search

Deadwood-ai / deadwood-api

Main FastAPI application for the deadwood backend
GNU General Public License v3.0
0 stars 0 forks source link

"Why `auto_refresh_token=False` #78

Closed JesJehle closed 1 month ago

JesJehle commented 1 month ago

What is the reason to not allow auto refresh of jwt? https://github.com/Deadwood-ai/deadwood-api/blob/0e781fddc871c5e04d2d60aeaf76aba437b190b7/src/supabase.py#L27-L28

mmaelicke commented 1 month ago

If you enable this, the Python process does not end. Thus, ie. the cog generation python process will keep on running forever. There is no easy way around this. It is a very weird design decision by supabase and there are many, many issues concerning this. In the past, they frequently kept on changing this behaviour, which broke my code regularly and almost made me move away from supabase. We should definitely keep an eye on this and try new supabase client versions from time to time, as it is the client library's responsibility to refresh the token, and not ours.

To test, you can write a login function similar to ours, grab something from the database and end python without logging out (as auth is done by the website, not the API). If you log out in python, the token is invalidated and the user needs to log in again.