fix rls policies for multiple functions

Author: matteyu

prisma/migrations/20250221160426_user_trigger/migration.sql

@@ -5,86 +5,245 @@
 -- potentially functions (once we get into RLS functionality). So, for now at least, it seems more
 -- practical to add the triggers conditionally.
 
--- These triggers automatically create and update a UserProfile when a new user signs up via Supabase Auth.
+-- These triggers automatically create and update a Profile when a new user is created via Supabase Auth.
 -- See https://supabase.com/docs/guides/auth/managing-user-data#using-triggers for more details.
 
--- inserts a row into public.UserProfiles
-
-create function public.handle_new_user()
-returns trigger as $$
-begin
-    insert into public."UserProfiles" ("supId", "supEmail", "supPhone", "name", "email", "phone", "picture", "updatedAt")
-    values (new.id, new.email, new.phone, new.raw_user_meta_data->>'full_name', new.email, new.phone, coalesce(new.raw_user_meta_data->>'avatar_url', new.raw_user_meta_data->>'picture'), now());
-    return new;
-end;
-
--- trigger the function above every time an auth.user is created
-
--- $$ language plpgsql security definer;
--- create trigger on_auth_user_created
---     after insert on auth.users
---     for each row execute procedure public.handle_new_user();
-
+-- Create function to handle new users
+DROP FUNCTION IF EXISTS public.handle_new_user();
+CREATE OR REPLACE FUNCTION public.handle_new_user()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  INSERT INTO "UserProfiles" ("supId", "supEmail", "supPhone", "name", "email", "phone", "picture", "updatedAt")
+  VALUES (
+    NEW.id,
+    NEW.email,
+    NEW.phone,
+    COALESCE(NEW.raw_user_meta_data->>'full_name', NEW.raw_user_meta_data->>'name', ''),
+    NEW.email,
+    NEW.phone,
+    COALESCE(NEW.raw_user_meta_data->>'avatar_url', NEW.raw_user_meta_data->>'picture', ''),
+    NOW()
+  ) ON CONFLICT ("supId") DO NOTHING;
+  RETURN NEW;
+END;
+$$;
+
+-- Create function to handle user updates
+DROP FUNCTION IF EXISTS public.handle_user_update();
+CREATE OR REPLACE FUNCTION public.handle_user_update()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  UPDATE "UserProfiles"
+  SET
+    "supEmail" = NEW.email,
+    "supPhone" = NEW.phone,
+    "name" = COALESCE(NEW.raw_user_meta_data->>'full_name', NEW.raw_user_meta_data->>'name', "name"),
+    "email" = COALESCE(NEW.email, "email"),
+    "phone" = COALESCE(NEW.phone, "phone"),
+    "picture" = COALESCE(NEW.raw_user_meta_data->>'avatar_url', NEW.raw_user_meta_data->>'picture', "picture"),
+    "updatedAt" = NOW()
+  WHERE "supId" = NEW.id;
+  RETURN NEW;
+END;
+$$;
+
+-- Add explicit policy for triggers to bypass RLS
 DO $$
 BEGIN
-    IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'auth') THEN
-        EXECUTE 'CREATE TRIGGER on_auth_user_created
-                  AFTER INSERT ON auth.users
-                  FOR EACH ROW EXECUTE PROCEDURE public.handle_new_user();';
+  -- Check if the UserProfiles table exists
+  IF EXISTS (
+    SELECT 1 
+    FROM pg_catalog.pg_class c
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relname = 'UserProfiles' 
+    AND n.nspname = 'public'
+  ) THEN
+    -- Check if the policy already exists
+    IF NOT EXISTS (
+      SELECT 1 
+      FROM pg_catalog.pg_policy p
+      JOIN pg_catalog.pg_class c ON p.polrelid = c.oid
+      JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid
+      WHERE p.polname = 'Allow triggers to manage UserProfiles'
+      AND c.relname = 'UserProfiles'
+      AND n.nspname = 'public'
+    ) THEN
+      -- Create the policy
+      EXECUTE 'CREATE POLICY "Allow triggers to manage UserProfiles" ON "UserProfiles" USING (true) WITH CHECK (true)';
     END IF;
+  END IF;
 END $$;
 
