* test: add E2E tests for all four adapters against a local Supabase stack Adds an e2e vitest project (SDK-1143) covering what the mocked unit tests cannot: real GoTrue-issued JWTs verified against the live JWKS endpoint, real Supabase client operations via supabaseAdmin, resolveEnv() reading process.env, and imports from dist/ so packaging regressions fail here. One scenario set (auth + data access + isolation) runs over real HTTP against minimal Hono, H3, Elysia, and NestJS apps. Elysia runs behind a node:http server (srvx) so CI needs no Bun. A separate E2E workflow starts the local stack with the Supabase CLI, builds, and runs the suite. * test: grant explicit table privileges in the e2e notes migration Newer Supabase stacks make new tables private by default — the API roles (anon/authenticated/service_role) no longer receive DML grants on table creation. CI installs the latest CLI, so all supabaseAdmin queries failed with "permission denied for table notes" while JWT scenarios passed. Reproduced locally on CLI 2.109.1; explicit grants fix it on both old and new stacks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: align NestJS missing-body handling and cover it in the scenarios The NestJS app silently inserted an empty note when the body was missing, while the other three adapters returned 400 — and no scenario exercised those 400 branches. NestJS now throws BadRequestException like the rest, and a shared missing-body scenario keeps all four aligned. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: cover forged JWTs, the RLS-scoped client, and optional-auth rejection Closes the three gaps from PR review: the garbage-token scenario failed at header decode without ever reaching signature verification, ctx.supabase (the RLS-scoped client) was never exercised, and nothing pinned that a present-but-invalid token on an optional route is rejected rather than downgraded to anonymous. - Mint a well-formed JWT with the live JWKS kid but a wrong signing key in global setup; every adapter must 401 it — proving signature verification end-to-end, not just structure checks. - Add GET /my-notes reading through ctx.supabase with no WHERE clause, backed by a user_id = auth.uid() select policy — proving the caller's token reaches PostgREST and Postgres RLS scopes the rows. - Assert GET /me-optional with an invalid token → 401. 10 → 14 scenarios per adapter (56 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: add core-wrapper app, admin-bypass proof, and sign-in readability Addresses PR review comments: - New fifth app on the core withSupabase(config, handler) fetch wrapper — the exact programming model Supabase Edge Functions deploy — running the full scenario set behind node:http. A real Deno runtime e2e via `supabase functions serve` is tracked in SDK-1280. - New GET /all-notes route (admin client, no filter) + scenario: user2's request sees user1's rows through supabaseAdmin, directly proving the admin client is not scoped to the caller's identity. - Replace the `;({ data, error } = ...)` destructuring-reassignment in the sign-in helper with a plain result variable. 15 scenarios × 5 apps (75 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
5.7 KiB
Contributing to @supabase/server
Thank you for your interest in contributing to @supabase/server! This document provides guidelines and instructions for contributing to the project.
Table of Contents
- Getting Started
- Development Setup
- Project Structure
- Development Workflow
- Testing
- Code Style
- Submitting Changes
- Contributing a framework adapter
- Release Process
Getting Started
TBD
Development Setup
Prerequisites
- Node.js: 20.x or higher
- pnpm
Installation
- Fork and clone the repository:
git clone https://github.com/YOUR_USERNAME/server.git
cd server
- Install dependencies:
pnpm install
- Build the project to verify setup:
pnpm build
Development Workflow
Building
Build the library for distribution:
pnpm build
Watch mode for development (rebuilds on file changes):
pnpm run dev
Formatting
Format all code using Prettier:
pnpm format
Testing
Run the unit and integration tests (no external dependencies needed):
pnpm test
End-to-end tests
The E2E suite (e2e/) runs real JWT issuance, real JWKS validation, and real
Supabase client operations against a local Supabase stack, across all four
adapters. It imports the library from dist/, so build first:
pnpm build
cd e2e && supabase start && cd .. # requires Docker
pnpm gen:env
pnpm test:e2e
See e2e/README.md for details. CI runs this suite in a
separate workflow (.github/workflows/e2e.yml).
Submitting Changes
Commit Messages
We use Conventional Commits for automated releases. Format:
<type>(<scope>): <description>
[optional body]
[optional footer]
Types:
feat: New feature (triggers minor version bump)fix: Bug fix (triggers patch version bump)docs: Documentation changes onlytest: Adding or updating testschore: Maintenance tasks, dependency updatesrefactor: Code changes that neither fix bugs nor add featuresperf: Performance improvementsci: CI/CD configuration changes
Breaking changes:
- Use
feat!:orfix!:for breaking changes (triggers major version bump) - Or include
BREAKING CHANGE:in the commit footer
Examples:
feat: add support for view operations
fix: handle empty namespace list correctly
docs: update README with new examples
test: add integration tests for table updates
feat!: change auth config structure
BREAKING CHANGE: auth configuration now uses a discriminated union
Pull Request Process
-
Create a branch from
main:git checkout -b feat/my-feature -
Make your changes following the guidelines above
-
Commit using conventional commit format:
git commit -m "feat: add support for XYZ" -
Push to your fork:
git push origin feat/my-feature -
Open a Pull Request with:
- Clear title following conventional commit format
- Description of what changed and why
- Reference any related issues (e.g., "Fixes #123")
- Screenshots/examples if adding user-facing features
-
Respond to feedback - maintainers may request changes
PR Guidelines
- Keep PRs focused - one feature or fix per PR
- Update documentation if you change public APIs
- Add tests for new functionality
- Ensure all CI checks pass
- Rebase on
mainif needed to resolve conflicts - Be responsive to review feedback
Contributing a framework adapter
Framework adapters (Hono, H3, …) are community-maintained and live in this repo under src/adapters/. They have additional requirements on top of the general PR guidelines above — tests covering every auth mode, no new runtime deps beyond a peer-dep, matching the existing adapter shape, and updating both adapter tables (in README.md and src/adapters/README.md).
See src/adapters/README.md for the full checklist before opening an adapter PR.
Release Process
This project uses release-please for automated releases. You don't need to manually manage versions or changelogs.
How It Works
-
You commit using conventional commit format (see above)
-
release-please creates/updates a release PR automatically when changes are pushed to
main- Updates version in
package.json - Updates
CHANGELOG.md - Generates release notes
- Updates version in
-
Maintainer merges the release PR when ready to release
- Creates a GitHub release and git tag
- Automatically publishes to npm with provenance
Version Bumps
Versions follow Semantic Versioning:
- Major (1.0.0 → 2.0.0): Breaking changes (
feat!:,fix!:, orBREAKING CHANGE:) - Minor (1.0.0 → 1.1.0): New features (
feat:) - Patch (1.0.0 → 1.0.1): Bug fixes (
fix:)
Commits with types like docs:, test:, chore: don't trigger releases on their own.
For Maintainers Only
Publishing is fully automated via GitHub Actions:
- Merge the release-please PR when ready
- GitHub Actions will automatically publish to npm with provenance
- No manual
npm publishneeded
Questions?
- Open an issue for bugs or feature requests
- Check existing issues and PRs before creating new ones
- Tag your issues appropriately (
bug,enhancement,documentation, etc.)
License
By contributing to @supabase/server, you agree that your contributions will be licensed under the MIT License.