Files
supabase__server/CONTRIBUTING.md
Katerina Skroumpelou 09a67506db test: add E2E tests for all four adapters against a local Supabase stack (#99)
* test: add E2E tests for all four adapters against a local Supabase stack

Adds an e2e vitest project (SDK-1143) covering what the mocked unit tests
cannot: real GoTrue-issued JWTs verified against the live JWKS endpoint,
real Supabase client operations via supabaseAdmin, resolveEnv() reading
process.env, and imports from dist/ so packaging regressions fail here.

One scenario set (auth + data access + isolation) runs over real HTTP
against minimal Hono, H3, Elysia, and NestJS apps. Elysia runs behind a
node:http server (srvx) so CI needs no Bun. A separate E2E workflow
starts the local stack with the Supabase CLI, builds, and runs the suite.

* test: grant explicit table privileges in the e2e notes migration

Newer Supabase stacks make new tables private by default — the API roles
(anon/authenticated/service_role) no longer receive DML grants on table
creation. CI installs the latest CLI, so all supabaseAdmin queries failed
with "permission denied for table notes" while JWT scenarios passed.
Reproduced locally on CLI 2.109.1; explicit grants fix it on both old and
new stacks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: align NestJS missing-body handling and cover it in the scenarios

The NestJS app silently inserted an empty note when the body was missing,
while the other three adapters returned 400 — and no scenario exercised
those 400 branches. NestJS now throws BadRequestException like the rest,
and a shared missing-body scenario keeps all four aligned.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: cover forged JWTs, the RLS-scoped client, and optional-auth rejection

Closes the three gaps from PR review: the garbage-token scenario failed at
header decode without ever reaching signature verification, ctx.supabase
(the RLS-scoped client) was never exercised, and nothing pinned that a
present-but-invalid token on an optional route is rejected rather than
downgraded to anonymous.

- Mint a well-formed JWT with the live JWKS kid but a wrong signing key in
  global setup; every adapter must 401 it — proving signature verification
  end-to-end, not just structure checks.
- Add GET /my-notes reading through ctx.supabase with no WHERE clause,
  backed by a user_id = auth.uid() select policy — proving the caller's
  token reaches PostgREST and Postgres RLS scopes the rows.
- Assert GET /me-optional with an invalid token → 401.

10 → 14 scenarios per adapter (56 tests).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: add core-wrapper app, admin-bypass proof, and sign-in readability

Addresses PR review comments:

- New fifth app on the core withSupabase(config, handler) fetch wrapper —
  the exact programming model Supabase Edge Functions deploy — running the
  full scenario set behind node:http. A real Deno runtime e2e via
  `supabase functions serve` is tracked in SDK-1280.
- New GET /all-notes route (admin client, no filter) + scenario: user2's
  request sees user1's rows through supabaseAdmin, directly proving the
  admin client is not scoped to the caller's identity.
- Replace the `;({ data, error } = ...)` destructuring-reassignment in the
  sign-in helper with a plain result variable.

15 scenarios × 5 apps (75 tests).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-09 10:36:13 +03:00

5.7 KiB

Contributing to @supabase/server

Thank you for your interest in contributing to @supabase/server! This document provides guidelines and instructions for contributing to the project.

Table of Contents

Getting Started

TBD

Development Setup

Prerequisites

  • Node.js: 20.x or higher
  • pnpm

Installation

  1. Fork and clone the repository:
git clone https://github.com/YOUR_USERNAME/server.git
cd server
  1. Install dependencies:
pnpm install
  1. Build the project to verify setup:
pnpm build

Development Workflow

Building

Build the library for distribution:

pnpm build

Watch mode for development (rebuilds on file changes):

pnpm run dev

Formatting

Format all code using Prettier:

pnpm format

Testing

Run the unit and integration tests (no external dependencies needed):

pnpm test

End-to-end tests

The E2E suite (e2e/) runs real JWT issuance, real JWKS validation, and real Supabase client operations against a local Supabase stack, across all four adapters. It imports the library from dist/, so build first:

pnpm build
cd e2e && supabase start && cd ..   # requires Docker
pnpm gen:env
pnpm test:e2e

See e2e/README.md for details. CI runs this suite in a separate workflow (.github/workflows/e2e.yml).

Submitting Changes

Commit Messages

We use Conventional Commits for automated releases. Format:

<type>(<scope>): <description>

[optional body]

[optional footer]

Types:

  • feat: New feature (triggers minor version bump)
  • fix: Bug fix (triggers patch version bump)
  • docs: Documentation changes only
  • test: Adding or updating tests
  • chore: Maintenance tasks, dependency updates
  • refactor: Code changes that neither fix bugs nor add features
  • perf: Performance improvements
  • ci: CI/CD configuration changes

Breaking changes:

  • Use feat!: or fix!: for breaking changes (triggers major version bump)
  • Or include BREAKING CHANGE: in the commit footer

Examples:

feat: add support for view operations
fix: handle empty namespace list correctly
docs: update README with new examples
test: add integration tests for table updates
feat!: change auth config structure

BREAKING CHANGE: auth configuration now uses a discriminated union

Pull Request Process

  1. Create a branch from main:

    git checkout -b feat/my-feature
    
  2. Make your changes following the guidelines above

  3. Commit using conventional commit format:

    git commit -m "feat: add support for XYZ"
    
  4. Push to your fork:

    git push origin feat/my-feature
    
  5. Open a Pull Request with:

    • Clear title following conventional commit format
    • Description of what changed and why
    • Reference any related issues (e.g., "Fixes #123")
    • Screenshots/examples if adding user-facing features
  6. Respond to feedback - maintainers may request changes

PR Guidelines

  • Keep PRs focused - one feature or fix per PR
  • Update documentation if you change public APIs
  • Add tests for new functionality
  • Ensure all CI checks pass
  • Rebase on main if needed to resolve conflicts
  • Be responsive to review feedback

Contributing a framework adapter

Framework adapters (Hono, H3, …) are community-maintained and live in this repo under src/adapters/. They have additional requirements on top of the general PR guidelines above — tests covering every auth mode, no new runtime deps beyond a peer-dep, matching the existing adapter shape, and updating both adapter tables (in README.md and src/adapters/README.md).

See src/adapters/README.md for the full checklist before opening an adapter PR.

Release Process

This project uses release-please for automated releases. You don't need to manually manage versions or changelogs.

How It Works

  1. You commit using conventional commit format (see above)

  2. release-please creates/updates a release PR automatically when changes are pushed to main

    • Updates version in package.json
    • Updates CHANGELOG.md
    • Generates release notes
  3. Maintainer merges the release PR when ready to release

    • Creates a GitHub release and git tag
    • Automatically publishes to npm with provenance

Version Bumps

Versions follow Semantic Versioning:

  • Major (1.0.0 → 2.0.0): Breaking changes (feat!:, fix!:, or BREAKING CHANGE:)
  • Minor (1.0.0 → 1.1.0): New features (feat:)
  • Patch (1.0.0 → 1.0.1): Bug fixes (fix:)

Commits with types like docs:, test:, chore: don't trigger releases on their own.

For Maintainers Only

Publishing is fully automated via GitHub Actions:

  1. Merge the release-please PR when ready
  2. GitHub Actions will automatically publish to npm with provenance
  3. No manual npm publish needed

Questions?

  • Open an issue for bugs or feature requests
  • Check existing issues and PRs before creating new ones
  • Tag your issues appropriately (bug, enhancement, documentation, etc.)

License

By contributing to @supabase/server, you agree that your contributions will be licensed under the MIT License.