"session_user" value is inconsistent between hosted and local versions

Bug report

I have a psql function which references the “session_user” variable to differentiate between being called by an authenticated user and a trigger. The function is “is_claims_admin()” from this guide;

I noticed my rls policies were passing on local and failing on dev. After troubleshooting this on discord, I noticed that my hosted production isntance is returning “authenticator” for the session_user value while my local dev is returning “postgres”.

Steps to reproduce:

1. Create a local supabase instance: supabase init (for local)
2. Create a function which can be used to get the value of session_user with an authenticated session:

CREATE OR REPLACE FUNCTION public.sesh()
	RETURNS text
	LANGUAGE plpgsql
AS $function$
	BEGIN
		return session_user;
	END;
$function$

1. Create a user on the supabase instance:

curl -X POST 'http://localhost:54321/auth/v1/signup' \
-H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24ifQ.625_WdcF3KHqz5amU0x2X5WWHP-OEs_4qj0ssLNHzTs" \
-H "Content-Type: application/json" \
-d '{
  "email": "[e-mail]",
  "password": "eORzCgpVRYTyIVmipLnY"
}'

1. Sign in as the user and get the jwt:

curl -X POST 'http://localhost:54321/auth/v1/token?grant_type=password' \
-H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24ifQ.625_WdcF3KHqz5amU0x2X5WWHP-OEs_4qj0ssLNHzTs" \
-H "Content-Type: application/json" \
-d '{
  "email": "[e-mail]",
  "password": "eORzCgpVRYTyIVmipLnY"
}'

1. Issue a rest api call with the jwt and call the function:

curl -X POST 'http://localhost:54321/rest/v1/rpc/sesh' \
-H "Content-Type: application/json" \
-H "apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24ifQ.625_WdcF3KHqz5amU0x2X5WWHP-OEs_4qj0ssLNHzTs" \
-H "Authorization: Bearer ${USER_JWT_HERE}"

1. Observe that the output is “postgres”
2. Repeat steps with a hosted isntance of supabase
3. Observer that the output is “authenticator”

Expected behavior

Supabase hosted and local versions should behave the same in order for local dev environments to be useful.

System information

• OS: macOS 13.0.1
• Version of supabase-cli: 1.14.3

[point-source]

@barbinbrad Well you can sort of workaround it by changing the $POSTGRES_USER env variable on the db container but that’s not particularly streamlined vs running the supabase cli

[barbinbrad]

@barbinbrad Well you can sort of workaround it by changing the $POSTGRES_USER env variable on the db container but that’s not particularly streamlined vs running the supabase cli

Thank you!