sample diagnosis · demo app, not client work
Invoices vanish after saving
A demo app I built and broke on purpose, with the written part of a diagnosis: what’s broken, why, and a fix plan you can follow yourself or hand to any developer. A paid diagnosis also comes with a video of the bug.
- app
- “Invoices” demo · Next.js + Supabase, on Vercel
- reported
- “I save an invoice, it says Saved!, then the list is empty.”
- access
- invited to Supabase and Vercel · no passwords
What's broken
Your invoices are saved. The app just isn’t allowed to read them back. Supabase checks a safety rule for every action (row level security), and the rule that lets people see their own invoices is missing. So the list always comes back empty, and nothing shows an error.
Editing and deleting are hit by the same missing rule.
How to see it
- Log in as a test user.
- Create an invoice. The app says “Saved!”.
- The list still says “No invoices yet.”
- In Supabase › Table Editor › invoices, the new row is there.
Why it happens
With row level security on, a table needs one rule per action: read, create, edit and delete. A later migration (0003_policies_update.sql) dropped the read rule on invoices. Without it, Supabase hides every row and answers the app’s request with an empty list instead of an error, so the app shows its “no invoices” screen.
Fix plan
One short SQL change in Supabase. The app’s code stays the same.
- In Supabase › SQL Editor, add the read rule back, for each user’s own invoices only:
create policy "Users can view their own invoices" on public.invoices for select to authenticated using ((select auth.uid()) = user_id); - Don’t turn row level security off, and don’t use
using (true). Both “fix” the list by showing every user’s invoices to everyone. - Add the same rule to your migrations, so the next database change doesn’t drop it again.
How to check it's fixed
- Refresh: your invoices are listed again.
- Edit and delete one: both stick after a refresh.
- Log in as a second test user: they see only their own invoices.
Want this for your app?
report within 48h of access
no passwords · refund terms