Permissions issue for postgres user on auth table objects (unable to drop triggers)

Bug report

Describe the bug

The supabase examples sometimes take advantage of creating a trigger against the auth.users table - so that on sign up (or update of user information) you can also subsequently populate another table (e.g. your own application’s public.profile table via a function that is called from the trigger).

To do this, supabase provides a postgres db user. In the default setup, the postgres user is able to create a trigger on auth.users.

To Reproduce

Connect to your supabase db using the postgres user with the connection details provided by supabase console.

Create a function to populate your own profile table when a user signs up.

create or replace function public.handle_new_user() returns trigger as $$ begin insert into public.users (id, email) values (new.id, new.email); return new; end; $$ language plpgsql security definer;

Works fine.

Now add a trigger to call this function when data is inserted into auth.users

create trigger on_auth_user_created after insert on auth.users for each row execute procedure public.handle_new_user();

Works fine.

However, subsequently try and drop the trigger.

drop trigger if exists on_auth_user_created on auth.users;

This errors with

ERROR: must be owner of relation users

Understandably the internal auth schema is owned by a separate internal account supabase_auth_admin but some looks like perhaps the permission to create trigger has been granted to postgres user but not drop.

Expected behavior

Should be able to drop the trigger after creating it.

Screenshots

If applicable, add screenshots to help explain your problem.

[kiwicopple]

We discussed this internally and think we have a solution using our supautils extension. I’ll update once we have tested a few ideas

[evhan]

FWIW dropping any functions you’ve hooked up as triggers on auth.users with CASCADE seems to do the trick:

postgres=> drop function if exists handle_new_user() cascade;
NOTICE:  drop cascades to trigger on_auth_user_created on table auth.users
DROP FUNCTION

Hopefully this will help someone in the meantime.