mirror of
https://github.com/supabase/supabase.git
synced 2026-09-08 19:08:44 +08:00
01d12e83c1
The 47 BigQuery-era logs queries across these 20 pages error on the
ClickHouse-backed logs engine ("Backend error! Retry your query."). This
converts them per the rules in `apps/studio/lib/ai/clickhouse-logs.ts`
and repoints every Logs Explorer link at the SQL Editor with the query
source set to **Logs**, since the Logs Explorer is being retired. Also
fixes two stale PostgreSQL 12 links in the tables guide.
Each of the 14 prefilled links was verified to decode back to exactly
the SQL shown on its page. One caveat for review:
`response.headers.proxy_status` in `postgrest-error-codes.mdx` is
unverified — it isn't in the published field reference, and the test
project had no `edge_logs` traffic to confirm against.
Fixes DOCS-1331
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Documentation**
- Updated database, storage, API, and Edge Function logging guides to
use the SQL Editor and current Logs interface.
- Replaced legacy Log Explorer and BigQuery examples with current query
syntax and structured log fields.
- Refreshed troubleshooting queries for error diagnosis, filtering,
aggregation, and performance analysis.
- Improved examples with clearer source filters, status handling,
request details, joins, and result limits.
- Updated PostgreSQL documentation links and clarified how API error
codes appear in responses.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jordi Enric <jordi.err@gmail.com>
87 lines
4.1 KiB
Plaintext
87 lines
4.1 KiB
Plaintext
---
|
|
title = "Database API 42501 errors"
|
|
topics = [ "database" ]
|
|
github_url = "https://github.com/orgs/supabase/discussions/31293"
|
|
database_id = "49b51a3a-9753-4747-a24e-8afcb075792b"
|
|
|
|
[[errors]]
|
|
http_status_code = 401
|
|
code = "42501"
|
|
|
|
[[errors]]
|
|
http_status_code = 403
|
|
code = "42501"
|
|
---
|
|
|
|
[Postgres 42501 errors](https://www.postgresql.org/docs/current/errcodes-appendix.html), often reported by clients as 401 or 403 errors, imply the request lacked adequate privileges. They can be viewed in the [SQL Editor](/dashboard/project/_/sql/new?skip=true&source=logs&content=select%0A%20%20timestamp%2C%0A%20%20event_message%2C%0A%20%20log_attributes%5B%27parsed.error_severity%27%5D%20as%20error_severity%2C%0A%20%20log_attributes%5B%27parsed.user_name%27%5D%20as%20user_name%2C%0A%20%20log_attributes%5B%27parsed.query%27%5D%20as%20query%2C%0A%20%20log_attributes%5B%27parsed.detail%27%5D%20as%20detail%2C%0A%20%20log_attributes%5B%27parsed.hint%27%5D%20as%20hint%0Afrom%20logs%0Awhere%0A%20%20source%20%3D%20%27postgres_logs%27%0A%20%20and%20log_attributes%5B%27parsed.error_severity%27%5D%20in%20%28%27ERROR%27%2C%20%27FATAL%27%2C%20%27PANIC%27%29%0A%20%20and%20log_attributes%5B%27parsed.sql_state_code%27%5D%20%3D%20%2742501%27%0Aorder%20by%20timestamp%20desc%0Alimit%20100%3B) by running:
|
|
|
|
```sql
|
|
select
|
|
timestamp,
|
|
event_message,
|
|
log_attributes['parsed.error_severity'] as error_severity,
|
|
log_attributes['parsed.user_name'] as user_name,
|
|
log_attributes['parsed.query'] as query,
|
|
log_attributes['parsed.detail'] as detail,
|
|
log_attributes['parsed.hint'] as hint
|
|
from logs
|
|
where
|
|
source = 'postgres_logs'
|
|
and log_attributes['parsed.error_severity'] in ('ERROR', 'FATAL', 'PANIC')
|
|
and log_attributes['parsed.sql_state_code'] = '42501'
|
|
order by timestamp desc
|
|
limit 100;
|
|
```
|
|
|
|
They tend to be caused by one of the following factors.
|
|
|
|
## Attempted to access a forbidden schema
|
|
|
|
API roles cannot access certain schemas, most notably `auth` and `vault`. This restriction extends to Foreign Data Wrappers relying on `vault`. While you can bypass it using a [security definer function](/docs/guides/database/functions?queryGroups=language&language=sql&queryGroups=example-view&example-view=sql#security-definer-vs-invoker), these schemas are intentionally restricted for security reasons.
|
|
|
|
## Attempted to access a custom schema
|
|
|
|
If you created a custom schema, you will have to give the Database API permission to query it. Follow our [Using Custom Schemas guide](/docs/guides/api/using-custom-schemas) for more directions.
|
|
|
|
## Missing table-level privileges
|
|
|
|
If you see an error like `permission denied for table your_table`, the querying role may not have the required privilege for the operation.
|
|
|
|
By default, tables in the `public` schema are granted `SELECT`, `INSERT`, `UPDATE`, and `DELETE` to the `anon` and `authenticated` roles. However, you can change these privileges in the [**Integrations > Data API**](/dashboard/project/_/integrations/data_api/settings) section of the Dashboard or via SQL.
|
|
|
|
To check the current privileges on a table:
|
|
|
|
```sql
|
|
select grantee, privilege_type
|
|
from information_schema.role_table_grants
|
|
where table_name = 'your_table';
|
|
```
|
|
|
|
To grant a specific privilege to a role:
|
|
|
|
```sql
|
|
grant select on table public.your_table to anon;
|
|
```
|
|
|
|
To grant all privileges:
|
|
|
|
```sql
|
|
grant select, insert, update, delete on table public.your_table to anon, authenticated;
|
|
```
|
|
|
|
<Admonition type="note">
|
|
|
|
Granting privileges allows access to your table through the Data API, so you should ensure you [enable RLS](/docs/guides/database/postgres/row-level-security) and write appropriate policies to protect your data.
|
|
|
|
For more information, see [Securing your API](/docs/guides/api/securing-your-api).
|
|
|
|
</Admonition>
|
|
|
|
## Configured column-level restrictions
|
|
|
|
If you've set column-based access in the [Dashboard](/dashboard/project/_/database/column-privileges) or via SQL, queries will fail with a `42501` error when accessing restricted columns. This includes using `select *`, as it expands to include forbidden columns.
|
|
|
|
## RLS:
|
|
|
|
If the anon or authenticated roles attempt to UPDATE or INSERT values without the necessary RLS permissions, Postgres will return a 42501 error.
|