Troubleshooting
Fix common Lovable.dev errors: RLS recursion, blank pages, build failures
Most Lovable error reports cluster into a small number of root causes. Once you know the pattern, you can fix the prompt instead of debugging the symptom for the third time. Here are the most common ones and the exact prompt clauses that prevent them.
Error: "infinite recursion detected in policy for relation ..."
Cause: an RLS policy on table A queries table B, but table B's policy queries table A. Most commonly this happens on workspace_members.
Fix: use a SECURITY DEFINER function to bypass RLS for the membership lookup. See the RLS cheat sheet for the pattern.
Error: "permission denied for table ..." (when RLS allows it)
Cause: you enabled RLS and wrote policies, but you never GRANTed the table to the authenticated role. PostgREST needs both.
Fix: every CREATE TABLE in the public schema must be followed by GRANT SELECT, INSERT, UPDATE, DELETE ON ... TO authenticated in the same migration.
Error: blank page on refresh of a deep route
Cause: a static-file host serves index.html only for /, returning 404 for /dashboard. On TanStack Start with the modern stack this should not happen — but it does on legacy stacks deployed to Netlify/Vercel without a SPA fallback.
Fix: on legacy stacks, add a public/_redirects file with /* /index.html 200, or equivalent. On the modern Lovable stack, check that the route file exists under src/routes/ and createFileRoute() declares the expected URL.
Error: build fails with "Unauthorized" during prerender
Cause: a route loader calls a server function protected by requireSupabaseAuth. SSR / build:dev has no user session, so the middleware rejects.
Fix: never put a protected server function in a public route's loader. Call it from the component via useServerFn + useQuery. Protected loaders only belong under the _authenticated layout.
Error: "window is not defined" in production
Cause: a client-only module (pdf-lib, chart libs, anything that touches window) runs at module scope of a file imported by SSR.
Fix: move the import inside a client-only function, rename the file to *.client.ts, or wrap the call in createIsomorphicFn.
Error: empty <div id="root"> when shared on social
Cause: not an error, by design. Client-rendered SPAs return an empty shell to crawlers. Open Graph previews fall back to the root document's meta tags — which on Lovable defaults are generic.
Fix: add per-route head() with og:title, og:description, og:image, plus canonical and JSON-LD. See the SEO checklist.
Error: API key undefined at runtime
Cause: process.env.API_KEY is read at module scope, not inside the handler. On Cloudflare Workers, env injection happens at call time, not import time.
Fix: read process.env.* inside the createServerFn .handler() body, never at the top of the file.