fix(realtime): ensure setAuth doesn't disable token refresh

[edgurgel]

🔍 Description

Ensure realtime.setAuth doesn't disable token refresh. This happens only on 3rd party tokens.

What changed?

Change RealtimeClient's setAuth to only consider that tokens will be manually set if there is no accessToken promise to resolve.

Why was this change needed?

Because the SupabaseClient bootstraps the token calling setAuth which disables the token refresh:

supabase-js/packages/core/supabase-js/src/SupabaseClient.ts

Lines 389 to 395 in 21e410f

	if (this.accessToken) {
	// Start auth immediately to avoid race condition with channel subscriptions
	// Wrap Promise to avoid Firefox extension cross-context Promise access errors
	Promise.resolve(this.accessToken())
	.then((token) => this.realtime.setAuth(token))
	.catch((e) => console.warn('Failed to set initial Realtime auth token:', e))
	}

🔄 Breaking changes

• This PR contains no breaking changes

📋 Checklist

• I have read the Contributing Guidelines
• My PR title follows the conventional commit format: <type>(<scope>): <description>
• I have run pnpm nx format to ensure consistent code formatting
• I have added tests for new functionality (if applicable)
• I have updated documentation (if applicable)

📝 Additional notes

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d3998e8b-2057-4355-b8ac-af02c9a6d29d

📥 Commits

Reviewing files that changed from the base of the PR and between fd3148a and f25187d.

📒 Files selected for processing (2)

• packages/core/realtime-js/src/RealtimeClient.ts
• packages/core/supabase-js/test/unit/SupabaseClient.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/core/realtime-js/src/RealtimeClient.ts
• packages/core/supabase-js/test/unit/SupabaseClient.test.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved Realtime authentication handling when using access-token callbacks.
  • Ensured automatic token refresh remains enabled after initial authentication, even if a token is manually provided.

Walkthrough

RealtimeClient.setAuth keeps callback authentication active when an accessToken callback is configured. Manual-token mode is used only when no callback exists. Callback mode clears manual-token state and supports automatic token refresh. SupabaseClient test coverage verifies this behavior after asynchronous authentication initialization.

Sequence Diagram(s)

sequenceDiagram
  participant SupabaseClient
  participant RealtimeClient
  participant accessToken_callback
  participant Heartbeat
  SupabaseClient->>RealtimeClient: setAuth(token)
  RealtimeClient->>accessToken_callback: Keep callback mode active
  Heartbeat->>accessToken_callback: Request refreshed token
  accessToken_callback-->>RealtimeClient: Return refreshed token

Loading

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2592

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2592

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2592

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2592

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2592

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2592

commit: f25187d

[coveralls]

coverage: 81.41%. remained the same — fix/realtime-set-auth into master