Files
supabase/packages/common/sentry.test.ts
T
claude[bot]andClaude 6c6b19c6c6 chore(studio): report empty-body GET 200s to Sentry with a no-store probe (#51123)
<!-- ccr-slack-attribution -->
_Requested by **Ivan Vasilov** · [Slack
thread](https://supabase.slack.com/archives/C063LNYJJKS/p1790710416069689?thread_ts=1790710416.069689&cid=C063LNYJJKS)_

**Before:** When a Studio API GET comes back as a 200 with an empty
body, openapi-fetch hands the caller `{}` and we only see the downstream
crash, with no record of the response that caused it.

**After:** The first time this happens for an endpoint in a page
session, Studio sends one Sentry warning, `Empty response body on
successful API request`. It carries the response metadata, browser
state, resource timing, and the result of a single `cache: 'no-store'`
refetch. What the caller receives is unchanged.

## Problem

Studio crashes trace back to GET requests that return 200 with an empty
body, which openapi-fetch turns into `{}`. They are heavily skewed to
Firefox and Safari. The leading hypothesis is browser cache revalidation
(Express weak ETags, no `Cache-Control` on api.supabase.com), but
nothing confirms it yet. The `no-store` probe tells the two cases apart:
if the refetch has a body, the browser cache is the likely culprit; if
it is also empty, the server or the edge is sending empty bodies. This
data should show whether the fix belongs on the API side or the
Cloudflare side.

Context: #51041 (closed) tried to guard the crashing call sites instead.

## Needs API-side change to be fully useful

Cross-origin, Studio can only read CORS-safelisted response headers, and
resource timing sizes read as zero. If api.supabase.com sends
`Access-Control-Expose-Headers: ETag, cf-ray, cf-cache-status,
x-request-id` and `Timing-Allow-Origin: <studio origin>`, this event
will also carry the ETag, cf-ray, and cache status, plus the real
transfer and body sizes and the negotiated protocol. Until then, those
fields read as `null` or `0`.

## Solution

- `data/empty-body-diagnostics.ts` (new): `reportEmptyBodyResponse({
request, response, schemaPath })`.
- Runs only for `GET` and only when `IS_PLATFORM`. Empty POST/201 bodies
are legitimate.
- Reports at most once per templated endpoint per page session
(module-level `Set`).
- Endpoint: openapi-fetch's `schemaPath` (e.g.
`/platform/projects/{ref}/settings`), passed through
`templateEndpointPath`. That function drops the query string and hash,
replaces the segment after `projects`/`organizations`/`branches` with
`{ref}`/`{slug}`/`{branch}`, and replaces UUIDs, numeric IDs, and 20+
character alphanumeric IDs with `{id}`. I used `schemaPath` rather than
the request URL so user-chosen names (bucket names, function slugs)
never end up in tags or fingerprints.
- Probe: one plain `fetch(new Request(request, { cache: 'no-store', ...
}))` with a fresh `X-Request-Id` and a 10s `AbortController` timeout.
`AbortSignal.timeout` isn't available in older Safari. The probe
bypasses the openapi-fetch middleware, so it can't recurse. Only the
body's byte length is recorded, never its contents.
- Event: `level: 'warning'`, `fingerprint: ['empty-body-response',
endpoint]`, `tags: { endpoint, probe_has_body, empty_body_diagnostic:
'true' }`, where `probe_has_body` is `true` / `false` / `error`. `extra`
holds:
- the request: method, status, `response.type`, `redirected`, and the
original `X-Request-Id` (for API log lookup)
- response headers: `content-type`, `cache-control`, `last-modified`,
`expires`, `content-length`, `etag`, `cf-ray`, `cf-cache-status`,
`x-request-id`
- browser state: `visibilityState`, `navigator.onLine`, the navigation
type, ms since navigation start, and whether the page was restored from
bfcache
- the latest `PerformanceResourceTiming` for the URL (transfer, encoded,
and decoded size, `nextHopProtocol`, `responseStatus`)
- the probe: status, request ID, body length, `content-length`,
`content-type`, or the error name
- Fire-and-forget: everything is wrapped in a `try`/`catch`, and the
caller does not await it.
- `data/fetchers.ts`: the `onResponse` middleware passes `{ request,
schemaPath }` to `normalizeEmptyBodyResponse`, which calls the reporter
in its empty-body branch and also for a 200 that carries
`Content-Length: 0`. openapi-fetch short-circuits that case to `{}` the
same way, so it is the same symptom. The return value is unchanged in
every branch.
- `packages/common/sentry.ts`: `filterSentryEvent` normally keeps only
1% of events that aren't page crashes. It now sends events tagged
`empty_body_diagnostic` unsampled, with `codeSampleRate: '1'`. A
once-per-session warning would barely show up at 1%. Consent and
platform gating and the third-party filter still apply. www and docs
also use `filterSentryEvent`, but only Studio's reporter sets this tag,
so sampling for them and for every other Studio event is unchanged.

Sentry config: Studio's `beforeSend` doesn't otherwise drop this
message. It has no exception values, so the no-stack-trace filter
doesn't apply, and it matches no `ignoreErrors` entry.

