Repository navigation
feat(tus): object id in Supabase-Object-Id response header - #1500
Merged
ferhatelmas merged 3 commits intoOct 14, 2026
Merged
Conversation
… header (closes supabase#647) TUS clients had no way to resolve the row they just wrote without issuing a follow-up list / search request. Maintainer @fenos pre-approved the pattern ("we could send the object_id back via a header like the upload-id") on the issue in 2024. - src/http/routes/tus/lifecycle.ts * Capture `completed.obj.id` from `uploader.completeUpload(...)`. * Return it as `X-Supabase-Object-Id` alongside the existing `Tus-Complete: 1` header. Header name mirrors Supabase's kebab-case convention and avoids collision with `Upload-ID` (which already carries the TUS resource id, not the storage row id). * Fallback: if `completed.obj.id` is unavailable (older code paths or error-recovery), the header is simply omitted — never undefined-stringified. - src/http/routes/tus/lifecycle.test.ts * Two new vitest cases: - includes `X-Supabase-Object-Id` on happy path with a UUID - gracefully omits the header when `completeUpload` returns no id * `completeUpload` is spied; backend / location are stubbed via the existing `createRawTusRequest` helper (no infra required). Note: CORS is handled by Kong upstream in Supabase deployments, so no Access-Control-Expose-Headers change is needed in the app itself.
Signed-off-by: Ferhat Elmas <elmas.ferhat@gmail.com>
Signed-off-by: Ferhat Elmas <elmas.ferhat@gmail.com>
ferhatelmas
force-pushed
the
feat/tus-object-id-response-header-647
branch
from
October 14, 2026 08:32
d472193 to
82eeb27
Compare
Coverage Report for CI Build 38535875013Coverage increased (+0.02%) to 85.352%Details
Uncovered Changes
Coverage RegressionsNo coverage regressions found. Coverage Stats💛 - Coveralls |
ferhatelmas
approved these changes
Oct 14, 2026
1 of 2 tasks
This was referenced Oct 14, 2026
Open
ferhatelmas
added a commit
that referenced
this pull request
Oct 14, 2026
## What kind of change does this PR introduce? feat ## What is the current behavior? Object id is added in #1500 but it's less useful without version id. ## What is the new behavior? Add version id similarly. ## Additional context Related to #1500 https://www.rfc-editor.org/rfc/rfc6648.html#section-3 Signed-off-by: Ferhat Elmas <elmas.ferhat@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes #647 — TUS clients
had no way to resolve the storage row they just wrote without issuing a
follow-up list or search request.
Maintainer @fenos pre-approved the pattern on the issue in 2024:
Change
In
onUploadFinish(src/http/routes/tus/lifecycle.ts):(
Tus-Complete,Upload-ID).X-Supabase-so it is unambiguously distinct from TUSprotocol headers.
completeUploadreturns without an id — theheader is never emitted as the string
"undefined".Tests
Two new vitest cases in
src/http/routes/tus/lifecycle.test.ts:includes X-Supabase-Object-Id when the created object id is available— happy path with a UUID.
omits X-Supabase-Object-Id gracefully when completeUpload returns no id— defensive fallback.
Both use the existing
createRawTusRequesthelper + spies onUploader.prototype.completeUpload,so they run without needing storage infrastructure.
CORS note
Verified
src/app.ts:25— CORS is handled by Kong upstream (// kong should take care of cors). NoAccess-Control-Expose-Headerschange needed inthe app itself; operators who front the service without Kong already
configure header exposure at the reverse proxy.
Impact
that don't read it see no change.
completed.obj.idis non-empty.the object after upload — common in file-manager UIs, workflow
orchestrators, and S3-to-TUS bridges.