-
-
Notifications
You must be signed in to change notification settings - Fork 248
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add third-party auth support #1004
Conversation
Pull Request Test Coverage Report for Build 10130650437Details
💛 - Coveralls |
Correct me if I'm wrong, but couldn't this also be used to authenticate supabase clients, for RLS, during API requests? This assumes a Supabase JWT is being used as the API key. So instead of adding the JWT to the global header, you'd use /* Some API endpoint that your user hits. */
const jwt = 'get-from-request-authorization-header'
const supabase = createClient(
env.SUPABASE_URL,
env.SUPABASE_ANON_KEY, {
+ accessToken: async () => { return `${jwt}` }
- global: {
- headers: {
- Authorization: `Bearer ${jwt}`
- }
- },
- auth: {
- persistSession: false,
- detectSessionInUrl: false,
- autoRefreshToken: false
- }
})
const { data, error } = await supabase.from('table').select('column') |
Absolutely. No more needing to patch the |
10170f4
to
c6fbbd1
Compare
src/SupabaseClient.ts
Outdated
this.accessToken = settings.accessToken | ||
|
||
this.auth = new Proxy<SupabaseAuthClient>({} as any, { | ||
get: (prop) => { | ||
throw new Error( | ||
`@supabase/supabase-js: Supabase Client is configured with the accessToken option, accessing supabase.auth.${prop} is not possible` | ||
) | ||
}, | ||
}) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@hf why would we not want folks to access this if the access token is set?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is it because we want to prevent supabase auth from overriding the access token set?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, it is because this overrides any Supabase Auth access token, so using supabase.auth.,,,
makes no more sense, and this prevents that confusion for now.
What access token will storage receive? Not Supabase Auth's.
c6fbbd1
to
fd66b1a
Compare
fd66b1a
to
7b4c23f
Compare
Adds support for the
accessToken
option on the Supabase client which can be used to provide a third-party authentication (e.g. Auth0, Clerk, Firebase Auth, ...) access token or ID token to be used instead of Supabase Auth.When set,
supabase.auth.xyz
cannot be used and an error will be thrown.