@svadmin/supabase 0.8.3 → 0.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/supabase",
-  "version": "0.8.3",
+  "version": "0.9.1",
   "description": "Supabase adapters — DataProvider, AuthProvider, LiveProvider, AuditHandler",
   "type": "module",
   "sideEffects": false,
@@ -16,7 +16,7 @@
     }
   },
   "peerDependencies": {
-    "@svadmin/core": "^0.19.3",
+    "@svadmin/core": "^0.21.0",
     "@supabase/supabase-js": "^2.0.0"
   },
   "license": "MIT",

package/src/auth-provider.ts

@@ -31,11 +31,15 @@ export function createSupabaseAuthProvider(client: SupabaseClient): AuthProvider
     async getIdentity(): Promise<Identity | null> {
       const { data: { user } } = await client.auth.getUser();
       if (!user) return null;
+      
+      const { data: { session } } = await client.auth.getSession();
+      
       return {
         id: user.id,
         name: user.user_metadata?.name ?? user.email?.split('@')[0] ?? 'User',
         email: user.email,
         avatar: user.user_metadata?.avatar_url,
+        token: session?.access_token,
       };
     },
 
@@ -68,6 +72,18 @@ export function createSupabaseAuthProvider(client: SupabaseClient): AuthProvider
 
     async onError(error: unknown): Promise<{ redirectTo?: string; logout?: boolean }> {
       if (error instanceof Error && error.message.includes('401')) {
+        // Pre-flight check: race-condition guard
+        // Supabase might have just refreshed the token in the background right after our fetch failed
+        const { data: { session } } = await client.auth.getSession();
+        
+        if (session?.access_token) {
+          // Token is actually still valid in Supabase! The 401 was a stale race condition.
+          // We intercept and swallow the logout action so the user isn't falsely kicked.
+          return {};
+        }
+
+        // Truly expired
+        await client.auth.signOut();
         return { redirectTo: '/login', logout: true };
       }
       return {};