Files
supabase/apps
Andrew Valleteau da3b0cb3ec fix(cli): login creating duplicate tokens on re-renders (#46120)
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

The CLI login page was firing `POST /platform/cli/login` multiple times
per page load due to an unstable `navigate` reference in the parent
component re-triggering the effect. This caused several duplicate
personal access tokens to be created for each browser sign-in attempt
(regression CLI-1491).

Additionally, error messages from non-Error rejection shapes (like those
from openapi-fetch) were being replaced with a generic "Unknown error"
message instead of surfacing the actual platform error.

## What is the new behavior?

1. **Prevents duplicate API calls**: Added a `useRef` guard
(`startedForSessionIdRef`) to ensure `createCliLoginSession` is only
called once per `sessionId`, even if the parent component re-renders
with a new `navigate` reference.

2. **Improved error handling**: Created a `getErrorMessage()` utility
that properly extracts error messages from both Error instances and
plain objects (e.g., `{ message: string, statusCode: number }`),
allowing platform error messages to surface instead of generic
fallbacks.

3. **Added comprehensive test coverage**:
- E2E test verifying the POST fires exactly once per page load with
realistic network latency
   - E2E test confirming platform error messages are displayed correctly
   - Unit test for non-Error rejection shapes
- Unit test verifying the effect doesn't re-trigger on parent re-renders

## Additional context

The fix addresses the root cause by:
- Using a ref to track which `sessionId` has already been processed,
preventing re-execution when deps change
- Extracting error message handling into a reusable utility that handles
both Error instances and plain objects
- Adding tests that specifically check for the regression (multiple POST
calls and error message display)

The E2E test includes a 400ms delay in the mock response to simulate
real-world conditions where the original bug only surfaced after React
committed multiple re-renders.

Closes: CLI-1491

https://claude.ai/code/session_01GAujw33MTRBRYSnS8cxcEa

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved CLI login error handling to display platform-specific error
messages instead of generic fallback text.
  * Fixed duplicate login session creation during component rerenders.

* **Tests**
  * Added test coverage for error message display in CLI login.
* Added regression tests for single session creation and platform error
scenarios.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46120?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-20 09:17:22 +02:00
..