From 8c8117a3ec92a8f9265614806f98ddcf8c767cc7 Mon Sep 17 00:00:00 2001
From: PedroHenrique0713 <pluspedrohenrique@gmail.com>
Date: Thu, 23 Jul 2026 17:59:34 -0300
Subject: [PATCH 1/2] fix(storage): wrap non-StorageError exceptions in
 StorageUnknownError

handleOperation's documented contract is to return { data, error } tuples.
When a non-StorageError was thrown, the error was re-thrown instead of
being wrapped, breaking the expected caller contract.
---
 packages/core/storage-js/src/lib/common/BaseApiClient.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/core/storage-js/src/lib/common/BaseApiClient.ts b/packages/core/storage-js/src/lib/common/BaseApiClient.ts
index fbe9e38e49..5edf81de50 100644
--- a/packages/core/storage-js/src/lib/common/BaseApiClient.ts
+++ b/packages/core/storage-js/src/lib/common/BaseApiClient.ts
@@ -1,4 +1,4 @@
-import { ErrorNamespace, isStorageError, StorageError } from './errors'
+import { ErrorNamespace, isStorageError, StorageError, StorageUnknownError } from './errors'
 import { Fetch } from './fetch'
 import { normalizeHeaders, setHeader as setHeaderUtil } from './headers'
 import { resolveFetch } from './helpers'
@@ -98,7 +98,10 @@ export default abstract class BaseApiClient<TError extends StorageError = Storag
       if (isStorageError(error)) {
         return { data: null, error: error as TError }
       }
-      throw error
+      return {
+        data: null,
+        error: new StorageUnknownError(_getErrorMessage(error), error) as unknown as TError,
+      }
     }
   }
 }

From bdef53944ce4d513d245c569064b05e6cefd7852 Mon Sep 17 00:00:00 2001
From: PedroHenrique0713 <pluspedrohenrique@gmail.com>
Date: Thu, 23 Jul 2026 18:22:09 -0300
Subject: [PATCH 2/2] fix(auth): getUserIdentities null guard and validateUUID
 inside try

---
 packages/core/auth-js/src/GoTrueAdminApi.ts | 9 ++++++++-
 packages/core/auth-js/src/GoTrueClient.ts   | 4 ++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/packages/core/auth-js/src/GoTrueAdminApi.ts b/packages/core/auth-js/src/GoTrueAdminApi.ts
index 656743c352..659cb2abe3 100644
--- a/packages/core/auth-js/src/GoTrueAdminApi.ts
+++ b/packages/core/auth-js/src/GoTrueAdminApi.ts
@@ -623,7 +623,14 @@ export default class GoTrueAdminApi {
    * ```
    */
   async getUserById(uid: string): Promise<UserResponse> {
-    validateUUID(uid)
+    try {
+      validateUUID(uid)
+    } catch {
+      return {
+        data: { user: null },
+        error: new AuthInvalidCredentialsError('Invalid UUID format') as AuthError,
+      }
+    }
 
     try {
       return await _request(this.fetch, 'GET', `${this.url}/admin/users/${uid}`, {
diff --git a/packages/core/auth-js/src/GoTrueClient.ts b/packages/core/auth-js/src/GoTrueClient.ts
index 4f85623bca..aa48db0fd9 100644
--- a/packages/core/auth-js/src/GoTrueClient.ts
+++ b/packages/core/auth-js/src/GoTrueClient.ts
@@ -4462,6 +4462,10 @@ export default class GoTrueClient {
     try {
       const { data, error } = await this.getUser()
       if (error) throw error
+      const { data, error } = await this.getUser()
+      if (error) throw error
+      if (!data.user)
+        return this._returnResult({ data: null, error: new AuthSessionMissingError() })
       return this._returnResult({ data: { identities: data.user.identities ?? [] }, error: null })
     } catch (error) {
       if (isAuthError(error)) {