Skip to content

Security definer's 'new' object only has app_metadata after update not after insert #975

Description

@jopfre

Improve documentation

Link

https://supabase.com/docs/guides/auth/managing-user-data

Describe the problem

When following the managing user data > using triggers example it seems like all data will be available in the new object, just as new.id is after INSERT. In fact there are many tutorials on the internet which show how to add more data to a profiles table while referencing new.raw_user_meta_data. What is not clear from the supabase docs is that new.raw_app_meta_data will not contain any data added when createUser() is run. Instead this data will become available in a security definer triggered after an UPDATE.

@GaryAustin1 has clarified:

The issue is really that the insert to the database does not insert that column value and they do a 2nd update call to the database to put in the app_metadata. Has nothing to do with new/old and the type of function.

Describe the improvement

Add a warning to the tutorial that new.raw_app_meta_data will only be accessible in a function triggered by an UPDATE. Or alternatively make new.raw_app_meta_data available after INSERT inline with all other values which are passed on createUser() if this is not the intended behavior.

Additional context

Maybe related to this bug #628 as perhaps app_metadata was only inserted into auth.users but not made available in security definers. (I maybe be misunderstanding how postgres works though)

Here are my logs after running

const { data: { user }, error: createUserError, } = await serviceSupabase.auth.admin.createUser({ email, user_metadata: { first_name, last_name, job_title }, app_metadata: { role }, password: 'blahblah', email_confirm: true, });

Screenshot_2022-11-20_at_14 53 39

with two security definers one triggered after UPDATE and one after INSERT to auth.users

Metadata

Metadata

Assignees

Labels

authdocumentationImprovements or additions to documentation

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions