fix(auth): resolve Firefox content script Promise.then() security errors in locks#2112
fix(auth): resolve Firefox content script Promise.then() security errors in locks#2112
Conversation
📝 WalkthroughWalkthroughUpdated lock implementations in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
No actionable comments were generated in the recent review. 🎉 🧹 Recent nitpick comments
Comment |
@supabase/auth-js
@supabase/functions-js
@supabase/postgrest-js
@supabase/realtime-js
@supabase/storage-js
@supabase/supabase-js
commit: |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@packages/core/auth-js/src/lib/locks.ts`:
- Around line 229-259: The timeout promise unconditionally logs after
acquireTimeout even if the race already resolved; fix by creating the timeout
with a timer handle (e.g., let timer: NodeJS.Timeout) and only perform
console.warn/reject inside the setTimeout callback, then ensure you
clearTimeout(timer) when the other promise wins; concretely, in the
currentOperation block around previousOperationHandled and acquireTimeout,
create the timeoutPromise with a timer id, run
Promise.race([previousOperationHandled, timeoutPromise]) and after the race
resolves or rejects clearTimeout(timer) (or attach .finally to
previousOperationHandled to clear it) so the warning only fires when the timeout
actually fires; reference symbols: previousOperationHandled, acquireTimeout,
ProcessLockAcquireTimeoutError, currentOperation, name.
- Around line 123-185: The navigator.locks.request call can reject with an
AbortError when abortController.abort() fires (acquireTimeout > 0); wrap the
await globalThis.navigator.locks.request(...) invocation in a try-catch, detect
AbortError (e.g. err.name === 'AbortError' or instanceof DOMException) and
rethrow a NavigatorLockAcquireTimeoutError so callers receive the documented
isAcquireTimeout timeout error; keep existing debug logging around query() and
the fallback path, but ensure the catch converts the abort to
NavigatorLockAcquireTimeoutError while rethrowing other errors unchanged
(reference symbols: navigator.locks.request, abortController, AbortError,
NavigatorLockAcquireTimeoutError, fn, internals.debug).
🧹 Nitpick comments (1)
packages/core/auth-js/src/lib/locks.ts (1)
96-289: Please add/confirm targeted tests for this Firefox regression.
Given this is a cross-library bug fix, it would be great to add a unit test in auth-js for the lock helpers plus an integration test in supabase-js that simulates the content-script context to ensure no.then()access occurs. I can help draft tests if useful. Based on learnings: “For cross-library bug fixes, fix root cause in source library, add unit tests there, add integration tests in supabase-js, verify both test suites, and commit with description of impact.”
4b61d32 to
c7c86fa
Compare
* fix(postgrest): enforce type safety for table and view names in from() method (supabase#2058) * docs(auth): clarify updateUserById does not trigger client listeners (supabase#2114) * fix(auth): resolve Firefox content script Promise.then() security errors in locks (supabase#2112) * build(deps): bump qs from 6.14.1 to 6.14.2 in the npm_and_yarn group across 1 directory (supabase#2118) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(release): version 2.96.0 changelogs (supabase#2121) Co-authored-by: supabase-releaser[bot] <supabase-releaser[bot]@users.noreply.github.com> * docs(supabase): document UNUSED_EXTERNAL_IMPORT build warning as false positive (supabase#2122) * feat(auth): add skipAutoInitialize option to prevent constructor auto-init (supabase#2123) * chore(release): version 2.97.0 changelogs (supabase#2124) Co-authored-by: supabase-releaser[bot] <supabase-releaser[bot]@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Vaibhav <[email protected]> Co-authored-by: Katerina Skroumpelou <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: supabase-releaser[bot] <223506987+supabase-releaser[bot]@users.noreply.github.com> Co-authored-by: supabase-releaser[bot] <supabase-releaser[bot]@users.noreply.github.com>
Description
Fixes Firefox extension content scripts failing when using Supabase auth.
.then()on cross-context promises fromnavigator.locks.then()/.catch()withawait/try-catchinlocks.tsFixes #2108
Changes
navigatorLock(): ReplacePromise.resolve().then()with sequential awaitsprocessLock(): Replace.catch()/.then()chains with async IIFE + try/catchBreaking Changes
None. Firefox now works, everything else unchanged.
Summary by CodeRabbit
Bug Fixes
Tests