Issue with Private Access - Role-Based Redirection Not Working as Expected

[dereckbolsanelo]

Hi everyone,

I’m trying to use the private access feature, but I’m running into an issue.
The redirection is working as it should, but it seems that even when a user has the required role, they still can’t access the page.

In the image, you can see 3 roles created in Supabase (see image below):

And I’ve created 2 access groups based on these roles (see image below as well):

Even though my user clearly shows as having these two roles in Supabase (see image):

When the logged-in user tries to navigate to the page, they are redirected as if they don’t have the roles.

It was configured like this (access denied):

When I changed it back to this configuration, it worked normally (access granted):

What could be the issue?

I saw another post mentioning it could be related to the WeWeb plan. My WeWeb plan is the “Essencial” plan. However, if this feature isn’t included in my plan, why would it be available for me to configure?

Thanks

[Agustin_Carozo]

Hi Dereck, welcome to our community

Roles only work when your app is published, so you are going to need to preview this feature while the app is published.

I also created a tutorial for this:

Supabase roles, creating a client portal

Hello everyone I just recorded a long video going through how to create a client portal with role base visibility and blocking pages for specific roles like admin and user. Most of the work is based on the docs: Supabase authentication | Documentation But there is a lot of troubleshooting that will be super important for those trying to attempt this. Things like: Paying attention to your RLS policies in supabase tables. when creating the new tables: roles and userRoles you can…

Hope this helps!

[dereckbolsanelo]

Hi Agustin,

Thanks for your reply and the tutorial.

I need to clarify: the issue I’m facing is with the published app, not the editor. In the published app, users are redirected even when logged in and possessing the correct Supabase roles.

My Supabase roles are correctly configured and visible in WeWeb’s Supabase plugin (see new image below):

The core problem: WeWeb’s page access rules in the published app don’t seem to recognize these Supabase roles. Users get redirected as if they lack the roles, though the roles are visible on the user object in WeWeb (as shown in the user-detail image from my first forum post).

If I remove these specific role/group restrictions from the page, leaving only “authenticated user,” access works correctly in the published app.

Thanks

[Agustin_Carozo]

I remember having a similar issue.
First thing is we need to determine if our roles are actually being captured by our auth plugin:

On the user variable (that comes with the auth plugin) you can see the entire object of the logged in user, and here you can check if it’s actually receiving the roles.

If not, you need to change your RLS in supabase to make sure an authenticated user is able to read from those tables (userRoles and Roles)

[dereckbolsanelo]

That worked! The RLS for the roles tables was the issue. Thanks for the clear steps!

[vfede]

@dereckbolsanelo

I’m trying to use the private access feature, but I’m running into an issue.

i’m having the same problem but the roles are present in the user object in production. The strange thing is that it works in the Editor! What permissions are different?
RLS are the ones set by weweb when i activated the roles via the Editor UI. Also i tried disabling the RLS for roles and users_roles tables and nothing changed.

the redirect to the default page (provider-signin) for a user without the credentials always happen, even if this is set:

the only way to prevent the redirection is to remove the editors group (that contains the provider role). But this is not what i need.
Also, i’m quite sure this worked until some days ago and now it stopped working.

Any known update on the weweb side that could have broken it?

thank you for the support

[vfede]

ok, nevermind, i find out that the roles in a group are in an AND condition, not in a OR

[Agustin_Carozo]

Hi Federico,

You need to set up your RLS in your Supabase tables directly.
RLS : Row Level Security
You need to tell supabase who you want to give access to: Reading, Writing, Deleting etc
And you need to do that for all tables (each one will have its own rules)
In order to use roles inside WeWeb you will need to set up those RLS rules for 2 tables:
“Roles” and “UserRoles”

You can learn more about it here:

Supabase data source | Documentation