Skip to content

fix(postgrest): use POST fallback for rpc get:true with object args - #2502

Open
AndroidPoet wants to merge 1 commit into
supabase:masterfrom
AndroidPoet:fix/postgrest-rpc-get-object-args
Open

fix(postgrest): use POST fallback for rpc get:true with object args#2502
AndroidPoet wants to merge 1 commit into
supabase:masterfrom
AndroidPoet:fix/postgrest-rpc-get-object-args

Conversation

@AndroidPoet

Copy link
Copy Markdown

Description

rpc(fn, args, { get: true }) silently corrupts the request when any argument is an object (or an array containing objects): the object is stringified into the query string as the literal [object Object].

The rpc method already has a fallback that routes object-valued args to POST (objects can't be serialized into URL params), but the guard only checked head:

const _hasObjectArg = head && Object.values(args as object).some(_isObject)

Since head and get share the same URL-serialization branch (else if (head || get)), a get: true call with an object arg skipped the fallback and hit `${value}`"[object Object]". The sibling head: true path handled it correctly.

Reproduction

supabase.rpc('fn', { filter: { a: 1 } }, { get: true })
// GET /rest/v1/rpc/fn?filter=%5Bobject+Object%5D   ❌

Fix

Extend the POST fallback to get as well, and keep return=minimal head-only so a get caller still receives the function result:

const _hasObjectArg = (head || get) && Object.values(args as object).some(_isObject)
// ...
if (head && _hasObjectArg) {
  headers.set('Prefer', count ? `count=${count},return=minimal` : 'return=minimal')
}

head && _hasObjectArg is equivalent to the original head-only condition, so the existing head behavior is unchanged. get: true with an object arg now sends POST with the args as the body and returns the function result.

Type of Change

  • Bug fix (fix)

Testing

  • Unit test added (test/fetch-errors.test.ts) asserting get: true + object args produces POST, the body carries the args, the URL contains no [object Object], and return=minimal is not set (so the body is returned).
  • Verified the test fails on the pre-fix code (Received: "GET") and passes after the fix.
  • All existing get: true tests (scalar / array / empty args) are unaffected — no test relied on the old behavior.

Checklist

  • Code formatted (nx format:check passes)
  • Builds passing (nx affected --target=build)
  • Type tests passing (nx test:types postgrest-js)
  • Common types in sync (codegen:check)
  • Conventional commit

@AndroidPoet
AndroidPoet requested review from a team as code owners July 6, 2026 19:05
@pkg-pr-new

pkg-pr-new Bot commented Jul 8, 2026

Copy link
Copy Markdown

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2502

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2502

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2502

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2502

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2502

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2502

commit: 2d886b2

@coveralls

Copy link
Copy Markdown

Coverage Status

coverage: 92.942% (+12.6%) from 80.309% — AndroidPoet:fix/postgrest-rpc-get-object-args into supabase:master

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants