Troubleshooting

Role is not allowed

Confirm that the selected table has an endpoint for the exact operation and that the endpoint includes the server-resolved role key. NONE is an explicit deny; an absent role is also rejected.

No allowed fields

Check the intersection of requested fields, allowed, and disallowed. For joined fields, inspect the policy on the joined table as well.

Policy does not match

Inspect resolved $user and $data values, table qualification, operator shape, and the logical combination of request filters with policy filters.

Unexpected row filtering

Remember that request and policy where expressions are combined. Temporarily reduce the case to one condition at a time in a non-production test environment.

Mutation rejects valid data

Verify the payload shape, whether data is an object or array, and whether transition logic compares the intended $data field to the correct current column.

Join fails

Only INNER and LEFT are exported join types. Confirm that both table names exist in the structure, every field exists in the Drizzle schema, and the role may access joined fields.

Trigger does not run

Check the trigger type, endpoint placement, and whether disable_triggers is enabled. Nested trigger queries may intentionally disable triggers to avoid recursion.

Phase order is surprising

Queries inside a TRANSACTION phase run sequentially. Separate top-level phases are constructed and executed through Promise.all; do not rely on ordering between them.

Debugging checklist

1. Reproduce with one table, endpoint, role, and field.
2. Validate the raw request against StructuredQuery.
3. Verify the authenticated user and role created by the server.
4. Inspect the relevant endpoint permission object.
5. Remove joins and triggers, then reintroduce them individually.
6. Run the closest repository test or add a denied-path regression test.
7. Capture internal errors securely without returning them to clients.

← Security · Develop VoidQL →