--- updates a public.UserProfiles' email and phone
-
-create or replace function public.handle_update_user_email_n_phone()
-returns trigger as $$
-begin
-    update public."UserProfiles"
-    set
-      "supEmail" = coalesce(new.email, "supEmail"),
-      "supPhone" = coalesce(new.phone, "supPhone")
-    where "supId" = new.id;
-    return new;
-end;
-
--- trigger the function above every time an auth.user's email or phone are updated
+-- Create a single procedure to manage setting up and removing triggers
+DROP PROCEDURE IF EXISTS public.manage_user_triggers();
+CREATE OR REPLACE PROCEDURE public.manage_user_triggers()
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  auth_schema_exists BOOLEAN;
+BEGIN
+  -- Check if auth schema exists (will be false in shadow database)
+  BEGIN
+    SELECT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'auth') INTO auth_schema_exists;
+  EXCEPTION WHEN OTHERS THEN
+    -- If an error occurs during the check, assume auth schema doesn't exist
+    RAISE NOTICE 'Error checking for auth schema: %, assuming it does not exist', SQLERRM;
+    auth_schema_exists := FALSE;
+  END;
+
+  IF auth_schema_exists THEN
+    BEGIN
+      -- Remove any existing triggers first
+      EXECUTE 'DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+              DROP TRIGGER IF EXISTS on_auth_user_updated ON auth.users;';
+      
+      -- Create the triggers
+      EXECUTE 'CREATE TRIGGER on_auth_user_created
+                AFTER INSERT ON auth.users
+                FOR EACH ROW EXECUTE FUNCTION public.handle_new_user();
+              
+              CREATE TRIGGER on_auth_user_updated
+                AFTER UPDATE ON auth.users
+                FOR EACH ROW EXECUTE FUNCTION public.handle_user_update();';
+      
+      -- Grant necessary permissions
+      BEGIN
+        EXECUTE 'GRANT EXECUTE ON FUNCTION public.handle_new_user TO authenticated;
+                GRANT EXECUTE ON FUNCTION public.handle_new_user TO service_role;
+                GRANT EXECUTE ON FUNCTION public.handle_user_update TO authenticated;
+                GRANT EXECUTE ON FUNCTION public.handle_user_update TO service_role;';
+      EXCEPTION
+        WHEN insufficient_privilege THEN
+          RAISE NOTICE 'Could not grant EXECUTE permission to roles. This is expected in the shadow database.';
+        WHEN OTHERS THEN
+          RAISE NOTICE 'Error granting permissions: %', SQLERRM;
+      END;
+    EXCEPTION
+      WHEN OTHERS THEN
+        RAISE NOTICE 'Error creating triggers: %. This is expected in the shadow database.', SQLERRM;
+    END;
+  ELSE
+    RAISE NOTICE 'Auth schema does not exist. Skipping trigger creation.';
+  END IF;
+END;
+$$;
+
+-- Call the procedure to set up the triggers using a DO block instead of CALL
+DO $$
+BEGIN
+  PERFORM public.manage_user_triggers();
+EXCEPTION
+  WHEN OTHERS THEN
+    RAISE NOTICE 'Error calling manage_user_triggers: %. This is expected in the shadow database.', SQLERRM;
+END $$;
 
--- $$ language plpgsql security definer set search_path = public;
--- create trigger on_auth_user_updated
---     after update of email, phone on auth.users
---   for each row execute procedure public.handle_update_user_email_n_phone();
+-- Drop the procedure as we no longer need it after migration
+DROP PROCEDURE IF EXISTS public.manage_user_triggers();
 
+-- Create policies to allow users to manage their own profiles 
+-- These need to align with the RLS policies in enable_rls migration
+-- RLS policies don't reference the auth schema directly, so they can be defined unconditionally
 DO $$
+DECLARE
+  auth_fn_exists BOOLEAN;
 BEGIN
-    IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'auth') THEN
-        EXECUTE 'CREATE TRIGGER on_auth_user_updated
-                  AFTER UPDATE OF email, phone ON auth.users
-                  FOR EACH ROW EXECUTE PROCEDURE public.handle_update_user_email_n_phone();';
+    -- Check if auth.uid() function exists
+    BEGIN
+      SELECT EXISTS (
+        SELECT 1 FROM pg_proc p
+        JOIN pg_namespace n ON p.pronamespace = n.oid
+        WHERE n.nspname = 'auth' AND p.proname = 'uid'
+      ) INTO auth_fn_exists;
+    EXCEPTION
+      -- Use standard SQLSTATE error codes instead of named exceptions
+      WHEN SQLSTATE '3F000' THEN -- schema does not exist
+        auth_fn_exists := FALSE;
+      WHEN OTHERS THEN
+        RAISE NOTICE 'Error checking for auth.uid(): %, assuming it does not exist', SQLERRM;
+        auth_fn_exists := FALSE;
+    END;
+
+    -- Only attempt to create policies if auth.uid() exists
+    IF auth_fn_exists THEN
+      BEGIN
+        -- Only add the policies if they don't exist already
+        IF NOT EXISTS (SELECT 1 FROM pg_policy WHERE polname = 'Users can create their own profiles') THEN
+            EXECUTE $new_policies$
+            -- Create policy allowing users to create their own profiles
+            CREATE POLICY "Users can create their own profiles" ON "UserProfiles"
+              FOR INSERT 
+              WITH CHECK (auth.uid() = "supId");
+            $new_policies$;
+        END IF;
+        
+        -- Only add the policy if it doesn't exist and doesn't conflict with enable_rls
+        IF NOT EXISTS (SELECT 1 FROM pg_policy WHERE polname = 'Users can view their own profiles') THEN
+            EXECUTE $new_policies$
+            -- Create policy allowing users to view their own profiles 
+            CREATE POLICY "Users can view their own profiles" ON "UserProfiles"
+              FOR SELECT USING (auth.uid() = "supId");
+            $new_policies$;
+        END IF;
+        
+        -- Only add the policy if it doesn't exist and doesn't conflict with enable_rls
+        IF NOT EXISTS (SELECT 1 FROM pg_policy WHERE polname = 'Users can update their own profile data') THEN
+            EXECUTE $new_policies$
+            -- Create policy allowing users to update their own profiles
+            CREATE POLICY "Users can update their own profile data" ON "UserProfiles"
+              FOR UPDATE 
+              USING (auth.uid() = "supId")
+              WITH CHECK (auth.uid() = "supId");
+            $new_policies$;
+        END IF;
+      EXCEPTION
+        WHEN OTHERS THEN
+          RAISE NOTICE 'Error creating RLS policies: %. This is expected in the shadow database.', SQLERRM;
+      END;
+    ELSE
+      RAISE NOTICE 'auth.uid() function does not exist. Skipping RLS policy creation.';
     END IF;
 END $$;
 
