supabase / supabase-flutter / 32949660997

89%

push

github

fix!: return unmodifiable header views with controlled replacement (#1764)

## What kind of change does this PR introduce?

Breaking change, plus a small feature that keeps every header use case
reachable.

## What is the current behavior?

`AuthClient.headers`, `FunctionsClient.headers`,
`StorageBucketApi.headers` (so `SupabaseStorageClient.headers`) and
`StorageFileApi.headers` all handed out the live internal header map, so
any consumer could rewrite the headers of a client from anywhere,
including the sub-clients a `SupabaseClient` manages:

```dart
supabase.functions.headers['Authorization'] = 'Bearer $jwt';
supabase.storage.headers.clear();
```

`SupabaseClient._replaceHeaders` depended on that leak, mutating each
client with `..clear()..addAll(...)`. This is the same anti-pattern that
was fixed for `RealtimeClient.headers` in #1758, and
`PostgrestClient.headers` before that.

Closes SDK-1600.

## What is the new behavior?

- Every `headers` getter returns `Map.unmodifiable(_headers)`, so
mutating one throws an `UnsupportedError`.
- Each client gained an `@internal void replaceHeaders(Map<String,
String>)`, and `SupabaseClient.headers =` now calls that instead of
mutating the maps in place. Propagation to all sub-clients is unchanged.
- `AuthClient` and `FunctionsClient` gained a public `setHeader(String,
String)`, mirroring `SupabaseStorageClient.setHeader`. Without it, a
standalone client built directly (not through `SupabaseClient`) would
have had no way to add a header after construction, since in-place
mutation was previously the only one. On auth the header map is shared
with `admin`, so admin requests carry it too; on functions a header
passed to `invoke()` still wins for that single call.
- `SupabaseStorageClient.setHeader()` goes through `replaceHeaders` as
well, so it keeps working. `StorageBucketApi` copies the headers it is
constructed with rather than aliasing the caller's map.
- `SupabaseStorageClient.vectors` is a getter that buil... (continued)

36 of 45 new or added lines in 6 files covered. (80.0%)

6034 of 6813 relevant lines covered (88.57%)

4.57 hits per line