Supabase: when a client logs in she can see everyone's appointments, not just hers

Replies

1. N

   Nikhil @nikhiliOS developer · uses Supabase

   Helped

   RLS being on isn't enough, you need a policy that says who can read what. On the appointments table add a select policy with auth.uid() = client_id (whatever your column is called). Right now you probably have a policy that just says true, which means everyone.

   Sep 10Maya R., Mikey B., Noelle and others agree
2. M

   Mikey B. @mikey-bSolo SaaS founder · uses Supabase

   Helped

   And your admin view being empty is the same thing from the other side. You need a second policy for your own account, or a role column. Don't turn RLS off to fix it, that's the trap.

   Sep 10Rowan D., Nikhil and Odalys agree
3. M

   Maya R. @maya-rProduct designer · uses Lovable and Supabase

   Paste the policy into Claude with your table columns and ask it to explain in plain english what each line lets through. That's how I finally got it, the Supabase docs assume you already know SQL.

   Sep 12Odalys and Noelle agree
4. R

   Rowan D. @rowan-dPhysiotherapist · uses Supabase

   One more: if Lovable put the fetch in an edge function it might be using the service role key, and that bypasses RLS entirely. Check which key the query actually runs with.

   Sep 11Nikhil agrees
5. N

   Noelle @noelleFlorist · uses Lovable and Supabase

   same problem, following. I didn't even know clients could see each other's until I read this

   Sep 12