Service Role does not work well in production.

[yarapolana]

I am using remix 2.8.1
and I used to make calls with service role and currently does not work in production environment

What am I doing:

• supabase.from('table-for-admin').select('') and this used to work fine until around a few weeks ago

What happens:

• I am using vercel and it simply fails with Function Invocation Failed / Timeout

Things I have tried

• Verified api keys are updated and correct
• Tried making different calls with service role:
  for example supabase.auth.admin - works (no vercel error) while supabase.from('users').select('') - does not work (vercel error)
• Updated remix to 2.9.2 no luck there
• Updated node version on vercel to 20 (no changes)
• Updated supabase and supabase-auth-helpers-remix

    "@supabase/auth-helpers-remix": "0.3.0",
    "@supabase/supabase-js": "2.39.3",

• Reconfigured supabse service role

  export const supabase = createClient<Database>(
    process.env.SUPABASE_URL,
    process.env.SUPABASE_SERVICE_ROLE_KEY,
    // added bellow
    {
      auth: {
        autoRefreshToken: false,
        persistSession: false
      },
      global: {
        headers: {
          Authorization: `Bearer ${process.env.SUPABASE_SERVICE_ROLE_KEY}`
        }
      }
    }
  )

Things I have not tried:

• Replicate this with a new remix project (due to vite integration)
• Refactor the production code to use @supabase/ssr due to time constrains with the production code

My questions is

• The documentations does not show service any use case with database calls (.from() .insert() etc) though it worked before, Is service role not supposed to be used for that? (my use case is admin operations and I need service_role bypass)

Any help is welcomed.

[GaryAustin1]

You use a supabase.js client for service_role. It needs to be a separate client from any auth-helpers/SSR clients. If for some reason you share the service role client with a user session then it is no longer service role.

[yarapolana]

Thanks for the reply. Yes, I am using '@supabase/supabase-js' for service role client configuration and auth-helper for user sessions.

To clarify I am only using the service role client for admin calls and nothing else (and this used to work) as of 2 weeks ago, nothing changed on my side, no updates, no upgrades, no code changes either. Started noticing this when Vercel started giving Function Invocation Failed errors and after a week of digging deep and trying to figure out what could have been the issue it was pointed down to 2 calls, the only calls that have service role supabase client.

I would assume if supabase service role was used with client/user sessions it would give me unauthorized responses instead of breaking the app, unless that is the desired effect.

[GaryAustin1]

Yes it would give unauthorized. Was not clear on your specific error.
So it is something else. I am no help at this point with Vercel and something that worked then stopped with no change. You might see if your dependencies changed to newer versions around the time frame of the error, but seems like you are on top of it.

[weilintuye95]

+1 Also encountering somewhat of the same issue when using service role client configuration to make admin calls in production. Unsure if it's fully related but figured I'd post in case my data point helps. My db call looks something like this:

const supabaseAdmin = createClient<Database>(
  process.env.NEXT_PUBLIC_SUPABASE_URL || '',
  process.env.SUPABASE_SERVICE_ROLE_KEY || ''
);

... async function definition...

await supabaseAdmin
      .from('')
      .select('')
      .eq('id', id)
      .single();

It works locally using the anon_key/service_role_key generated by the supabase status command. When I try this in production with the real anon_key/service_role_key from the Settings > API page, it doesn't work. I don't get an error or anything, my console.logs /try catch blocks do not log anything to vercel logs. It stops at the console.log right before the db call, and goes silent (i would expect a timeout error after a few mins but i don't get that either).

[GaryAustin1]

See the warnings here https://supabase.com/docs/reference/javascript/auth-onauthstatechange if you are using onAuthStateChange in your code elsewhere. If you make an SB call in that code it can "hang" another SB call in a different part of your code.

[yarapolana]

Well what a turn of events I just have been laid off and this was my first and only persistent issue that indirectly contributed to it.
Not looking for blaming anyone or anything just letting it out, sorry if it sounds that way.

I do love supabase and will continue to use in my future projects, not sure what to do with this issue since now I can't fix it. So let me know if I should close it and I will.

I will move forward!

[weilintuye95]

Aw sorry to hear that @yarapolana

@GaryAustin1 thanks for the tip -- I don't use onAuthStateChange at all, but i'll keep troubleshooting and reply here if it turns out I messed something up on my end.

[weilintuye95]

Resolved this issue for myself, turns out it was user error for me -- all I needed was a good night's sleep

[PeanutButte7]

@weilintuye95 How did you resolve the issue? I have the exact same problem but cannot figure it out.

I have an API route for webhooks where I fetch a profile via service client. I get no error, no response, my logs stop before the request and then nothing...

const supabase = createClient<Database>(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.SUPABASE_SERVICE_KEY!, {
    auth: {
      persistSession: false,
      autoRefreshToken: false,
      detectSessionInUrl: false,
    },
  });

 const { data: userData, error: userError } = await supabase
    .from("profiles")
    .select("*")
    .eq("id", userId)
    .limit(1)
    .single();