* fix: apply Injectable programmatically so NestJS adapter loads in raw Node
The @Injectable() decorator on the guard in withSupabase() shipped
untranspiled (tsdown/oxc does not lower legacy decorators), crashing
`require`/`import` of the adapter with SyntaxError under plain Node.
Apply it as Injectable()(SupabaseAuthGuard) instead, and add a raw-Node
load smoke test (pnpm smoke) in CI to catch this class of regression.
Fixes#87
* fix: fail smoke test when no entrypoints are found in exports
* test: add E2E tests for all four adapters against a local Supabase stack
Adds an e2e vitest project (SDK-1143) covering what the mocked unit tests
cannot: real GoTrue-issued JWTs verified against the live JWKS endpoint,
real Supabase client operations via supabaseAdmin, resolveEnv() reading
process.env, and imports from dist/ so packaging regressions fail here.
One scenario set (auth + data access + isolation) runs over real HTTP
against minimal Hono, H3, Elysia, and NestJS apps. Elysia runs behind a
node:http server (srvx) so CI needs no Bun. A separate E2E workflow
starts the local stack with the Supabase CLI, builds, and runs the suite.
* test: grant explicit table privileges in the e2e notes migration
Newer Supabase stacks make new tables private by default — the API roles
(anon/authenticated/service_role) no longer receive DML grants on table
creation. CI installs the latest CLI, so all supabaseAdmin queries failed
with "permission denied for table notes" while JWT scenarios passed.
Reproduced locally on CLI 2.109.1; explicit grants fix it on both old and
new stacks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: align NestJS missing-body handling and cover it in the scenarios
The NestJS app silently inserted an empty note when the body was missing,
while the other three adapters returned 400 — and no scenario exercised
those 400 branches. NestJS now throws BadRequestException like the rest,
and a shared missing-body scenario keeps all four aligned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: cover forged JWTs, the RLS-scoped client, and optional-auth rejection
Closes the three gaps from PR review: the garbage-token scenario failed at
header decode without ever reaching signature verification, ctx.supabase
(the RLS-scoped client) was never exercised, and nothing pinned that a
present-but-invalid token on an optional route is rejected rather than
downgraded to anonymous.
- Mint a well-formed JWT with the live JWKS kid but a wrong signing key in
global setup; every adapter must 401 it — proving signature verification
end-to-end, not just structure checks.
- Add GET /my-notes reading through ctx.supabase with no WHERE clause,
backed by a user_id = auth.uid() select policy — proving the caller's
token reaches PostgREST and Postgres RLS scopes the rows.
- Assert GET /me-optional with an invalid token → 401.
10 → 14 scenarios per adapter (56 tests).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: add core-wrapper app, admin-bypass proof, and sign-in readability
Addresses PR review comments:
- New fifth app on the core withSupabase(config, handler) fetch wrapper —
the exact programming model Supabase Edge Functions deploy — running the
full scenario set behind node:http. A real Deno runtime e2e via
`supabase functions serve` is tracked in SDK-1280.
- New GET /all-notes route (admin client, no filter) + scenario: user2's
request sees user1's rows through supabaseAdmin, directly proving the
admin client is not scoped to the caller's identity.
- Replace the `;({ data, error } = ...)` destructuring-reassignment in the
sign-in helper with a plain result variable.
15 scenarios × 5 apps (75 tests).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Splits release.yml into two jobs to close the OIDC-theft path that the
TanStack/router compromise (2026-05-11) exploited:
- `build` job: contents: write + pull-requests: write (release-please).
Runs install/build/pack and uploads the .tgz as an artifact. NO id-token.
- `publish-npm` job: needs build, id-token: write only. Downloads the
tarball into a scratch dir and runs `npm publish --provenance`. Never
executes pnpm install or any third-party code.
JSR publish and GH pre-release stay in the build job (JSR uses its own
OIDC binding scoped to JSR, not npm).
Also drops `cache: pnpm` from docs.yml and ci.yml. Per
adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache, GitHub
Actions cache poisoning lets a compromised dep on a main-branch workflow
steal the cache token and poison entries that other privileged workflows
on main will restore. release.yml never used cache; docs.yml has
id-token: write for Pages OIDC and is the main remaining target. ci.yml
is low impact but dropped for consistency. preview-release.yml runs in
fork cache scope and is unaffected.
All `\${{ ... }}` substitutions in inline shell scripts moved to env:
blocks (GHSL Part 2 defense in depth, even though upstream values are
regex-validated).
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Katerina Skroumpelou