From bcdb5ae9b2fd9b138694dd6151e49e9a32f8dcb1 Mon Sep 17 00:00:00 2001 From: Fabio Gartenmann <137318798+artiphishle@users.noreply.github.com> Date: Wed, 5 Aug 2026 04:03:40 +0200 Subject: [PATCH 1/4] fix: parse configured fields through PostgreSQL text --- src/adapter.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/adapter.ts b/src/adapter.ts index b201f3e..11ecb8e 100644 --- a/src/adapter.ts +++ b/src/adapter.ts @@ -122,7 +122,7 @@ export function createSupabaseVaultAdapter( (project_id, environment, secret_ref, vault_secret_id, kind, provider, configured_fields) values ( $1, $2, $3, $4::uuid, $5, $6, - array(select jsonb_array_elements_text($7::jsonb)) + array(select jsonb_array_elements_text($7::text::jsonb)) ) returning project_id, environment, secret_ref, kind, provider, configured_fields, created_at::text, updated_at::text`, @@ -168,7 +168,7 @@ export function createSupabaseVaultAdapter( const updated = await executor.query( `update ${metadataTable} set configured_fields = array( - select jsonb_array_elements_text($4::jsonb) + select jsonb_array_elements_text($4::text::jsonb) ), updated_at = now() where project_id = $1 and environment = $2 and secret_ref = $3 From eae1b35f29dad28a937ea7dfa2cef7b23304833e Mon Sep 17 00:00:00 2001 From: Fabio Gartenmann <137318798+artiphishle@users.noreply.github.com> Date: Wed, 5 Aug 2026 04:04:13 +0200 Subject: [PATCH 2/4] test: cover Bun-safe JSON array casts --- src/adapter.test.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/adapter.test.ts b/src/adapter.test.ts index 95b7a3b..4782788 100644 --- a/src/adapter.test.ts +++ b/src/adapter.test.ts @@ -69,7 +69,10 @@ describe('createSupabaseVaultAdapter', () => { expect(JSON.stringify(result)).not.toContain('vault-id'); const [, , insertCall] = client.calls; - expect(insertCall?.sql).toContain('array(select jsonb_array_elements_text($7::jsonb))'); + expect(insertCall?.sql).toContain( + 'array(select jsonb_array_elements_text($7::text::jsonb))', + ); + expect(insertCall?.sql).not.toContain('jsonb_array_elements_text($7::jsonb)'); expect(insertCall?.parameters[6]).toBe('["clientId","clientSecret"]'); expect(Array.isArray(insertCall?.parameters[6])).toBe(false); }); @@ -104,7 +107,8 @@ describe('createSupabaseVaultAdapter', () => { expect(JSON.stringify(result)).not.toContain('ROTATED_SECRET'); const [, , updateCall] = client.calls; - expect(updateCall?.sql).toContain('select jsonb_array_elements_text($4::jsonb)'); + expect(updateCall?.sql).toContain('select jsonb_array_elements_text($4::text::jsonb)'); + expect(updateCall?.sql).not.toContain('jsonb_array_elements_text($4::jsonb)'); expect(updateCall?.parameters[3]).toBe('["clientSecret"]'); expect(Array.isArray(updateCall?.parameters[3])).toBe(false); }); From e741bf8c09812316a969bae2e9d2cef95098abbf Mon Sep 17 00:00:00 2001 From: Fabio Gartenmann <137318798+artiphishle@users.noreply.github.com> Date: Wed, 5 Aug 2026 04:04:39 +0200 Subject: [PATCH 3/4] chore: add patch changeset --- .changeset/clean-json-arrays.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/clean-json-arrays.md diff --git a/.changeset/clean-json-arrays.md b/.changeset/clean-json-arrays.md new file mode 100644 index 0000000..f6f988b --- /dev/null +++ b/.changeset/clean-json-arrays.md @@ -0,0 +1,5 @@ +--- +'@ankhorage/supabase-vault': patch +--- + +Parse serialized configured-field arrays through PostgreSQL text before converting them to JSONB so Bun SQL does not expose them as JSON scalar strings during secret creation or replacement. From 3cb50c18b39cd844b5936da4c15ab50f8d5dc1c1 Mon Sep 17 00:00:00 2001 From: artiphishle Date: Wed, 5 Aug 2026 04:06:42 +0200 Subject: [PATCH 4/4] chore(lint): fix --- src/adapter.test.ts | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/adapter.test.ts b/src/adapter.test.ts index 4782788..ae72bc1 100644 --- a/src/adapter.test.ts +++ b/src/adapter.test.ts @@ -69,9 +69,7 @@ describe('createSupabaseVaultAdapter', () => { expect(JSON.stringify(result)).not.toContain('vault-id'); const [, , insertCall] = client.calls; - expect(insertCall?.sql).toContain( - 'array(select jsonb_array_elements_text($7::text::jsonb))', - ); + expect(insertCall?.sql).toContain('array(select jsonb_array_elements_text($7::text::jsonb))'); expect(insertCall?.sql).not.toContain('jsonb_array_elements_text($7::jsonb)'); expect(insertCall?.parameters[6]).toBe('["clientId","clientSecret"]'); expect(Array.isArray(insertCall?.parameters[6])).toBe(false);