## Review instructions

1. Check `normalizeEmptyBodyResponse` in `data/fetchers.ts`: the
reporter is `void`-called and its return value is untouched.
2. Check `probe()` in `data/empty-body-diagnostics.ts`: only
`byteLength` is read from the body. The probe reuses the original
request's headers and credentials (same auth as the original GET).
3. Check `filterSentryEvent` in `packages/common/sentry.ts`: only the
`empty_body_diagnostic` tag skips sampling.
4. Tests: `data/empty-body-diagnostics.test.ts` and
`packages/common/sentry.test.ts`.

## Verification

- Unit tests (`data/empty-body-diagnostics.test.ts`, new):
  - path templating cases
  - `probe_has_body` `true` / `false` / `error`
  - the secret body content never appears in the Sentry call
  - one report per endpoint
  - non-GET and non-platform requests are skipped
  - no throw when `fetch` or Sentry throws
- end-to-end through `client.GET`: still resolves `{}` and reports the
`schemaPath`, for both a missing `Content-Length` and `Content-Length:
0`
- `packages/common/sentry.test.ts`: tagged diagnostics are sent
unsampled, untagged or false-tagged ones are still sampled, and they're
still dropped without consent.

These tests, plus the existing `normalizeEmptyBodyResponse.test.ts`,
`handleError.test.ts`, and the rest of `sentry.test.ts`, pass (67 tests)
under vitest 5 + jsdom. I ran them in a minimal harness, not the full
`pnpm install` workspace, because the local checkout is sparse.
- I ran TypeScript 7.0.2 (`--strict`) on the five touched files against
the real `api-types`, with stubbed `common`/Sentry types. No errors in
the touched files.
- Prettier `--check` with the repo config passes, with and without
`SORT_IMPORTS=false`.
- Not run locally: the full studio typecheck, `lint:ratchet`, and knip.
CI covers them. The change adds no `any`, no default exports, and no
deps.

## Checklist

- [x] I have read
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01UefDak8XYLMi9aiEjDPXc5

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-10-07 16:15:57 +02:00

97 lines
3.4 KiB
TypeScript

import { afterEach, describe, expect, it, vi } from 'vitest'
import { filterSentryEvent } from './sentry'
const enabled = { isPlatform: true, hasConsent: true }
afterEach(() => {
vi.restoreAllMocks()
})
describe('which errors get sent to Sentry', () => {
it.each([undefined, {}, { third_party_code: false }, { third_party_code: 'false' }])(
'sends sampled app errors and records the sample rate: %j',
(tags) => {
vi.spyOn(Math, 'random').mockReturnValue(0)
const event = { tags, exception: { values: [{ value: 'Page crashed' }] } }
expect(filterSentryEvent(event, enabled)).toBe(event)
expect(event.tags).toEqual({ ...tags, codeSampleRate: '0.01' })
}
)
it.each([true, 'true'])('drops errors marked as coming from outside the app: %s', (tag) => {
expect(filterSentryEvent({ tags: { third_party_code: tag } }, enabled)).toBeNull()
})
it.each([true, 'true'])(
'sends page crashes even when the code location is missing: %s',
(tag) => {
const random = vi.spyOn(Math, 'random').mockReturnValue(0.99)
const event = {
tags: { third_party_code: true, globalErrorBoundary: tag },
exception: { values: [{ value: 'Page crashed' }] },
}
expect(filterSentryEvent(event, enabled)).toBe(event)
expect(event.tags).toEqual({
third_party_code: true,
globalErrorBoundary: tag,
codeSampleRate: '1',
})
expect(random).not.toHaveBeenCalled()
}
)
it.each([
[0.0099, true],
[0.01, false],
])('sends 1%% of errors that did not crash the page: %s', (randomValue, isSent) => {
vi.spyOn(Math, 'random').mockReturnValue(randomValue)
const event = { tags: {}, exception: { values: [{ value: 'Application error' }] } }
expect(filterSentryEvent(event, enabled) === event).toBe(isSent)
})
it.each([true, 'true'])(
'sends every Studio empty-body diagnostic without sampling: %s',
(tag) => {
const random = vi.spyOn(Math, 'random').mockReturnValue(0.99)
const event = { tags: { empty_body_diagnostic: tag } }
expect(filterSentryEvent(event, enabled)).toBe(event)
expect(event.tags).toEqual({ empty_body_diagnostic: tag, codeSampleRate: '1' })
expect(random).not.toHaveBeenCalled()
}
)
it.each([false, 'false', null])(
'still samples events whose empty-body diagnostic tag is not set: %s',
(tag) => {
vi.spyOn(Math, 'random').mockReturnValue(0.99)
expect(filterSentryEvent({ tags: { empty_body_diagnostic: tag } }, enabled)).toBeNull()
}
)
it('drops empty-body diagnostics when reporting is turned off', () => {
const tags = { empty_body_diagnostic: 'true' }
expect(filterSentryEvent({ tags }, { isPlatform: true, hasConsent: false })).toBeNull()
})
it.each([undefined, false, 'false', null, 1])(
'drops errors from outside the app unless marked as a page crash: %s',
(tag) => {
expect(
filterSentryEvent({ tags: { third_party_code: true, globalErrorBoundary: tag } }, enabled)
).toBeNull()
}
)
it.each([
{ isPlatform: false, hasConsent: true },
{ isPlatform: true, hasConsent: false },
{ isPlatform: false, hasConsent: false },
])('drops all errors and page crashes when reporting is turned off: %j', (settings) => {
for (const tags of [undefined, { globalErrorBoundary: true, third_party_code: true }]) {
expect(filterSentryEvent({ tags }, settings)).toBeNull()
}
})
})