Permissions denied for table using API but works with SupabaseClient

Bug report

Describe the bug

When trying to access data from some API endpoints, like this: /rest/v1/leads?select=* I get this error:

{
    "message": "permission denied for table leads",
    "code": "42501",
    "hint": null,
    "details": null
}

when doing the same using JS client like this:

const { data, error } = await supabase
            .from('leads')
            .select()

I successfully get the data. Although enabling or disabling RLS has no impact.

I’m using the same anon API key in both situations.

To Reproduce

I am creating these tables using the following function:

BEGIN
EXECUTE format('
      CREATE TABLE IF NOT EXISTS %I (
       id serial PRIMARY KEY,
       created_at date default current_timestamp
      )', my_table);

EXECUTE format('
      ALTER TABLE %I ENABLE ROW LEVEL SECURITY;
', my_table);    

END

I tried to enable and disable RLS from UI and from SQL editor but didn’t change anything. I also tried to use the service role KEY when using API, but the same error above showed.

When creating the tables from the UI, everything seems to work as intended.

Expected behavior

I was expecting to be able to create tables programmatically from the client-side so I’m trying to do it using functions. I’m using the function like this:

 const { data, error } = await supabase
            .rpc('create_table', { my_table: table_name })

Am I missing something?

[w3b6x9]

hello everyone!

posting a retroactive fix that you will be able to apply to your projects

if you’re currently blocked please run the following in your Supabase SQL editor:

GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role, dashboard_user;

ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
ALTER function net.http_collect_response(request_id bigint, async boolean) SECURITY DEFINER;

REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
REVOKE ALL ON FUNCTION net.http_collect_response(request_id bigint, async boolean) FROM PUBLIC;

GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role, dashboard_user;
GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role, dashboard_user;
GRANT EXECUTE ON FUNCTION net.http_collect_response(request_id bigint, async boolean) TO supabase_functions_admin, postgres, anon, authenticated, service_role, dashboard_user;

[dstroot]

1. @w3b6x9 your fix works! Kudos.
2. This definitely happens after your project is paused (and you have hooks in place I think)