Realtime RLS does not work if I don't explicitly setAuth

[bukacdan]

Bug report

Describe the bug

I have valid session in supabase.auth, however if I subscribe to a channel, I'm not getting any data, because of RLS.
If I use supabase.realtime.setAuth with the access token, that has already been in the auth.session, the data starts coming.

To Reproduce

1. create table public.test with column uid (so the RLS can be set so users can only read their data)
2. allow realtime
3. set auth policy so that users can only read their data
4. sign in user in your codebase, so that you have valid supabase.auth.getSession

const channel = supabase.channel("premium").on(
        'postgres_changes',
        { event: 'UPDATE', schema: 'public', table: 'test'},
        (payload) => {
            console.log("Premium change payload", payload);
        }
    ).subscribe((status, err) => {
        if (err) {
            console.error("Error subscribing to premium channel", err);
        }
        console.log("Subscription status", status);
    })

this code won't reliably receive updates for the signed in user in the public.test table. However if we add something like this, the data starts coming.

    const { data, error } = await supabase.auth.getSession();
    if (error || !data) {
        console.error("Error getting session", error);
        return;
    }
    supabase.realtime.setAuth(data.session.access_token);

Expected behavior

I was expecting that the session is propagated automatically. I only found this reference in documentation, but that's referring to custom tokens, but this happened for regular supabase sign in without no custom tokens. So either the auth should be propagated to realtime automatically or add mention do documentation to always use setAuth for realtime.

System information

• OS: macOS
• Browser: electron
• Version of supabase-js: [2.45.2]
• Version of Node.js: [16]

Additional context

Add any other context about the problem here.

[xxRockOnxx]

this is still happening it bit me for hours now.

took a lot to figure out where it went wrong until i dug the source for the sdk.

manually setting it via setAuth() works but also for some reason while I was still investigating, after some time, it works.

now since I've dug the source, the heartbeat sent after 30s also does the same thing.

[pierroo]

I am also facing this unexpected behavior.
Did you guys learn more about it since?
are we really supposed to call supabase.realtime.setAuth now for realtime to work through RLS?

[prilepskiy]

hello?

[Andras1000]

Same issue on supabase-js@2.57.4. It works with supabase.realtime.setAuth().

[mandarini]

This should have been fixed in latest version. Can you please check?

[aaronzhongg]

I'm still getting this error with "@supabase/supabase-js": "^2.80.0".

I wouldn't mind it having to set the token as a workaround, however it only works when I land on the page via a browser refresh. If I navigate to it from another page I get this error Error: mismatch between server and client bindings for postgres changes

EDIT: The error is from the component being rendered twice due to react strict mode. Although not ideal, I've temporarily disabled react strict mode, but still need to call supabase.realtime.setAuth() prior to subscribing