supabase / supabase-flutter
87%

DEFAULT BRANCH: main
Repo Added
Token z3GUkNtD1PDnCOWpuPvCMvjUB924F4R9N regen
Build 1132 Last
Files 103
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: main
CHANGE BRANCH
x
Sync Branches

coverage: 86.818% (+0.04%) from 86.783%
29584102933

push

github

web-flow 
fix(functions): never send new-format API key as Bearer; warn on unrecognized sb_ key subtype (#1615)

## Summary

Parity with supabase-js and supabase-swift
([#1130](https://github.com/supabase/supabase-swift/pull/1130)) for the
new Supabase API key format (`sb_publishable_…` / `sb_secret_…`). These
keys are not JWTs and must never be sent as an `Authorization: Bearer`
token.

- **Functions never sends a new-format key as Bearer.** The
`Authorization: Bearer` header for Functions (and REST/Storage) is
injected per request by the shared `AuthHttpClient`. When no user
session exists it previously fell back to the API key, so a
`sb_publishable_`/`sb_secret_` key was sent as `Bearer …`, which the
Edge Functions runtime rejects. The Functions client now uses a
dedicated `AuthHttpClient` that omits the Bearer header for a new-format
key when there is no session. A genuine session JWT is still sent
normally.
- **Warn on unrecognized `sb_` subtypes.** `SupabaseClient` now warns
once per unrecognized `sb_`-prefixed key subtype at construction. It
never throws (the server, not the SDK, decides key validity) and never
logs the key value.

Scope matches the reference implementations: this affects Functions
only. Legacy JWT keys, REST, Storage, Auth, and Realtime are unchanged.

## Implementation notes

Unlike supabase-swift/js, supabase-flutter injects the Bearer token
through a **shared** `AuthHttpClient` used by REST, Functions, and
Storage, and `FunctionsClient.setAuth` is never wired up from
`SupabaseClient`. To keep the fix scoped to Functions, a separate
`AuthHttpClient` instance (`omitNewApiKeyAsBearer: true`) is created for
the Functions client instead of changing auth-state handling.

## Changes

- `packages/supabase/lib/src/api_key.dart` (new): `isNewApiKey`
classification and `warnOnUnrecognizedApiKey` warn-once helper.
- `packages/supabase/lib/src/auth_http_client.dart`:
`omitNewApiKeyAsBearer` flag suppressing the Bearer header for
new-format keys w... (continued)

21 of 0 new or added lines in 0 files covered. (NaN%)

15 existing lines in 1 file now uncovered.

5552 of 6395 relevant lines covered (86.82%)

3.92 hits per line

Relevant lines Covered
6395 RELEVANT LINES 5552 COVERED LINES
3.92 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
29584102933 main fix(functions): never send new-format API key as Bearer; warn on unrecognized sb_ key subtype (#1615) ## Summary Parity with supabase-js and supabase-swift ([#1130](https://github.com/supabase/supabase-swift/pull/1130)) for the new Supabase API ... push web-flow github
86.82
29563951630 main fix(realtime_client): stop throwing internally when converting null cell values (#1612) ## What kind of change does this PR introduce? Bug fix (internal exception noise; no observable behavior change). ## What is the current behavior? `convert... push web-flow github
86.78
29417623650 main chore(release): publish packages (#1605) Prepared all packages to be released to pub.dev Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> push web-flow github
86.79
29415982262 main feat(storage): add analytics (Iceberg) bucket CRUD (#1588) ## Summary Adds support for analytics (Apache Iceberg) buckets to `storage_client`, covering the bucket lifecycle: create, list, and delete. These map to the storage server's Iceberg buc... push web-flow github
86.79
29415634238 main feat(functions): add request cancellation to invoke via abortSignal (#1593) ## Summary Adds request cancellation to `FunctionsClient.invoke`, closing the gap versus the canonical compliance matrix. `invoke` now accepts an optional `abortSignal` ... push web-flow github
88.86
29413897983 main feat(auth): send PKCE code_challenge in updateUser when changing email (#1601) ## Summary Under the PKCE flow, `updateUser({ email })` now generates a PKCE code verifier and sends the corresponding `code_challenge` / `code_challenge_method` in t... push web-flow github
88.86
29408971089 main test: expand unit coverage for supabase_common and storage_client types (#1595) ## What Fills genuine, server-free unit coverage gaps found by measuring actual line coverage (`dart test --coverage` + `format_coverage`) across the self-contained ... push web-flow github
88.5
29336359764 main feat(auth): add signInWithWeb3 for Web3 wallet authentication (#1590) ## Summary Adds `signInWithWeb3` support to `gotrue`, wrapping the GoTrue `POST /token?grant_type=web3` endpoint used for Web3 wallet authentication (Sign-In with Ethereum and... push web-flow github
87.9
29318155135 main fix(supabase_common): align platform stats casing with other SDKs (#1596) ## What Normalizes the platform name reported in the `platform=` segment of the `X-Client-Info` header so it uses the same casing across all Supabase SDKs. Previously the... push web-flow github
87.33
29287704963 main feat(postgrest): configurable auto-retry and request timeout (#1560) ## Summary Makes the PostgREST client's automatic retry behavior configurable and adds an optional per-request timeout that actually cancels a stalled attempt. Previously the r... push web-flow github
87.2
See All Builds (1128)

Badge your Repo: supabase-flutter

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh