supabase / supabase-flutter / 29584102933
92%

DEFAULT BRANCH: main
Ran
Jobs 9
Files 103
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 86.818% (+0.04%) from 86.783%
29584102933

push

github

web-flow 
fix(functions): never send new-format API key as Bearer; warn on unrecognized sb_ key subtype (#1615)

## Summary

Parity with supabase-js and supabase-swift
([#1130](https://github.com/supabase/supabase-swift/pull/1130)) for the
new Supabase API key format (`sb_publishable_…` / `sb_secret_…`). These
keys are not JWTs and must never be sent as an `Authorization: Bearer`
token.

- **Functions never sends a new-format key as Bearer.** The
`Authorization: Bearer` header for Functions (and REST/Storage) is
injected per request by the shared `AuthHttpClient`. When no user
session exists it previously fell back to the API key, so a
`sb_publishable_`/`sb_secret_` key was sent as `Bearer …`, which the
Edge Functions runtime rejects. The Functions client now uses a
dedicated `AuthHttpClient` that omits the Bearer header for a new-format
key when there is no session. A genuine session JWT is still sent
normally.
- **Warn on unrecognized `sb_` subtypes.** `SupabaseClient` now warns
once per unrecognized `sb_`-prefixed key subtype at construction. It
never throws (the server, not the SDK, decides key validity) and never
logs the key value.

Scope matches the reference implementations: this affects Functions
only. Legacy JWT keys, REST, Storage, Auth, and Realtime are unchanged.

## Implementation notes

Unlike supabase-swift/js, supabase-flutter injects the Bearer token
through a **shared** `AuthHttpClient` used by REST, Functions, and
Storage, and `FunctionsClient.setAuth` is never wired up from
`SupabaseClient`. To keep the fix scoped to Functions, a separate
`AuthHttpClient` instance (`omitNewApiKeyAsBearer: true`) is created for
the Functions client instead of changing auth-state handling.

## Changes

- `packages/supabase/lib/src/api_key.dart` (new): `isNewApiKey`
classification and `warnOnUnrecognizedApiKey` warn-once helper.
- `packages/supabase/lib/src/auth_http_client.dart`:
`omitNewApiKeyAsBearer` flag suppressing the Bearer header for
new-format keys w... (continued)

5552 of 6395 relevant lines covered (86.82%)

3.92 hits per line

Coverage Regressions

Lines Coverage ∆ File
15
90.4
0.22% packages/supabase/lib/src/supabase_client.dart
Jobs
ID Job ID Ran Files Coverage
8 supabase - 29584102933.8 17
83.2
GitHub Action Run
9 supabase_flutter - 29584102933.9 10
79.31
GitHub Action Run
3 postgrest - 29417623650.3 10
85.33
GitHub Action Run
7 functions_client - 29417623650.7 3
98.85
GitHub Action Run
9 realtime_client - 29563951630.9 11
90.11
GitHub Action Run
8 supabase_common - 29417623650.8 10
100.0
GitHub Action Run
9 yet_another_json_isolate - 29417623650.9 1
93.65
GitHub Action Run
5 gotrue - 29417623650.5 28
87.6
GitHub Action Run
2 storage_client - 29417623650.2 13
84.42
GitHub Action Run
Source Files on build 29584102933