Auth hooks updates signed access_token, but not REST response. about gotrue

[J0]

Hey!

Thanks for the query. getSession typically checks for a local token which might be out of sync with the recently returned token. If you're looking to obtain an up to date token with custom claims would recommend that you update app_metadata in the Auth Hook and use getUser to obtain a fresh access token.

Alternatively, you could wait for a refresh event to happen and the new access token should show the claims, providing they were saved to the users table.

Hope this helps

[mr-menno]

I’ll try it with app_metadata. Are you saying the auth hook should update the claim, or should the auth hook do an upsert on the auth.users table?

…

On Mon, Feb 12, 2024 at 11:17 PM Joel Lee ***@***.***> wrote: Hey! Thanks for the query. getSession typically checks for a local token which might be out of sync with the recently returned token. If you're looking to obtain an up to date token with custom claims would recommend that you update app_metadata in the Auth Hook and use getUser to obtain a fresh access token. Alternatively, you could wait for a refresh event to happen and the new access token should show the claims, providing they were saved to the users table. Hope this helps — Reply to this email directly, view it on GitHub <#1415 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGK3LCZV7AGIAHZQNIBX2LYTMHQRAVCNFSM6AAAAABDC2AY46VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNBQGU2TENRUGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[J0]

Hey @mr-menno,

Sorry, I spoke with a colleague earlier today who and realized that I misunderstood this query. The REST response indeed does not return the claim but the signed access token does. We'll likely add it in the REST response for the next release

Thanks for flagging this!

[taytzehao]

would like to take this

[mr-menno]

Thanks Joel! Right now I just created an alternate getSession function in supabase to inject the decoding of the JWT and overloading the session.user object. Would love to keep it beyond user_metadata and app_metadata for any claim extension.

…

On Thu, Feb 15, 2024 at 9:46 AM taytzehao ***@***.***> wrote: would like to take this — Reply to this email directly, view it on GitHub <#1415 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGK3LGQ5YCVKNB6PUYA76LYTZCXLAVCNFSM6AAAAABDC2AY46VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNBWG42DGMRSGI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[taytzehao]

@mr-menno , could you show a precise example of it? Currently, when I run

const { data2, error2 } = await supabase.auth.updateUser({
    data: { hello: 'world5' }
  })

data2 is undefined. Do you mean this?

[mr-menno]

I’m following the hooks doc here: https://supabase.com/docs/guides/auth/auth-hooks And the hook user_metadata updates in the signed access_token JWT, but not in the JSON responses (which includes user_metadata and access_token)

…

On Tue, Feb 20, 2024 at 10:36 AM taytzehao ***@***.***> wrote: @mr-menno <https://github.com/mr-menno> , could you show a precise example of it? Currently, when I run const { data2, error2 } = await supabase.auth.updateUser({ data: { hello: 'world5' } }) data2 is undefined. Do you mean this? — Reply to this email directly, view it on GitHub <#1415 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGK3LHOMIENYDOMRG3GDQDYUTUKZAVCNFSM6AAAAABDC2AY46VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNJUHAZTIMZXGI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[tzehaoo]

okay, creating the PR