Using supabase client in SvelteKit layout.server for RLS calls

[Etchelon]

Hello,
I have the following code working when invoked in layout.ts (which run the HTTP calls to PostgREST from the browser):

import { supabase } from "$lib/supabase";
import type { Session } from "@supabase/supabase-js";
import type { Role } from "./roles";

export const fetchUserRoles = async (userId: string): Promise<Role[]> => {
	const { data, error } = await supabase.from("user_roles").select("role_id").eq("user_id", userId);
	if (error) {
		console.error(error);
		return [];
	}

	return data.map(row => row.role_id) as Role[];
};

but if call the same fetchUserRoles function from a layout.server.ts file, passing the Session object returned by getServerSession, the query returns an empty set.

I realized it's due to the Authenticated RLS policy on selects against user_roles (it's the first table I'm protecting with such a policy).

I guess the call performed by the supabase client doesn't send the bearer token. I don't get why, since I have a Session... but anyway, I can't seem to find docs about how to make this work. Any pointers? The official docs only have an example usage from a layout.ts file, which works in my case.

[Etchelon]

For some reason I thought getSupabase was only invokable with a LoadEvent, but it also takes a ServerLoadEvent, so I was able to grab the authenticated client like that:

export const fetchLoggedUser = async (event: ServerLoadEvent): Promise<{ session: Session | null; loggedUser: ILoggedUser | null }> => {
	const { supabaseClient, session } = await getSupabase(event);
	if (!session) {
		return { session: null, loggedUser: null };
	}

	const [profile, roles] = await Promise.all([fetchProfile(session), fetchUserRoles(supabaseClient, session.user.id)]);
	return {
		session,
		loggedUser: {
			id: session.user.id,
			profile,
			roles,
		},
	};
};

I'm a bit concerned about having to do this every time I need to make authenticated calls on the server vs having a singleton supabase client as the documentation suggests, but at least for the moment I can keep tinkering with SvelteKit and Supabase.