-
 -- Create a trigger to handle the deletion of a user
-
-create or replace function public.handle_delete_user()
-returns trigger as $$
-begin
-    delete from public."UserProfiles" where "supId" = old.id;
-    return old;
-end;
+CREATE OR REPLACE FUNCTION public.handle_delete_user()
+RETURNS TRIGGER AS $$
+BEGIN
+    DELETE FROM public."UserProfiles" WHERE "supId" = OLD.id;
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
 
 -- Trigger the function above every time an auth.user is deleted
-
--- $$ language plpgsql security definer set search_path = public;
--- create trigger on_auth_user_deleted
---     after delete on auth.users
---     for each row execute procedure public.handle_delete_user();
-
 DO $$
+DECLARE
+  auth_schema_exists BOOLEAN;
 BEGIN
-    IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'auth') THEN
-        EXECUTE 'CREATE TRIGGER on_auth_user_deleted
-                  AFTER DELETE ON auth.users
-                  FOR EACH ROW EXECUTE PROCEDURE public.handle_delete_user();';
+    BEGIN
+      SELECT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'auth') INTO auth_schema_exists;
+    EXCEPTION WHEN OTHERS THEN
+      auth_schema_exists := FALSE;
+    END;
+
+    IF auth_schema_exists THEN
+        BEGIN
+          -- Drop trigger if it exists to avoid conflicts
+          EXECUTE 'DROP TRIGGER IF EXISTS on_auth_user_deleted ON auth.users;';
+          
+          -- Create the trigger
+          EXECUTE 'CREATE TRIGGER on_auth_user_deleted
+                    AFTER DELETE ON auth.users
+                    FOR EACH ROW EXECUTE PROCEDURE public.handle_delete_user();';
+        EXCEPTION
+          WHEN OTHERS THEN
+            RAISE NOTICE 'Error creating delete trigger: %. This is expected in the shadow database.', SQLERRM;
+        END;
+    ELSE
+      RAISE NOTICE 'Auth schema does not exist. Skipping delete trigger creation.';
     END IF;
 END $$;

prisma/migrations/20250224065512_session_trigger/migration.sql

@@ -8,6 +8,33 @@
 -- These triggers automatically create and update a Session when a new session is created via Supabase Auth.
 -- See https://supabase.com/docs/guides/auth/managing-user-data#using-triggers for more details.
 
+-- Add explicit policy for triggers to bypass RLS for Sessions
+DO $$
+BEGIN
+  -- Check if the Sessions table exists
+  IF EXISTS (
+    SELECT 1 
+    FROM pg_catalog.pg_class c
+    JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relname = 'Sessions' 
+    AND n.nspname = 'public'
+  ) THEN
+    -- Check if the policy already exists
+    IF NOT EXISTS (
+      SELECT 1 
+      FROM pg_catalog.pg_policy p
+      JOIN pg_catalog.pg_class c ON p.polrelid = c.oid
+      JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid
+      WHERE p.polname = 'Allow triggers to manage Sessions'
+      AND c.relname = 'Sessions'
+      AND n.nspname = 'public'
+    ) THEN
+      -- Create the policy
+      EXECUTE 'CREATE POLICY "Allow triggers to manage Sessions" ON "Sessions" USING (true) WITH CHECK (true)';
+    END IF;
+  END IF;
+END $$;
+
 -- Utility function to ensure a user profile exists
 DROP FUNCTION IF EXISTS public.ensure_user_profile;
 CREATE OR REPLACE FUNCTION public.ensure_user_profile(user_id UUID)