You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
refactor(stack-supabase): simplify the plaintext-table path from #1544 - #1615
Cleanups from a /simplify pass on #1544. #1544 has merged, so this PR now targets main. Nothing changes in behaviour.
Changes
column-map.ts: ColumnMap.hasEncryptedColumns is now a readonly field, set in the constructor from tableHasEncryptedColumns(table). Before, it worked the answer out again from encryptedColumnNames. That meant the one rule create.ts relies on was written twice, and the two copies agreed only because of how the constructor loop works. The field sits with the other public readonly fields.
query-results.ts: the Supabase-error branch of decryptResults now builds its response with respond(), like every other branch.
supabase-plaintext-table.test.ts: the near-identical introspectedClient and declaredClient builders are now one clientFor(connect) helper. Each mode passes its options as a literal straight to makeEncryptedSupabase, so the factory's overloads still type-check them.
Verification
vitest run on supabase-plaintext-table and supabase-encryption-error: 26 passed.
I renamed databaseUrl in a test literal as a check, and tsc failed on it.
pnpm run code:check: no errors.
CI is green on the head commit, including the full test suite on Node 22, Node 24 and Bun, and the live Supabase v3 integration job.
Review notes
There is no changeset because this is an internal refactor with no change in behaviour.
These cleanup findings were left as they are:
Scan only top-level values and embedded relations in the ciphertext guard (efficiency). A narrower scan would change what the guard refuses, so that is a behaviour decision, not a cleanup.
Make encryptionClient nullable for plaintext tables (altitude). That is a wider refactor of the query builder than this pass covers.
The guard's "embedded relation is not supported" message is only accurate when the parent table is plaintext (altitude). Changing it is a behaviour and wording decision.
Use fakeEnvelope in the ciphertext tests (reuse). fakeEnvelope is a v2 shape that carries a pt plaintext field, and these tests need a realistic v3 envelope.
Supabase error responses now retain standard response fields while including the error message, details, hint, and code. This provides a consistent response structure for callers while preserving the information supplied with Supabase errors.
…rule
ColumnMap.hasEncryptedColumns re-derived the plaintext-table rule from
encryptedColumnNames instead of calling tableHasEncryptedColumns, the
rule create.ts uses to choose what Encryption receives. It now reads
that function once in the constructor, so the two cannot drift.
Also routes decryptResults' Supabase-error branch through respond(),
and folds the two near-identical test client builders into one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jmn7nhALwP5BxDDr1reNV
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
No actionable comments were generated in the recent review.
Walkthrough
The change stores encrypted-column presence as a readonly ColumnMap property, consolidates test-client setup for introspected and declared schemas, and builds Supabase error responses through respond(null) before copying error fields.
Changes: Supabase adapter updates
Layer / File(s)
Summary
Column metadata and test-client setup languages/typescript/packages/stack-supabase/src/column-map.ts, languages/typescript/packages/stack-supabase/__tests__/supabase-plaintext-table.test.ts
ColumnMap initializes hasEncryptedColumns from the table definition. The tests use one client builder configured for introspected or declared schemas.
Supabase error response construction languages/typescript/packages/stack-supabase/src/query-results.ts
The error path builds standard response fields through respond(null), then copies error details from the Supabase result.
cipherstash/stack#1544: Introduces plaintext-table behavior that shares ColumnMap, result handling, and schema-mode tests with this change.
Suggested reviewers:tobyhede
Merge Risk: Minimal · up to 520e1
No merge-blocking behavior change was identified.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title clearly identifies an internal refactor in the stack-supabase plaintext-table path and relates to the changeset.
Docstring Coverage
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 3 files.
This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
This PR has no changeset on purpose. It is an internal refactor with no change in behaviour, and it merges into #1544's branch, which already has the @cipherstash/stack-supabase changeset for this work.
The reason will be displayed to describe this comment to others. Learn more.
Review attestation
Reviewed 3c4b37b · posted from Claude Code · claude-opus-5-5 · effort medium
Sources: code-review · claude-opus-5-5
Skills: code-review, review-cross-check, review-post
Findings (2): 2 minor — 2 inline, 0 below.
No correctness defects found: the hasEncryptedColumns field, the decryptResults error branch and the shared test helper each behave the same as the code they replace.
…c fields
clientFor took its options as a hand-written union and cast them to
never, so a renamed EncryptedSupabaseOptions key no longer failed the
build. It now takes a connect callback, keeping the options literal at
the makeEncryptedSupabase call where the overloads check it.
Also moves ColumnMap.hasEncryptedColumns up with the other public
readonly fields.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jmn7nhALwP5BxDDr1reNV
cipherstash-agent
changed the title
refactor(stack-supabase): simplify cleanups for #1544
refactor(stack-supabase): simplify the plaintext-table path from #1544
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cipherstash-agent
left a comment
cipherstash-agent
changed the title
Requested by CipherStash · project thread
Summary
Cleanups from a
/simplifypass on #1544. #1544 has merged, so this PR now targetsmain. Nothing changes in behaviour.Changes
column-map.ts:ColumnMap.hasEncryptedColumnsis now a readonly field, set in the constructor fromtableHasEncryptedColumns(table). Before, it worked the answer out again fromencryptedColumnNames. That meant the one rulecreate.tsrelies on was written twice, and the two copies agreed only because of how the constructor loop works. The field sits with the other public readonly fields.query-results.ts: the Supabase-error branch ofdecryptResultsnow builds its response withrespond(), like every other branch.supabase-plaintext-table.test.ts: the near-identicalintrospectedClientanddeclaredClientbuilders are now oneclientFor(connect)helper. Each mode passes its options as a literal straight tomakeEncryptedSupabase, so the factory's overloads still type-check them.Verification
vitest runonsupabase-plaintext-tableandsupabase-encryption-error: 26 passed.databaseUrlin a test literal as a check, andtscfailed on it.pnpm run code:check: no errors.Review notes
There is no changeset because this is an internal refactor with no change in behaviour.
These cleanup findings were left as they are:
encryptionClientnullable for plaintext tables (altitude). That is a wider refactor of the query builder than this pass covers.fakeEnvelopein the ciphertext tests (reuse).fakeEnvelopeis a v2 shape that carries aptplaintext field, and these tests need a realistic v3 envelope.🤖 Generated with Claude Code
https://claude.ai/code/session_012Jmn7nhALwP5BxDDr1reNV
Summary by CodeRabbit