You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Under certain conditions a client with a service role key can not circumvent RLS policy restrictions on web.
To Reproduce
Add the following code to a flutter project:
// integration_test/supabase_test.dartimport'package:flutter/material.dart';
import'package:flutter_test/flutter_test.dart';
import'package:integration_test/integration_test.dart';
import'package:supabase_flutter/supabase_flutter.dart'as supabase;
voidmain() async {
IntegrationTestWidgetsFlutterBinding.ensureInitialized();
testWidgets('Analytics', (WidgetTester tester) async {
final client1 = supabase.SupabaseClient(
getSupabaseUrl(),
getSupabaseKey(role:'service'),
);
final client2 = supabase.SupabaseClient(
getSupabaseUrl(),
getSupabaseKey(),
);
await tester.pumpWidget(
constMaterialApp(
home:Scaffold(
body:Center(child:Text('Hello')),
),
),
);
// Commenting out this line makes the test passawait client2.auth.signInAnonymously();
// Commenting out this line makes the test passawait client1.from('session_events').select();
final events =await client1.from('session_events').select();
expect(events, isNotEmpty, reason:'Session events empty');
});
}
Create a table "session_events" that has an RLS policy preventing everyone from reading it.
Run the test on Linux with flutter test -d linux integration_test and on Chrome with flutter drive --driver=test_driver/integration_test.dart --target=integration_test/supabase_test.dart -d web-server --browser-name chrome --no-headless. Make sure to first start ChromeDriver on port 4444.
Observed behavior
Run on Chrome -> The test fails
Run on Linux -> The test passes
Comment out the anonymous sign-in -> The test passes
Comment out the first read -> The test passes
Run on Chrome with version 2.6.0 -> Test passes
Version (please complete the following information):
I'm pretty sure this is because on web session changes are broadcasted to other instances to affect other tabs.
I briefly discussed an option to disable this behavior here
So I will once again think about how we should handle this and hopefully fix this unintended behavior.
Describe the bug
Under certain conditions a client with a service role key can not circumvent RLS policy restrictions on web.
To Reproduce
Add the following code to a flutter project:
Create a table "session_events" that has an RLS policy preventing everyone from reading it.
Run the test on Linux with
flutter test -d linux integration_test
and on Chrome withflutter drive --driver=test_driver/integration_test.dart --target=integration_test/supabase_test.dart -d web-server --browser-name chrome --no-headless
. Make sure to first start ChromeDriver on port 4444.Observed behavior
Version (please complete the following information):
The text was updated successfully, but these errors were encountered: