@supacloud/lite 0.5.7 → 0.5.8

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.5.8](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.7...supacloud-lite-v0.5.8) (2026-08-05)
+
+
+### Bug Fixes
+
+* **lite:** actionable hint when storage upload is denied by RLS ([2de9601](https://github.com/zuohuadong/supacloud/commit/2de96016c802f43a588e22e4dacc91d4efdaa1f3))
+
 ## [0.5.7](https://github.com/zuohuadong/supacloud/compare/supacloud-lite-v0.5.6...supacloud-lite-v0.5.7) (2026-08-05)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname5, join as join9, resolve as resolve4 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.5.7",
+  version: "0.5.8",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -6002,6 +6002,29 @@ function invalidObjectKey(key) {
 function storageError(status, error, message) {
   return json3(status, { statusCode: String(status), error, message });
 }
+var RLS_POLICY_HINT = "Upload denied by storage.objects RLS. Create a policy in supabase/migrations, e.g. " + "`create policy \"objects insert\" on storage.objects for insert to authenticated with check (bucket_id = '<bucket>');`. " + "Without a policy, RLS blocks every write by default.";
+
+class RlsPolicyError extends Error {
+  cause;
+  constructor(cause) {
+    super("storage.objects row-level security policy denied the write");
+    this.cause = cause;
+    this.name = "RlsPolicyError";
+  }
+}
+function rlsDeniedResponse() {
+  return storageError(403, "Unauthorized", RLS_POLICY_HINT);
+}
+function isRlsDenied(error) {
+  if (!error)
+    return false;
+  const pg = error;
+  if (pg.code === "42501")
+    return true;
+  if (error instanceof Error && /row-level security|permission denied/i.test(error.message))
+    return true;
+  return false;
+}
 function json3(status, body) {
   return new Response(JSON.stringify(body), {
     status,
@@ -6287,6 +6310,8 @@ class StorageHandler {
       const id = await this.persistObject(ctx, bucketId, key, bytes, contentType, cacheControl, upsert);
       return json3(200, { Key: `${bucketId}/${key}`, Id: id });
     } catch (e) {
+      if (e instanceof RlsPolicyError)
+        return rlsDeniedResponse();
       const pg = e;
       if (pg.code === "23505") {
         return storageError(409, "Duplicate", "The resource already exists");
@@ -6324,6 +6349,12 @@ class StorageHandler {
            values ($1, $2, $3, $4, $5::jsonb, $6) ${conflictClause} returning *`, [objectId, bucketId, key, ctx.claims?.sub ?? null, JSON.stringify(metadata), version]));
       inserted = result.rows[0];
     } catch (error) {
+      if (isRlsDenied(error)) {
+        try {
+          await this.driver.delete(stagedKey);
+        } catch {}
+        throw new RlsPolicyError(error);
+      }
       await this.discardStagedBytes(stagedKey, error);
     }
     if (!inserted)
@@ -6381,6 +6412,8 @@ class StorageHandler {
         try {
           await this.persistObject(ctx, bucketId, key, new Uint8Array, contentType, meta.cacheControl ?? "no-cache", upsert);
         } catch (error) {
+          if (error instanceof RlsPolicyError)
+            return rlsDeniedResponse();
           const pg = error;
           if (pg.code === "23505")
             return storageError(409, "Duplicate", "The resource already exists");
@@ -6511,6 +6544,8 @@ class StorageHandler {
       await this.persistObject(upload.ctx, upload.bucketId, upload.key, data, upload.contentType, upload.cacheControl, upload.upsert);
     } catch (e) {
       this.tusUploads.delete(id);
+      if (e instanceof RlsPolicyError)
+        return rlsDeniedResponse();
       const pg = e;
       if (pg.code === "23505")
         return storageError(409, "Duplicate", "The resource already exists");
@@ -6556,7 +6591,7 @@ class StorageHandler {
       if (pg.code === "23505")
         return storageError(409, "Duplicate", "The resource already exists");
       if (pg.code === "42501" || error instanceof Error && /row-level security|permission denied/i.test(error.message)) {
-        return storageError(403, "Unauthorized", "new row violates row-level security policy");
+        return rlsDeniedResponse();
       }
       throw error;
     }

package/dist/index.js

@@ -71,7 +71,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.5.7",
+  version: "0.5.8",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   type: "module",
   license: "Apache-2.0",
@@ -6007,6 +6007,29 @@ function invalidObjectKey(key) {
 function storageError(status, error, message) {
   return json3(status, { statusCode: String(status), error, message });
 }
+var RLS_POLICY_HINT = "Upload denied by storage.objects RLS. Create a policy in supabase/migrations, e.g. " + "`create policy \"objects insert\" on storage.objects for insert to authenticated with check (bucket_id = '<bucket>');`. " + "Without a policy, RLS blocks every write by default.";
+
+class RlsPolicyError extends Error {
+  cause;
+  constructor(cause) {
+    super("storage.objects row-level security policy denied the write");
+    this.cause = cause;
+    this.name = "RlsPolicyError";
+  }
+}
+function rlsDeniedResponse() {
+  return storageError(403, "Unauthorized", RLS_POLICY_HINT);
+}
+function isRlsDenied(error) {
+  if (!error)
+    return false;
+  const pg = error;
+  if (pg.code === "42501")
+    return true;
+  if (error instanceof Error && /row-level security|permission denied/i.test(error.message))
+    return true;
+  return false;
+}
 function json3(status, body) {
   return new Response(JSON.stringify(body), {
     status,
@@ -6292,6 +6315,8 @@ class StorageHandler {
       const id = await this.persistObject(ctx, bucketId, key, bytes, contentType, cacheControl, upsert);
       return json3(200, { Key: `${bucketId}/${key}`, Id: id });
     } catch (e) {
+      if (e instanceof RlsPolicyError)
+        return rlsDeniedResponse();
       const pg = e;
       if (pg.code === "23505") {
         return storageError(409, "Duplicate", "The resource already exists");
@@ -6329,6 +6354,12 @@ class StorageHandler {
            values ($1, $2, $3, $4, $5::jsonb, $6) ${conflictClause} returning *`, [objectId, bucketId, key, ctx.claims?.sub ?? null, JSON.stringify(metadata), version]));
       inserted = result.rows[0];
     } catch (error) {
+      if (isRlsDenied(error)) {
+        try {
+          await this.driver.delete(stagedKey);
+        } catch {}
+        throw new RlsPolicyError(error);
+      }
       await this.discardStagedBytes(stagedKey, error);
     }
     if (!inserted)
@@ -6386,6 +6417,8 @@ class StorageHandler {
         try {
           await this.persistObject(ctx, bucketId, key, new Uint8Array, contentType, meta.cacheControl ?? "no-cache", upsert);
         } catch (error) {
+          if (error instanceof RlsPolicyError)
+            return rlsDeniedResponse();
           const pg = error;
           if (pg.code === "23505")
             return storageError(409, "Duplicate", "The resource already exists");
@@ -6516,6 +6549,8 @@ class StorageHandler {
       await this.persistObject(upload.ctx, upload.bucketId, upload.key, data, upload.contentType, upload.cacheControl, upload.upsert);
     } catch (e) {
       this.tusUploads.delete(id);
+      if (e instanceof RlsPolicyError)
+        return rlsDeniedResponse();
       const pg = e;
       if (pg.code === "23505")
         return storageError(409, "Duplicate", "The resource already exists");
@@ -6561,7 +6596,7 @@ class StorageHandler {
       if (pg.code === "23505")
         return storageError(409, "Duplicate", "The resource already exists");
       if (pg.code === "42501" || error instanceof Error && /row-level security|permission denied/i.test(error.message)) {
-        return storageError(403, "Unauthorized", "new row violates row-level security policy");
+        return rlsDeniedResponse();
       }
       throw error;
     }

package/dist/runtime/storage/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/storage/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAQjD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE5E,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,uFAAuF;IACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAqGD,qEAAqE;AACrE,qBAAa,cAAc;IAKvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IANhB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAoB;gBAG9B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa;IAG/B,4FAA4F;IACtF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAazD,8GAA8G;IACxG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA6G9D,YAAY;IAgB1B,OAAO,CAAC,cAAc;YAOR,YAAY;YA2BZ,WAAW;YAKX,SAAS;YAMT,YAAY;YAqBZ,YAAY;YAYZ,WAAW;YAUX,UAAU;YAKV,MAAM;YAyDN,sBAAsB;IAgBpC,gFAAgF;YAClE,aAAa;YA2Cb,SAAS;IA6KvB,2EAA2E;YAC7D,SAAS;IA0CvB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,sBAAsB;YAMhB,oBAAoB;YA2CpB,QAAQ;YASR,cAAc;YAYd,WAAW;YAoBX,aAAa;YAeb,SAAS;YAUT,UAAU;YAuEV,gBAAgB;YAUhB,kBAAkB;YASlB,eAAe;YAKf,iBAAiB;YAcjB,WAAW;YAsDX,UAAU;YAyBV,OAAO;YAmBP,QAAQ;YAiBR,eAAe;YAef,aAAa;YAab,kBAAkB;IAehC,OAAO,CAAC,aAAa;CAUtB;AAsHD,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAqCnF"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/storage/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAQjD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE5E,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;IACjB,0GAA0G;IAC1G,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,uFAAuF;IACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAmID,qEAAqE;AACrE,qBAAa,cAAc;IAKvB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,MAAM;IANhB,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,YAAY,CAAoB;gBAG9B,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa;IAG/B,4FAA4F;IACtF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAazD,8GAA8G;IACxG,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YA6G9D,YAAY;IAgB1B,OAAO,CAAC,cAAc;YAOR,YAAY;YA2BZ,WAAW;YAKX,SAAS;YAMT,YAAY;YAqBZ,YAAY;YAYZ,WAAW;YAUX,UAAU;YAKV,MAAM;YA0DN,sBAAsB;IAgBpC,gFAAgF;YAClE,aAAa;YAiDb,SAAS;IA8KvB,2EAA2E;YAC7D,SAAS;IA2CvB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,sBAAsB;YAMhB,oBAAoB;YA2CpB,QAAQ;YASR,cAAc;YAYd,WAAW;YAoBX,aAAa;YAeb,SAAS;YAUT,UAAU;YAuEV,gBAAgB;YAUhB,kBAAkB;YASlB,eAAe;YAKf,iBAAiB;YAcjB,WAAW;YAsDX,UAAU;YAyBV,OAAO;YAmBP,QAAQ;YAiBR,eAAe;YAef,aAAa;YAab,kBAAkB;IAehC,OAAO,CAAC,aAAa;CAUtB;AAsHD,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,+FAA+F;AAC/F,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAqCnF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite",
   "type": "module",
   "license": "Apache-2.0",