Permission issues when working on QA DB Branch - ERROR: 42501: must be owner of table objects. How is this possible?

[SagieGrun]

I created a branch from main for purpose of cloning the DB and using the branch for QA. Not sure this is the best practice, but that is what Cursor recommended. When trying to apply migrations, ONLY for the bucket RLS policies - I got this error:
ERROR: 42501: must be owner of table objects

I tried both direct SQL, and CLI - both get the same error. Manually writing the policies works - the problem is that there are many policies that I am cloning, and I don't want to do it manually.
How can this be? On the main branch I don't have issues at all, and also other RLS policies (tables for example) worked fine.
What am I missing? I am a PRO user.

[shiv669]

Hey, I’ve seen this happen before. The error that says must be owner of table objects means the role you’re using to apply the migration doesn’t actually own the bucket’s underlying table in the branch. In Supabase, buckets are kept as special tables, and RLS policies require owner rights to apply through migration.

On your main branch, it works because your role owns those bucket tables. But when you clone a branch, ownership doesn’t automatically transfer for bucket tables, so you lose the ability to apply RLS policies through migration. That’s why you can still create policies manually (you can run them as a superuser), but migrations fail.

A reliable fix is to either:

• Change ownership of the bucket tables in your QA branch to your role before applying migrations, or
• Use your service_role key to apply the migration, since it has full rights.

This isn’t a bug; it’s a limitation with branch cloning and bucket ownership. You’ll need to handle ownership clearly for bucket RLS policies when cloning branches.