Allow session to be valid without refresh token provided

[Envek]

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Now if provide only access token to the set_session method, client will be authenticated and configured, but consequent calls to supabase.auth.get_sesion or supabase.auth.get_user will return None which is confusing.

from supabase import Client, create_client
supabase = create_client(settings.supabase_url, settings.supabase_anon_key)

supabase.auth.set_session(access_token=result.data["access_token"], refresh_token=result.data["refresh_token"])
# => AuthResponse(user=User(id='75672178-…))

supabase.auth.get_sessionO()
=> None

This is because current session is deleted from internal storage if its refresh key is absent (and most surprisingly this deletion happen from the get_session method). See here for details.

But it is pretty convenient to create short sessions from access token only, and let some upstream app to manage these keys by itstelf.

Workaround:

Provide some dummy non-empty refresh token, e.g.

supabase.auth.set_session(access_token=token, refresh_token="foobar")

What is the new behavior?

supabase.auth.get_session and supabase.auth.get_user returns session and user accordingly.

See:

supabase.auth.set_session(new_auth.session.access_token,new_auth.session.refresh_token)
# => AuthResponse(user=User(…) session=Session(…)

[silentworks]

This isn't how this is supposed to work as the current behavior is the save as the JS library. If you need to setup a temporary session then you create a new client and use the access_token as the Authorization header.

from supabase import create_client, ClientOptions

client = create_client(
    url,
    key,
    options=ClientOptions(
        headers={"Authorization": f"Bearer {access_token}"},
    ),
)

[Envek]

Thank you for your reply!

Unfortunately, even in that case client.auth.get_session() and client.auth.get_user() are both still returning None.

For my purposes I can use client.auth.get_user(token) to retrieve info about signed in user, but it feels clumsy as I have to pass token along with already instantiated client down the stack.

[silentworks]

This deviates from all the other client libraries and wouldn't be a change that would be made to the Python library without a consensus from the other libraries.