fix(auth): accept uppercase UUIDs in validateUUID

[i-anubhav-anand]

🔍 Description

What changed?

validateUUID() checked its input against UUID_REGEX, which lacked the case-insensitive (i) flag:

-const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i

As a result, any UUID containing uppercase hex (e.g. 123E4567-E89B-12D3-A456-426614174000) was rejected client-side with Expected parameter to be UUID but is not, before the request was ever sent — even though the value is a perfectly valid UUID and the GoTrue server accepts it.

This affects the public admin methods that validate a UUID argument: getUserById, updateUserById, deleteUser, _listFactors, _deleteFactor, _adminListPasskeys, _adminDeletePasskey.

Why was this change needed?

UUIDs are case-insensitive on input. Per RFC 9562 §4 (and RFC 4122 §3): "The hexadecimal values 'a' through 'f' … are case insensitive on input." The GoTrue server (Go uuid parser) accepts uppercase UUIDs, so rejecting them in the client is incorrect and blocks valid calls.

🔄 Breaking changes

• This PR contains no breaking changes

📋 Checklist

• I have read the Contributing Guidelines
• My PR title follows the conventional commit format
• I have run pnpm nx format
• I have added tests for new functionality

📝 Additional notes

Fail-before / pass-after — added uppercase and mixed-case cases to the validateUUID test in helpers.test.ts:

• Before fix: ❌ should accept uppercase UUID and should accept mixed-case UUID both throw @supabase/auth-js: Expected parameter to be UUID but is not
• After fix: ✅ all 26 helpers.test.ts tests pass

[mandarini]

@i-anubhav-anand thanks for this fix. Can you please rebase your PR so that it will trigger the suite and we can merge?

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 33d01935-eacb-436f-b62c-af840964cd4d

📥 Commits

Reviewing files that changed from the base of the PR and between 6331898 and 23ccf69.

📒 Files selected for processing (2)

• packages/core/auth-js/src/lib/helpers.ts
• packages/core/auth-js/test/helpers.test.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • UUID validation now accepts valid UUIDs containing uppercase or mixed-case hexadecimal characters.
  • Invalid UUID formats continue to be rejected.

Walkthrough

Updated UUID_REGEX to use case-insensitive matching, allowing validateUUID to accept uppercase and mixed-case hexadecimal UUID strings. Added test cases covering these formats while retaining the existing invalid-format test matrix.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[i-anubhav-anand]

Thanks! I've pushed a fresh commit to retrigger CI (23ccf690) — content is unchanged, just rebased onto latest master. Looks like the workflow runs are queued but sitting in action_required status, so they'll need an approval click from a maintainer to actually execute: https://github.com/supabase/supabase-js/pull/2467/checks. Let me know if there's anything else needed on my end!

[pkg-pr-new]

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2467

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2467

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2467

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2467

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2467

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2467

commit: 23ccf69

[coveralls]

coverage: 81.305%. remained the same — i-anubhav-anand:fix/auth-uuid-uppercase into supabase:master