Skip to content

feat: exposing new api keys to functions #4946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
kallebysantos wants to merge 3 commits into
base: develop
Choose a base branch
from
Draft

feat: exposing new api keys to functions #4946

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
465206c
feat: exposing new api keys to functions
kallebysantos Mar 9, 2026
8a90da6
Merge branch 'develop' into feat-update-functions-exposing-new-secrets
kallebysantos Mar 12, 2026
8d75a6c
Merge branch 'develop' into feat-update-functions-exposing-new-secrets
avallete Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions internal/functions/serve/serve.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ func ServeFunctions(ctx context.Context, envFilePath string, noVerifyJWT *bool,
"SUPABASE_ANON_KEY="+utils.Config.Auth.AnonKey.Value,
"SUPABASE_SERVICE_ROLE_KEY="+utils.Config.Auth.ServiceRoleKey.Value,
"SUPABASE_DB_URL="+dbUrl,
"SUPABASE_INTERNAL_PUBLISHABLE_KEY="+utils.Config.Auth.PublishableKey.Value,
"SUPABASE_INTERNAL_SECRET_KEY="+utils.Config.Auth.SecretKey.Value,
"SUPABASE_INTERNAL_JWT_SECRET="+utils.Config.Auth.JwtSecret.Value,
"SUPABASE_INTERNAL_JWKS="+jwks,
fmt.Sprintf("SUPABASE_INTERNAL_HOST_PORT=%d", utils.Config.Api.Port),
Expand Down
19 changes: 16 additions & 3 deletions internal/functions/serve/templates/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@ const SB_SPECIFIC_ERROR_REASON = {

// OS stuff - we don't want to expose these to the functions.
const EXCLUDED_ENVS = ["HOME", "HOSTNAME", "PATH", "PWD"];

const HOST_PORT = Deno.env.get("SUPABASE_INTERNAL_HOST_PORT")!;
const JWT_SECRET = Deno.env.get("SUPABASE_INTERNAL_JWT_SECRET")!;
const JWKS_ENDPOINT = new URL('/auth/v1/.well-known/jwks.json', Deno.env.get("SUPABASE_URL")!)
Expand All @@ -37,6 +36,9 @@ const FUNCTIONS_CONFIG_STRING = Deno.env.get(
"SUPABASE_INTERNAL_FUNCTIONS_CONFIG",
)!;

const SUPABASE_PUBLISHABLE_KEY = Deno.env.get('SUPABASE_INTERNAL_PUBLISHABLE_KEY')
const SUPABASE_SECRET_KEY = Deno.env.get('SUPABASE_INTERNAL_SECRET_KEY')

const WALLCLOCK_LIMIT_SEC = parseInt(
Deno.env.get("SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC"),
);
Expand Down Expand Up @@ -128,7 +130,7 @@ let jwks = (() => {
}
})();

async function isValidJWT(jwksUrl: string, jwt: string): Promise<boolean> {
async function isValidJWT(jwksUrl: URL, jwt: string): Promise<boolean> {
try {
if (!jwks) {
// Loading from remote-url on fly
Expand All @@ -146,7 +148,7 @@ async function isValidJWT(jwksUrl: string, jwt: string): Promise<boolean> {
* Applies hybrid JWT verification, using JWK as primary and Legacy Secret as fallback.
* Use only during 'New JWT Keys' migration period, while `JWT_SECRET` is still available.
*/
export async function verifyHybridJWT(jwtSecret: string, jwksUrl: string, jwt: string): Promise<boolean> {
export async function verifyHybridJWT(jwtSecret: string, jwksUrl: URL, jwt: string): Promise<boolean> {
const { alg: jwtAlgorithm } = jose.decodeProtectedHeader(jwt)

if (jwtAlgorithm === 'HS256') {
Expand Down Expand Up @@ -223,6 +225,17 @@ Deno.serve({
const workerTimeoutMs = isFinite(WALLCLOCK_LIMIT_SEC) ? WALLCLOCK_LIMIT_SEC * 1000 : 400 * 1000;
const noModuleCache = false;
const envVarsObj = Deno.env.toObject();
if (SUPABASE_PUBLISHABLE_KEY) {
envVarsObj['SUPABASE_PUBLISHABLE_KEYS'] = JSON.stringify({
default: SUPABASE_PUBLISHABLE_KEY
})
}
if (SUPABASE_SECRET_KEY) {
envVarsObj['SUPABASE_SECRET_KEYS'] = JSON.stringify({
default: SUPABASE_SECRET_KEY
})
}

const envVars = Object.entries(envVarsObj)
.filter(([name, _]) =>
!EXCLUDED_ENVS.includes(name) && !name.startsWith("SUPABASE_INTERNAL_")
Expand Down
Loading