Skip to content

Commit 4214c43

Browse files
GareeGaree
authored
fix(user auth context): do not overwrite provided client options Authorization header (#766)
1 parent bb24ce0 commit 4214c43

File tree

3 files changed

+98
-58
lines changed

3 files changed

+98
-58
lines changed

‎supabase/_async/client.py‎

Lines changed: 11 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,8 @@ def __init__(
6767

6868
self.supabase_url = supabase_url
6969
self.supabase_key = supabase_key
70-
self._auth_token = {
71-
"Authorization": f"Bearer {supabase_key}",
72-
}
73-
options.headers.update(self._get_auth_headers())
7470
self.options = options
71+
options.headers.update(self._get_auth_headers())
7572
self.rest_url = f"{supabase_url}/rest/v1"
7673
self.realtime_url = f"{supabase_url}/realtime/v1".replace("http", "ws")
7774
self.auth_url = f"{supabase_url}/auth/v1"
@@ -102,9 +99,7 @@ async def create(
10299
supabase_key: str,
103100
options: Union[ClientOptions, None] = None,
104101
):
105-
client = cls(supabase_url, supabase_key, options)
106-
client._auth_token = await client._get_token_header()
107-
return client
102+
return cls(supabase_url, supabase_key, options)
108103

109104
def table(self, table_name: str) -> AsyncRequestBuilder:
110105
"""Perform a table operation.
@@ -147,7 +142,6 @@ def rpc(
147142
@property
148143
def postgrest(self):
149144
if self._postgrest is None:
150-
self.options.headers.update(self._auth_token)
151145
self._postgrest = self._init_postgrest_client(
152146
rest_url=self.rest_url,
153147
headers=self.options.headers,
@@ -160,21 +154,19 @@ def postgrest(self):
160154
@property
161155
def storage(self):
162156
if self._storage is None:
163-
headers = self._get_auth_headers()
164-
headers.update(self._auth_token)
165157
self._storage = self._init_storage_client(
166158
storage_url=self.storage_url,
167-
headers=headers,
159+
headers=self.options.headers,
168160
storage_client_timeout=self.options.storage_client_timeout,
169161
)
170162
return self._storage
171163

172164
@property
173165
def functions(self):
174166
if self._functions is None:
175-
headers = self._get_auth_headers()
176-
headers.update(self._auth_token)
177-
self._functions = AsyncFunctionsClient(self.functions_url, headers)
167+
self._functions = AsyncFunctionsClient(
168+
self.functions_url, self.options.headers
169+
)
178170
return self._functions
179171

180172
# async def remove_subscription_helper(resolve):
@@ -248,26 +240,17 @@ def _init_postgrest_client(
248240
)
249241

250242
def _create_auth_header(self, token: str):
251-
return {
252-
"Authorization": f"Bearer {token}",
253-
}
243+
return f"Bearer {token}"
254244

255245
def _get_auth_headers(self) -> Dict[str, str]:
256246
"""Helper method to get auth headers."""
257247
return {
258248
"apiKey": self.supabase_key,
259-
"Authorization": f"Bearer {self.supabase_key}",
249+
"Authorization": self.options.headers.get(
250+
"Authorization", self._create_auth_header(self.supabase_key)
251+
),
260252
}
261253

262-
async def _get_token_header(self):
263-
try:
264-
session = await self.auth.get_session()
265-
access_token = session.access_token
266-
except Exception as err:
267-
access_token = self.supabase_key
268-
269-
return self._create_auth_header(access_token)
270-
271254
def _listen_to_auth_events(
272255
self, event: AuthChangeEvent, session: Union[Session, None]
273256
):
@@ -279,7 +262,7 @@ def _listen_to_auth_events(
279262
self._functions = None
280263
access_token = session.access_token if session else self.supabase_key
281264

282-
self._auth_token = self._create_auth_header(access_token)
265+
self.options.headers["Authorization"] = self._create_auth_header(access_token)
283266

284267

285268
async def create_client(

‎supabase/_sync/client.py‎

Lines changed: 11 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,8 @@ def __init__(
6767

6868
self.supabase_url = supabase_url
6969
self.supabase_key = supabase_key
70-
self._auth_token = {
71-
"Authorization": f"Bearer {supabase_key}",
72-
}
73-
options.headers.update(self._get_auth_headers())
7470
self.options = options
71+
options.headers.update(self._get_auth_headers())
7572
self.rest_url = f"{supabase_url}/rest/v1"
7673
self.realtime_url = f"{supabase_url}/realtime/v1".replace("http", "ws")
7774
self.auth_url = f"{supabase_url}/auth/v1"
@@ -102,9 +99,7 @@ def create(
10299
supabase_key: str,
103100
options: Union[ClientOptions, None] = None,
104101
):
105-
client = cls(supabase_url, supabase_key, options)
106-
client._auth_token = client._get_token_header()
107-
return client
102+
return cls(supabase_url, supabase_key, options)
108103

109104
def table(self, table_name: str) -> SyncRequestBuilder:
110105
"""Perform a table operation.
@@ -147,7 +142,6 @@ def rpc(
147142
@property
148143
def postgrest(self):
149144
if self._postgrest is None:
150-
self.options.headers.update(self._auth_token)
151145
self._postgrest = self._init_postgrest_client(
152146
rest_url=self.rest_url,
153147
headers=self.options.headers,
@@ -160,21 +154,19 @@ def postgrest(self):
160154
@property
161155
def storage(self):
162156
if self._storage is None:
163-
headers = self._get_auth_headers()
164-
headers.update(self._auth_token)
165157
self._storage = self._init_storage_client(
166158
storage_url=self.storage_url,
167-
headers=headers,
159+
headers=self.options.headers,
168160
storage_client_timeout=self.options.storage_client_timeout,
169161
)
170162
return self._storage
171163

