errorCode is undefined because data.error is not processed

[tvogel]

This is with my local supabase start environment (which might have an effect on the GoTrue version?):

When I get an authentication failure from auth-js, e.g. because of an invalid password, I do not get the useful invalid_grant error code but instead, it is undefined (from console.dir(error)):

AuthApiError: Invalid login credentials
​__isAuthError: true
​code: undefined
​columnNumber: 5
​fileName: "http:https://localhost/node_modules/.vite/deps/@supabase_supabase-js.js?v=71e4d0b2"
​lineNumber: 3828
​message: "Invalid login credentials"
​name: "AuthApiError"
​stack: <removed>
status: 400

This seems to be because, in

auth-js/src/lib/fetch.ts

Line 59 in f131300

if (

and below, it is checking only fordata.code and data.error_code. It seems to me that data.error should be checked as well, because that is what I see in the JSON reply in the network packet:

{"error":"invalid_grant","error_description":"Invalid login credentials"}

Because I am not aware what protocol version checks might be necessary, I won't try to file a pull request. (Also, I was not successful setting up a local version of auth-js.)

[tvogel]

Ah, by the way, a similar issue appears with verifyOtp() even though, here, the JSON in fact looks like:

{"code":"otp_expired","message":"Token has expired or is invalid"}

but still, the code does not make it into the error object:

AuthApiError: Token has expired or is invalid
​__isAuthError: true
​code: undefined
​columnNumber: 5
​fileName: "http:https://localhost/node_modules/.vite/deps/@supabase_supabase-js.js?v=71e4d0b2"
​lineNumber: 3828
​message: "Token has expired or is invalid"
​name: "AuthApiError"
​stack: <removed>
status: 403

[tvogel]

Could it be that the API version check fails because GoTrue is not exposing the version header to the script, see:

https://github.com/supabase/auth/blob/06464c013571253d1f18f7ae5e840826c4bd84a7/internal/api/api.go#L331

[silentworks]

The Supabase auth team is aware of this issue and is tracking it on the Supabase Auth GitHub repo supabase/auth#1631