@supabase/supabase-js 2.110.3 → 2.110.4-canary.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/supabase-js",
-  "version": "2.110.3",
+  "version": "2.110.4-canary.0",
   "description": "Isomorphic Javascript SDK for Supabase",
   "keywords": [
     "javascript",
@@ -59,11 +59,11 @@
     "directory": "packages/core/supabase-js"
   },
   "dependencies": {
-    "@supabase/auth-js": "2.110.3",
-    "@supabase/functions-js": "2.110.3",
-    "@supabase/postgrest-js": "2.110.3",
-    "@supabase/storage-js": "2.110.3",
-    "@supabase/realtime-js": "2.110.3"
+    "@supabase/auth-js": "2.110.4-canary.0",
+    "@supabase/functions-js": "2.110.4-canary.0",
+    "@supabase/postgrest-js": "2.110.4-canary.0",
+    "@supabase/realtime-js": "2.110.4-canary.0",
+    "@supabase/storage-js": "2.110.4-canary.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.2",

package/src/SupabaseClient.ts

@@ -20,7 +20,7 @@ import {
   DEFAULT_REALTIME_OPTIONS,
   DEFAULT_TRACE_PROPAGATION_OPTIONS,
 } from './lib/constants'
-import { fetchWithAuth } from './lib/fetch'
+import { assertSupportedApiKey, fetchWithAuth } from './lib/fetch'
 import {
   applySettingDefaults,
   validateSupabaseUrl,
@@ -89,6 +89,7 @@ export default class SupabaseClient<
   protected rest: PostgrestClient<Database, ClientOptions, SchemaName>
   protected storageKey: string
   protected fetch?: Fetch
+  protected functionsFetch?: Fetch
   protected changedAccessToken?: string
   protected accessToken?: () => Promise<string | null>
 
@@ -314,6 +315,7 @@ export default class SupabaseClient<
   ) {
     const baseUrl = validateSupabaseUrl(supabaseUrl)
     if (!supabaseKey) throw new Error('supabaseKey is required.')
+    assertSupportedApiKey(supabaseKey)
 
     this.realtimeUrl = new URL('realtime/v1', baseUrl)
     this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace('http', 'ws')
@@ -357,13 +359,25 @@ export default class SupabaseClient<
       })
     }
 
+    // The fetch wrappers receive the raw session token (null when there is no session) and
+    // decide the `Authorization` fallback themselves, so the API-key fallback lives in one place.
     this.fetch = fetchWithAuth(
       supabaseKey,
       supabaseUrl,
-      this._getAccessToken.bind(this),
+      this._getSessionToken.bind(this),
       settings.global.fetch,
       settings.tracePropagation
     )
+    // Edge Functions use a dedicated fetch that never falls back to a new-format API key in
+    // the Authorization header (see `isNewApiKey` in ./lib/fetch). Other services use `this.fetch`.
+    this.functionsFetch = fetchWithAuth(
+      supabaseKey,
+      supabaseUrl,
+      this._getSessionToken.bind(this),
+      settings.global.fetch,
+      settings.tracePropagation,
+      { omitApiKeyAsBearer: true }
+    )
     this.realtime = this._initRealtimeClient({
       headers: this.headers,
       accessToken: this._getAccessToken.bind(this),
@@ -404,7 +418,7 @@ export default class SupabaseClient<
   get functions(): FunctionsClient {
     return new FunctionsClient(this.functionsUrl.href, {
       headers: this.headers,
-      customFetch: this.fetch,
+      customFetch: this.functionsFetch,
     })
   }
 
@@ -568,14 +582,23 @@ export default class SupabaseClient<
     return this.realtime.removeAllChannels()
   }
 
-  private async _getAccessToken() {
+  /**
+   * The raw session token — the custom `accessToken` result or the signed-in user's JWT —
+   * or `null` when there is no session. Unlike {@link _getAccessToken} it does not fall back
+   * to `supabaseKey`, so callers can distinguish "no session" from "has session".
+   */
+  private async _getSessionToken(): Promise<string | null> {
     if (this.accessToken) {
       return await this.accessToken()
     }
 
     const { data } = await this.auth.getSession()
 
-    return data.session?.access_token ?? this.supabaseKey
+    return data.session?.access_token ?? null
+  }
+
+  private async _getAccessToken() {
+    return (await this._getSessionToken()) ?? this.supabaseKey
   }
 
   private _initSupabaseAuthClient(

package/src/lib/fetch.ts

@@ -21,12 +21,39 @@ export const resolveHeadersConstructor = () => {
   return Headers
 }
 
+/**
+ * New-format Supabase API keys (`sb_publishable_…` / `sb_secret_…`) are not JWTs and
+ * must never be sent as a Bearer token — they belong only in the `apikey` header.
+ * Legacy (JWT) keys predate this format (they don't start with `sb_`) and keep their
+ * existing behavior. Any other `sb_`-prefixed key is an unrecognized future subtype;
+ * see {@link assertSupportedApiKey}.
+ */
+const isNewApiKey = (key: string): boolean =>
+  key.startsWith('sb_publishable_') || key.startsWith('sb_secret_')
+
+/**
+ * Fail fast on an `sb_`-family key whose subtype this SDK version does not recognize, so a
+ * future key type can never be silently mistreated as a legacy JWT and sent as a Bearer
+ * token. Recognized new-format keys and legacy JWT keys (no `sb_` prefix) pass through.
+ * The key itself is never included in the message to avoid leaking secret keys.
+ */
+export const assertSupportedApiKey = (key: string): void => {
+  if (key.startsWith('sb_') && !isNewApiKey(key)) {
+    throw new Error(
+      '@supabase/supabase-js: Unrecognized Supabase API key format. Expected a legacy JWT key ' +
+        'or a new-format key (sb_publishable_… / sb_secret_…). This "sb_" key type is not ' +
+        'supported by this version of the SDK — please upgrade @supabase/supabase-js.'
+    )
+  }
+}
+
 export const fetchWithAuth = (
   supabaseKey: string,
   supabaseUrl: string,
   getAccessToken: () => Promise<string | null>,
   customFetch?: Fetch,
-  tracePropagationOptions?: TracePropagationOptions
+  tracePropagationOptions?: TracePropagationOptions,
+  options?: { omitApiKeyAsBearer?: boolean }
 ): Fetch => {
   const fetch = resolveFetch(customFetch)
   const HeadersConstructor = resolveHeadersConstructor()
@@ -39,8 +66,13 @@ export const fetchWithAuth = (
     ? getDefaultPropagationTargets(supabaseUrl)
     : null
 
+  // Whether the API key may be used as the `Authorization` Bearer fallback when there is no
+  // session token. Disabled for Edge Functions with a new-format key (see `isNewApiKey`).
+  // Static per instance, so it is computed once here rather than on every request.
+  const allowKeyAsBearer = !(options?.omitApiKeyAsBearer && isNewApiKey(supabaseKey))
+
   return async (input, init) => {
-    const accessToken = (await getAccessToken()) ?? supabaseKey
+    const realToken = await getAccessToken()
     let headers = new HeadersConstructor(init?.headers)
 
     if (!headers.has('apikey')) {
@@ -48,7 +80,10 @@ export const fetchWithAuth = (
     }
 
     if (!headers.has('Authorization')) {
-      headers.set('Authorization', `Bearer ${accessToken}`)
+      const bearer = realToken ?? (allowKeyAsBearer ? supabaseKey : null)
+      if (bearer) {
+        headers.set('Authorization', `Bearer ${bearer}`)
+      }
     }
 
     if (traceTargets) {

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.110.3'
+export const version = '2.110.4-canary.0'