infinite recursion detected in policy for relation

What it means in plain English

Two tables' security rules each look at the other table, so Postgres goes round in circles and gives up. Common with 'team' or 'shared list' features.

Likely causes

• Policy on table A queries table B, and table B's policy queries table A.
• A policy on a table queries the same table.

How to fix it, step by step

1. Find the two policies involved (Database → Policies).
2. Create a security definer function in a non-exposed schema that reads the membership table directly:

create schema if not exists private;
create function private.user_list_ids()
returns setof uuid language sql security definer set search_path = '' stable as $$
  select list_id from public.list_members where user_id = (select auth.uid())
$$;
revoke execute on function private.user_list_ids() from public;
grant usage on schema private to authenticated;
grant execute on function private.user_list_ids() to authenticated;

3. Rewrite both policies to use id in (select private.user_list_ids()) / list_id in (...).
4. Never create security definer functions in an exposed schema like public.

How to check it worked

• Queries on both tables return results without the 42P17 error.
• A non-member still sees nothing.

Sources

• https://supabase.com/docs/guides/database/postgres/row-level-security (opens in a new tab)
• https://supabase.com/docs/guides/api/securing-your-api (opens in a new tab)