supabase / supabase-flutter / 32354126909

89%

push

github

feat: resolve an access token per request on the standalone clients (#1742)

> [!NOTE]
> Stacked on #1739. Review that one first; the diff here is only the
last commit.

## Summary

Gives `PostgrestClient`, `SupabaseStorageClient` and `FunctionsClient`
an optional `accessToken` callback, resolved before every request and
sent as `Authorization: Bearer <token>`.

```dart
final functions = FunctionsClient(
  functionsUrl,
  {'apikey': anonKey},
  accessToken: () async => currentJwt,
);
```

## Why

#1739 removes `setAccessToken` from these three clients. Through
`SupabaseClient` nothing is lost, because `AuthHttpClient` already
resolves the session token per request. @Vinzent03 pointed out on that
PR that standalone users of these packages have no such wrapper, and are
left with a static constructor header or mutating the header map by
hand.

That is the gap the setters were filling, and filling badly: they pinned
a value that went stale, which is exactly why they became a footgun once
`AuthHttpClient` landed. A callback resolved per request covers the same
need without that failure mode.

This is the same shape supabase/supabase-swift#1233 gives the Swift
`FunctionsClient`.

## Behaviour

- Resolved before every request, and again for **every retry**, so a
token that rotates between attempts is picked up. Postgrest's retry loop
and storage's upload retry both go through it.
- Returning `null` sends no bearer token.
- A request that already carries an `Authorization` header keeps it, so
`invoke(headers: ...)`, `PostgrestBuilder.setHeader` and
`SupabaseStorageClient.setHeader` all still win over the callback.
- Passing both a constructor `Authorization` header and `accessToken`
asserts, since the header would win on every request and the callback
would never run.

Purely additive: the parameter is optional, and the assert can only fire
on a combination that was not expressible before this PR.

## Implementation

One `AccessTokenClient` in `supabase_commo... (continued)

12 of 14 new or added lines in 4 files covered. (85.71%)

5920 of 6694 relevant lines covered (88.44%)

4.34 hits per line