chore: wire up SDK compliance checking#1518
Open
grdsdev wants to merge 11 commits into
Open
Conversation
Adds the three files needed to integrate with the cross-SDK capability matrix (https://github.com/supabase/sdk): - sdk-compliance.yaml — declares implementation status for every feature in the canonical registry, with symbol names mapped to Python class methods so the parser can cross-reference them - sdk-parse-ignore — tells the Python API-surface parser to skip test directories and conftest files - .github/workflows/validate-capabilities.yml — calls the reusable validate-sdk-compliance workflow from supabase/sdk on every push to main and every PR The compliance file covers auth, database (postgrest), storage, realtime, functions, and client configuration. Notable gaps flagged as not_implemented: passkeys, OAuth server/admin APIs, several newer realtime features, and storage vector/analytics buckets. Part of SDK-991.
Use sdk-ref + the branch ref in `uses:` so the validate workflow picks up Python/griffe support from the in-flight supabase/sdk PR. Revert both to @main once SDK PR #36 is merged. Also rename sdk-parse-ignore → .sdk-parse-ignore to match the rename that landed in supabase/sdk#37.
Audit every implemented feature against the supabase-js reference to check behavioral parity, not just method existence. Corrections (wrong not_implemented status): - functions.invocation.region_selection: implemented via region key in invoke_options (FunctionRegion enum → x-region header) - client.authentication_integration.cross_client_token_sync: sub-clients lazily recreated with updated Authorization header on auth events; realtime.set_auth() called directly - realtime.subscriptions.private_channel: private config passed to server - realtime.subscriptions.broadcast_self: broadcast.self config passed to server - realtime.presence.presence_key: presence.key config passed to server Corrections (partial — config passes but behavior diverges from JS): - realtime.subscriptions.broadcast_ack: ack config sent to server but send_broadcast() does not await acknowledgment (JS does) - realtime.configuration.reconnect_backoff: fixed params only; JS accepts a custom reconnect function Symbol fix: - realtime.channel.send: renamed to send_broadcast in Python SDK Note improvements: - auth.session.auto_refresh: mention missing startAutoRefresh/stopAutoRefresh - database.mutate.select_after_mutation: clarify .select() chaining works for column selection after mutations, not just returning='representation'
grdsdev
commented
Jun 25, 2026
Supabase no longer auto-grants public schema access to the anon and authenticated roles. Explicit GRANT statements are now required for tables and sequences to be reachable via the REST Data API. Mirrors the fix applied to supabase-swift in supabase/supabase-swift@8372c18. Ref: https://github.com/orgs/supabase/discussions/45329
All storage3 vector bucket and analytics features are fully implemented: - AsyncStorageVectorsClient/SyncStorageVectorsClient: create/list/delete bucket, from_() - AsyncVectorBucketScope/SyncVectorBucketScope: create/get/list/delete index, index() - AsyncVectorIndexScope/SyncVectorIndexScope: put/get/list/query/delete vectors; list() supports segment_count/segment_index for parallel scan - AsyncStorageAnalyticsClient/SyncStorageAnalyticsClient: create/list/delete bucket; catalog() returns pyiceberg RestCatalog covering iceberg_namespace and iceberg_table
- auth.admin.list_mfa_factors / delete_mfa_factor: real HTTP implementations are wired to admin.mfa.list_factors / delete_factor at construction time - auth.oauth_admin.*: all six operations (create/delete/get/list/regenerate_secret/update) are wired to admin.oauth.* at construction time and make real HTTP calls to admin/oauth/clients endpoints Passkeys, oauth_server, and provider admin features remain not_implemented (no code found in the codebase).
o-santi
requested changes
Jun 29, 2026
- auth.session.auto_refresh: implemented (no startAutoRefresh/stopAutoRefresh needed) - database filters not_in, like_all, like_any, ilike_all, ilike_any: all implemented - database max_affected_rows, request_cancellation, request_timeout: implemented - functions request_cancellation, timeout: implemented via asyncio - realtime broadcast_replay: implemented via broadcast config replay field - realtime custom_logger: not_applicable (Python uses stdlib logging)
grdsdev
changed the title
o-santi
requested changes
Jul 2, 2026
Comment on lines
+507
to
+512
| realtime.client.connection_state: | ||
| status: partially_implemented | ||
| note: "is_connected boolean property; no full connection-state enum exposed." | ||
| symbols: | ||
| - AsyncRealtimeClient.is_connected | ||
| - SyncRealtimeClient.is_connected |
Contributor
There was a problem hiding this comment.
I don't think this should be a feature, as there is no explicit definition of all possible connection states, and this might be misleading to the end user.
Contributor
Author
There was a problem hiding this comment.
These should be connection states https://github.com/supabase/supabase-js/blob/master/packages/core/realtime-js/src/lib/constants.ts#L55
I do think this should be a canonical feature, the client should expose its current state.
WDYT?
Contributor
There was a problem hiding this comment.
I think it only makes sense in the callback model where the client is "opaque" and control flow is hidden; in the iterator approach, it should be obvious what is the current state; ie. before running 'subscribe', its always disconnected, before leaving, its always disconnected, etc.
Contributor
Author
There was a problem hiding this comment.
It may not apply for v3 realtime, but currently it does make sense to have a way to get the connections state.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates supabase-py with the cross-SDK capability matrix at supabase/sdk. On every push to
mainand every PR, CI will now:sdk-compliance.yamlagainst the canonical feature registryChanges
sdk-compliance.yaml— declares implementation status for all 195 features in the registry, with Python class/method symbols for cross-referencing (e.g.AsyncGoTrueClient.sign_up,AsyncBucketActionsMixin.upload).sdk-parse-ignore— tells the Python parser to skip test directories and conftest files.github/workflows/validate-capabilities.yml— calls the reusablevalidate-sdk-compliance.yml@mainworkflow from supabase/sdk withlanguage: pythonImplementation status highlights
admin.mfa.*admin.oauth.*select()chaining after insert/update/upsert/deletenot_invia.not_.in_(); rest viaBaseFilterRequestBuilder.cancel(); timeout viaasyncio.timeout()storage.vectors()→AsyncStorageVectorsClientstorage.analytics()→AsyncStorageAnalyticsClient+ pyicebergRestCatalogFunctionRegionenumrealtime.set_auth()send_broadcast()returns immediately without awaiting the ack (supabase-js awaits it)initial_backoff/max_retriesparams; supabase-js accepts a custom functionDepends on
Part of SDK-991.