RPC fails when using an extension feature inside Postgres stored function

Bug report

Describe the bug

When attempting to call a Postgres stored function which utilizes an extension function via .rpc(), the response fails and returns 404

To Reproduce

I have created a stored function called search_stations inside Postgres. It accepts 2 parameters - search_value TEXT and result_limit INTEGER. It returns a TABLE, and all returned fields and types are correctly defined.

This function uses the SIMILARITY function, as well as the distance (<->) operator, both from the pg_trgm extension. This extension shows as enabled in the dashboard.

I have verified that results return correctly when running the following query from within pgAdmin as well as the Supabase dashboard:

SELECT * FROM search_stations('Leeds', 10)

However, when I do the following inside my codebase using supabase-js:

await SupabaseClient.rpc("search_stations", {
    search_value: "Leeds",
    result_limit: 10
});

The following error occurs:

{
  "error": {
    "hint": "No function matches the given name and argument types. You might need to add explicit type casts.",
    "details": null,
    "code": "42883",
    "message": "function similarity(text, text) does not exist"
  },
  "data": null,
  "count": null,
  "status": 404,
  "statusText": "Not Found",
  "body": null
}

I am able to correctly call other stored functions in my database, but none of them utilize features from any extensions.

Expected behavior

The function should not throw an error and should instead return the results of the function.

Screenshots

N/A

System information

• OS: Windows 10 X64
• Browser (if applies): N/A - request running via Node (14.14.0)
• Version of supabase-js: 1.7.7
• Version of Node.js: 14.14.0

Additional context

I am able to correctly call other stored functions in my database and results are correctly returned, but none of those other functions utilize features from a extensions.

I have tried explicitly setting extensions.similarity for all the calls to similarity inside my function, but this returns the following when run via rpc():

{
  "error": {
    "hint": null,
    "details": null,
    "code": "42501",
    "message": "permission denied for schema extensions"
  },
  "data": null,
  "count": null,
  "status": 403,
  "statusText": "Forbidden",
  "body": null
}

[steve-chavez]

However, even after all that, running the same RPC call results in 403 (permission denied for schema extensions).

Hm, maybe you’re missing GRANT USAGE ON SCHEMA extensions TO service_role? (noted here)

Are there any potential downsides or security concerns with doing this?

No, granting usage to extensions is something we’re going to do for all projects on a later fix. You only need to make sure your public schema tables/views/functions are secured according to your application logic.

[ChronSyn]

However, even after all that, running the same RPC call results in 403 (permission denied for schema extensions).

Hm, maybe you’re missing GRANT USAGE ON SCHEMA extensions TO service_role? (noted here)

Yep - turns out that was the issue. Is that the user that RPC calls are routed through, and should I be concerned about it causing any potential security or performance issues?