fix: explicit apikey header + resilient dev-stack seed-count baselines

- client.py: set apikey explicitly in _create_base_client headers (Kong needs it on every request; for per-user clients apikey stays anon while Authorization carries the user JWT). Fixes the 2 stale header unit tests that asserted apikey in options.headers, and is robust against supabase-py default-header changes. - test_dev_stack: exact == seed counts → >= baselines. The greenfield seed sets a floor; additive exam-marker fixtures (S4-4 cohort) legitimately push live .94 counts above the old snapshot. >= still catches a broken/missing seed. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-06 19:25:39 +00:00
parent 49f84655f7
commit f3da9f3b59
2 changed files with 15 additions and 6 deletions
@@ -23,8 +23,13 @@ def _create_base_client(url: str, key: str, access_token: Optional[str] = None,
    # If an access token is provided, use it for Authorization (enables per-user RLS)
    # Otherwise fall back to the API key
    auth_header = f"Bearer {access_token}" if access_token else f"Bearer {key}"
-    
+
+    # apikey is required by the Supabase gateway (Kong) on every request and is independent of
+    # Authorization: for a per-user client apikey stays the anon key while Authorization carries
+    # the user's JWT (so RLS sees auth.uid()). Set it explicitly rather than relying on
+    # create_client's internal default-header behaviour, which our options.headers override.
    headers = {
+        "apikey": key,
        "Authorization": auth_header,
    }
    if options: