fix: preserve verify_jwt setting when not in config.toml by deepshekhardas · Pull Request #5348 · supabase/cli · GitHub
Skip to content

fix: preserve verify_jwt setting when not in config.toml#5348

Merged
jgoux merged 6 commits into
supabase:developfrom
deepshekhardas:fix/verify-jwt-deploy-preserve
Jun 23, 2026
Merged

fix: preserve verify_jwt setting when not in config.toml#5348
jgoux merged 6 commits into
supabase:developfrom
deepshekhardas:fix/verify-jwt-deploy-preserve

Conversation

@deepshekhardas

Copy link
Copy Markdown
Contributor

Changes

Changes the unction.VerifyJWT field from �ool to *bool across the codebase to distinguish between "not configured" and "explicitly set to false".

Files modified

  • pkg/config/config.go: Changed VerifyJWT type from �ool to *bool
  • internal/functions/deploy/deploy.go: Removed hardcoded VerifyJWT = true for functions not in config.toml; flag override now sets pointer properly
  • pkg/function/deploy.go: Updated reference to match new pointer type
  • pkg/function/batch.go: Updated comparison and assignment for *bool
  • internal/functions/serve/serve.go: Defaults to rue when *bool is nil for local serve
  • pkg/function/batch_test.go: Updated test to use cast.Ptr(true)

Rationale

Previously, the CLI always sent �erify_jwt: true in deploy metadata for functions not listed in config.toml, overwriting the dashboard setting. With this fix, when �erify_jwt is not specified in config.toml, the field is omitted from the deploy payload (
il), allowing the API to preserve the existing server-side value.

Fixes #43608

@deepshekhardas deepshekhardas requested a review from a team as a code owner May 25, 2026 11:29
Changes VerifyJWT field from bool to *bool so the CLI can distinguish
between 'not configured' and 'explicitly set to false'. When verify_jwt
is not present in config.toml, the field is omitted from deploy metadata
(nil), allowing the API to preserve the existing server-side setting
instead of defaulting to true and overwriting the dashboard value.

Fixes #43608
@jgoux jgoux force-pushed the fix/verify-jwt-deploy-preserve branch from 3136caa to 673d81f Compare June 23, 2026 08:48
@jgoux jgoux force-pushed the fix/verify-jwt-deploy-preserve branch from 673d81f to bec2dd3 Compare June 23, 2026 09:10
jgoux and others added 4 commits June 23, 2026 11:50
The shared deploy path now lists remote functions to preserve the
server-side verify_jwt when it is not configured locally. The legacy
deploy integration tests did not mock the new GET /functions call, so it
fell through to a 404/201 response and the deploy failed. Mock the list
call and assert on the deploy request directly instead of by index.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@jgoux jgoux added this pull request to the merge queue Jun 23, 2026
Merged via the queue into supabase:develop with commit 2ce303a Jun 23, 2026
28 checks passed
Coly010 added a commit to 7ttp/cli that referenced this pull request Jun 23, 2026
Resolve semantic conflict from supabase#5348 ("preserve verify_jwt setting when not
in config.toml"), which added a required `rawConfigFunctions` input to the
shared `resolveFunctionConfigs` and made resolved `verifyJwt` optional:

- export `rawFunctionConfigRecord` from deploy.ts and thread the raw functions
  document through serve's `ServeResolvedConfig` into `resolveFunctionConfigs`.
- default the container `verifyJWT` to `true` when `verify_jwt` is unset,
  matching the Go serve path (serve.go: `verifyJWT := true; if fc.VerifyJWT
  != nil { ... }`) rather than deploy's omit-when-unset behavior.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants