Conversation
Pull Request Test Coverage Report for Build 14836594270Details
💛 - Coveralls |
grdsdev
changed the title
Vinzent03
reviewed
Mar 22, 2025
| class Constants { | ||
| static const Map<String, String> defaultHeaders = { | ||
| static String get platform { | ||
| return Platform.operatingSystem; |
Collaborator
There was a problem hiding this comment.
I know this is still draft, but still want to mention that this won't work on web.
You will either need a conditional import, or probably better use a constant to guard web with a definition like the kIsWeb in flutter:
const bool kIsWeb = bool.fromEnvironment('dart.library.js_util');
Contributor
Author
There was a problem hiding this comment.
Thanks, @Vinzent03
Do we have any test for asserting that it doesn't break in Web? Didn't see any fail on CI.
Collaborator
There was a problem hiding this comment.
Sadly not yet, but hopefully #1140 solves this
Contributor
Author
There was a problem hiding this comment.
@Vinzent03 I added the guard as you suggested, we could send data in case of web, if that is easy to do, not a requirement since our reports also fetches from the user-agent, and user-agent in web is better defined then mobile.
Collaborator
There was a problem hiding this comment.
Yeah, I think using the user-agent is the better and correct way for web.
grdsdev
force-pushed
the
guilherme/clibs-120-supabase-flutter-send-standard-client-headers-on-all
branch
from
May 2, 2025 09:20
3e7b4aa to
070966e
Compare
grdsdev
marked this pull request as ready for review
May 2, 2025 09:25
grdsdev
force-pushed
the
guilherme/clibs-120-supabase-flutter-send-standard-client-headers-on-all
branch
from
May 5, 2025 12:36
070966e to
b0af382
Compare
Vinzent03
approved these changes
May 5, 2025
grdsdev
deleted the
guilherme/clibs-120-supabase-flutter-send-standard-client-headers-on-all
branch
May 5, 2025 19:54
spydon
added a commit
that referenced
this pull request
Jul 17, 2026
…cognized sb_ key subtype (#1615) ## Summary Parity with supabase-js and supabase-swift ([#1130](supabase/supabase-swift#1130)) for the new Supabase API key format (`sb_publishable_…` / `sb_secret_…`). These keys are not JWTs and must never be sent as an `Authorization: Bearer` token. - **Functions never sends a new-format key as Bearer.** The `Authorization: Bearer` header for Functions (and REST/Storage) is injected per request by the shared `AuthHttpClient`. When no user session exists it previously fell back to the API key, so a `sb_publishable_`/`sb_secret_` key was sent as `Bearer …`, which the Edge Functions runtime rejects. The Functions client now uses a dedicated `AuthHttpClient` that omits the Bearer header for a new-format key when there is no session. A genuine session JWT is still sent normally. - **Warn on unrecognized `sb_` subtypes.** `SupabaseClient` now warns once per unrecognized `sb_`-prefixed key subtype at construction. It never throws (the server, not the SDK, decides key validity) and never logs the key value. Scope matches the reference implementations: this affects Functions only. Legacy JWT keys, REST, Storage, Auth, and Realtime are unchanged. ## Implementation notes Unlike supabase-swift/js, supabase-flutter injects the Bearer token through a **shared** `AuthHttpClient` used by REST, Functions, and Storage, and `FunctionsClient.setAuth` is never wired up from `SupabaseClient`. To keep the fix scoped to Functions, a separate `AuthHttpClient` instance (`omitNewApiKeyAsBearer: true`) is created for the Functions client instead of changing auth-state handling. ## Changes - `packages/supabase/lib/src/api_key.dart` (new): `isNewApiKey` classification and `warnOnUnrecognizedApiKey` warn-once helper. - `packages/supabase/lib/src/auth_http_client.dart`: `omitNewApiKeyAsBearer` flag suppressing the Bearer header for new-format keys with no session. - `packages/supabase/lib/src/supabase_client.dart`: dedicated Functions `AuthHttpClient`; warn at construction. - `packages/supabase/test/api_key_test.dart` (new): classification, warn-once/no-key-leak, and all Bearer-suppression cases. ## Test plan - [x] `dart analyze` — clean - [x] `dart test` (supabase package) — all 91 tests pass, including the 8 new ones - [x] `dart format` run
Vinzent03
pushed a commit
that referenced
this pull request
Jul 28, 2026
…cognized sb_ key subtype (#1615) ## Summary Parity with supabase-js and supabase-swift ([#1130](supabase/supabase-swift#1130)) for the new Supabase API key format (`sb_publishable_…` / `sb_secret_…`). These keys are not JWTs and must never be sent as an `Authorization: Bearer` token. - **Functions never sends a new-format key as Bearer.** The `Authorization: Bearer` header for Functions (and REST/Storage) is injected per request by the shared `AuthHttpClient`. When no user session exists it previously fell back to the API key, so a `sb_publishable_`/`sb_secret_` key was sent as `Bearer …`, which the Edge Functions runtime rejects. The Functions client now uses a dedicated `AuthHttpClient` that omits the Bearer header for a new-format key when there is no session. A genuine session JWT is still sent normally. - **Warn on unrecognized `sb_` subtypes.** `SupabaseClient` now warns once per unrecognized `sb_`-prefixed key subtype at construction. It never throws (the server, not the SDK, decides key validity) and never logs the key value. Scope matches the reference implementations: this affects Functions only. Legacy JWT keys, REST, Storage, Auth, and Realtime are unchanged. ## Implementation notes Unlike supabase-swift/js, supabase-flutter injects the Bearer token through a **shared** `AuthHttpClient` used by REST, Functions, and Storage, and `FunctionsClient.setAuth` is never wired up from `SupabaseClient`. To keep the fix scoped to Functions, a separate `AuthHttpClient` instance (`omitNewApiKeyAsBearer: true`) is created for the Functions client instead of changing auth-state handling. ## Changes - `packages/supabase/lib/src/api_key.dart` (new): `isNewApiKey` classification and `warnOnUnrecognizedApiKey` warn-once helper. - `packages/supabase/lib/src/auth_http_client.dart`: `omitNewApiKeyAsBearer` flag suppressing the Bearer header for new-format keys with no session. - `packages/supabase/lib/src/supabase_client.dart`: dedicated Functions `AuthHttpClient`; warn at construction. - `packages/supabase/test/api_key_test.dart` (new): classification, warn-once/no-key-leak, and all Bearer-suppression cases. ## Test plan - [x] `dart analyze` — clean - [x] `dart test` (supabase package) — all 91 tests pass, including the 8 new ones - [x] `dart format` run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
What is the current behavior?
Please link any relevant issues here.
What is the new behavior?
Feel free to include screenshots if it includes visual changes.
Additional context
Add any other context or screenshots.