supabase / supabase-flutter / 29584102933 / 9
87%
main: 87%

DEFAULT BRANCH: main
Ran
Files 10
Run time 0s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 79.31%. Remained the same
29584102933.9

push

github

web-flow 
fix(functions): never send new-format API key as Bearer; warn on unrecognized sb_ key subtype (#1615)

## Summary

Parity with supabase-js and supabase-swift
([#1130](https://github.com/supabase/supabase-swift/pull/1130)) for the
new Supabase API key format (`sb_publishable_…` / `sb_secret_…`). These
keys are not JWTs and must never be sent as an `Authorization: Bearer`
token.

- **Functions never sends a new-format key as Bearer.** The
`Authorization: Bearer` header for Functions (and REST/Storage) is
injected per request by the shared `AuthHttpClient`. When no user
session exists it previously fell back to the API key, so a
`sb_publishable_`/`sb_secret_` key was sent as `Bearer …`, which the
Edge Functions runtime rejects. The Functions client now uses a
dedicated `AuthHttpClient` that omits the Bearer header for a new-format
key when there is no session. A genuine session JWT is still sent
normally.
- **Warn on unrecognized `sb_` subtypes.** `SupabaseClient` now warns
once per unrecognized `sb_`-prefixed key subtype at construction. It
never throws (the server, not the SDK, decides key validity) and never
logs the key value.

Scope matches the reference implementations: this affects Functions
only. Legacy JWT keys, REST, Storage, Auth, and Realtime are unchanged.

## Implementation notes

Unlike supabase-swift/js, supabase-flutter injects the Bearer token
through a **shared** `AuthHttpClient` used by REST, Functions, and
Storage, and `FunctionsClient.setAuth` is never wired up from
`SupabaseClient`. To keep the fix scoped to Functions, a separate
`AuthHttpClient` instance (`omitNewApiKeyAsBearer: true`) is created for
the Functions client instead of changing auth-state handling.

## Changes

- `packages/supabase/lib/src/api_key.dart` (new): `isNewApiKey`
classification and `warnOnUnrecognizedApiKey` warn-once helper.
- `packages/supabase/lib/src/auth_http_client.dart`:
`omitNewApiKeyAsBearer` flag suppressing the Bearer header for
new-format keys w... (continued)

253 of 319 relevant lines covered (79.31%)

4.55 hits per line

Source Files on job supabase_flutter - 29584102933.9