Fix for jwt verification-error-format#5918
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d885f5e8ce
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| if (!isValidJWT) { | ||
| return getResponse({ msg: "Invalid JWT" }, STATUS_CODE.Unauthorized); | ||
| return getResponse({ error: "Invalid JWT" }, STATUS_CODE.Unauthorized); |
There was a problem hiding this comment.
Update the stack runtime JWT error shape too
This only changes the CLI serve bootstrap, but the programmatic local stack runtime has the same JWT gate in packages/stack/src/services/edge-runtime-main.ts and still returns { msg: ... } for missing, malformed, and invalid tokens (lines 68-87); that file is loaded as the edge-runtime main service by packages/stack/src/services/edge-runtime.ts. In contexts that run functions through the TS stack runtime rather than this functions serve/Go embedded bundle, clients and Studio will still miss the error field this fix is intended to provide, so the regression remains on that local stack path.
Useful? React with 👍 / 👎.
| } catch (e) { | ||
| console.error(e); | ||
| return getResponse({ msg: e.toString() }, STATUS_CODE.Unauthorized); | ||
| return getResponse({ error: e.toString() }, STATUS_CODE.Unauthorized); |
There was a problem hiding this comment.
thanks! @yallalingyaradetti92
but this is being worked on here: #5862 (different approach)
also re message -> error change u can check the cmt here: (#5862 (comment))
Thanks again! for ur efforts towards contributing to Supabase!! 💚🙂
Summary
Fixes inconsistent JWT verification error response formatting in the local edge-runtime (
supabase start/functions serve). When JWT verification fails, the response used{"msg": "..."}, but production's Management API returns{"error": "..."}. This broke client code (and Studio's own edge-function test panel) that expects theerrorkey, causing silent failures since the actual error detail was never surfaced.This change:
apps/cli/src/shared/functions/serve.main.ts(the canonical edge-runtime bootstrap script) from{ msg: ... }to{ error: ... }.apps/cli-go/internal/functions/serve/templates/main.bundled.js) via the repo's ownbundleServeMainTemplate()bundler, sosupabase start's Go binary (which embeds this bundle viago:embed) stays in sync with the TS source, per the existing drift-detection test (serve-main-go-template.unit.test.ts).Verified end-to-end against a live local stack, not just unit tests: ran
functions servewith a realverify_jwt = truefunction and sent real HTTP requests —Authorizationheader →{"error":"Error: Missing authorization header"}(401){"error":"Invalid JWT"}(401)Linked issue
Closes #5861
open-for-contributionlabel (or I'm a Supabase maintainer).Checklist
fix(cli): …).pnpm check:allandpnpm testpass for the workspace(s) I touched.