172164
@property
173165
def functions(self):
174166
if self._functions is None:
175-
headers = self._get_auth_headers()
176-
headers.update(self._auth_token)
177-
self._functions = SyncFunctionsClient(self.functions_url, headers)
167+
self._functions = SyncFunctionsClient(
168+
self.functions_url, self.options.headers
169+
)
178170
return self._functions
179171

180172
# async def remove_subscription_helper(resolve):
@@ -248,26 +240,17 @@ def _init_postgrest_client(
248240
)
249241

250242
def _create_auth_header(self, token: str):
251-
return {
252-
"Authorization": f"Bearer {token}",
253-
}
243+
return f"Bearer {token}"
254244

255245
def _get_auth_headers(self) -> Dict[str, str]:
256246
"""Helper method to get auth headers."""
257247
return {
258248
"apiKey": self.supabase_key,
259-
"Authorization": f"Bearer {self.supabase_key}",
249+
"Authorization": self.options.headers.get(
250+
"Authorization", self._create_auth_header(self.supabase_key)
251+
),
260252
}
261253

262-
def _get_token_header(self):
263-
try:
264-
session = self.auth.get_session()
265-
access_token = session.access_token
266-
except Exception as err:
267-
access_token = self.supabase_key
268-
269-
return self._create_auth_header(access_token)
270-
271254
def _listen_to_auth_events(
272255
self, event: AuthChangeEvent, session: Union[Session, None]
273256
):
@@ -279,7 +262,7 @@ def _listen_to_auth_events(
279262
self._functions = None
280263
access_token = session.access_token if session else self.supabase_key
281264

282-
self._auth_token = self._create_auth_header(access_token)
265+
self.options.headers["Authorization"] = self._create_auth_header(access_token)
283266

284267

285268
def create_client(

‎tests/test_client.py‎

Lines changed: 76 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
from __future__ import annotations
22

3+
import os
34
from typing import Any
5+
from unittest.mock import MagicMock
46

57
import pytest
68

9+
from supabase import Client, create_client
10+
from supabase.lib.client_options import ClientOptions
11+
712

813
@pytest.mark.xfail(
914
reason="None of these values should be able to instantiate a client object"
@@ -12,6 +17,75 @@
1217
@pytest.mark.parametrize("key", ["", None, "valeefgpoqwjgpj", 139, -1, {}, []])
1318
def test_incorrect_values_dont_instantiate_client(url: Any, key: Any) -> None:
1419
"""Ensure we can't instantiate client with invalid values."""
15-
from supabase import Client, create_client
16-
1720
_: Client = create_client(url, key)
21+
22+
23+
def test_uses_key_as_authorization_header_by_default() -> None:
24+
url = os.environ.get("SUPABASE_TEST_URL")
25+
key = os.environ.get("SUPABASE_TEST_KEY")
26+
27+
client = create_client(url, key)
28+
29+
assert client.options.headers.get("apiKey") == key
30+
assert client.options.headers.get("Authorization") == f"Bearer {key}"
31+
32+
assert client.postgrest.session.headers.get("apiKey") == key
33+
assert client.postgrest.session.headers.get("Authorization") == f"Bearer {key}"
34+
35+
assert client.auth._headers.get("apiKey") == key
36+
assert client.auth._headers.get("Authorization") == f"Bearer {key}"
37+
38+
assert client.storage.session.headers.get("apiKey") == key
39+
assert client.storage.session.headers.get("Authorization") == f"Bearer {key}"
40+
41+
42+
def test_supports_setting_a_global_authorization_header() -> None:
43+
url = os.environ.get("SUPABASE_TEST_URL")
44+
key = os.environ.get("SUPABASE_TEST_KEY")
45+
46+
authorization = f"Bearer secretuserjwt"
47+
48+
options = ClientOptions(headers={"Authorization": authorization})
49+
50+
client = create_client(url, key, options)
51+
52+
assert client.options.headers.get("apiKey") == key
53+
assert client.options.headers.get("Authorization") == authorization
54+
55+
assert client.postgrest.session.headers.get("apiKey") == key
56+
assert client.postgrest.session.headers.get("Authorization") == authorization
57+
58+
assert client.auth._headers.get("apiKey") == key
59+
assert client.auth._headers.get("Authorization") == authorization
60+
61+
assert client.storage.session.headers.get("apiKey") == key
62+
assert client.storage.session.headers.get("Authorization") == authorization
63+
64+
65+
def test_updates_the_authorization_header_on_auth_events() -> None:
66+
url = os.environ.get("SUPABASE_TEST_URL")
67+
key = os.environ.get("SUPABASE_TEST_KEY")
68+
69+
client = create_client(url, key)
70+
71+
assert client.options.headers.get("apiKey") == key
72+
assert client.options.headers.get("Authorization") == f"Bearer {key}"
73+
74+
mock_session = MagicMock(access_token="secretuserjwt")
75+
client._listen_to_auth_events("SIGNED_IN", mock_session)
76+
77+
updated_authorization = f"Bearer {mock_session.access_token}"
78+
79+
assert client.options.headers.get("apiKey") == key
80+
assert client.options.headers.get("Authorization") == updated_authorization
81+
82+
assert client.postgrest.session.headers.get("apiKey") == key
83+
assert (
84+
client.postgrest.session.headers.get("Authorization") == updated_authorization
85+
)
86+
87+
assert client.auth._headers.get("apiKey") == key
88+
assert client.auth._headers.get("Authorization") == updated_authorization
89+
90+
assert client.storage.session.headers.get("apiKey") == key
91+
assert client.storage.session.headers.get("Authorization") == updated_authorization

0 commit comments

Comments
 (0)