test(auth): split test infra for docker and cli

Author: mandarini

.github/workflows/ci-core.yml

@@ -61,24 +61,26 @@ jobs:
           flag-name: realtime-js
           fail-on-error: false
         continue-on-error: true
-      - name: Run auth-js tests (if affected)
+
+      - name: Setup Supabase CLI (for auth-js and storage-js tests)
+        uses: supabase/setup-cli@v1
+        with:
+          version: latest
+
+      - name: Run auth-js tests with Supabase CLI (if affected)
         run: npx nx affected --target=test:auth
+        timeout-minutes: 10
 
       - name: Upload coverage for auth-js (if affected)
         uses: coverallsapp/github-action@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          path-to-lcov: ./packages/core/auth-js/test/coverage/lcov.info
+          path-to-lcov: ./packages/core/auth-js/coverage/lcov.info
           parallel: true
           flag-name: auth-js
           fail-on-error: false
         continue-on-error: true
 
-      - name: Setup Supabase CLI (for storage-js tests)
-        uses: supabase/setup-cli@v1
-        with:
-          version: latest
-
       - name: Run storage-js tests (if affected)
         run: npx nx affected --target=test:storage
 
@@ -91,6 +93,28 @@ jobs:
           flag-name: storage-js
           fail-on-error: false
         continue-on-error: true
+
+  # Separate job for auth-js Docker tests (full coverage including edge cases)
+  test-auth-js-docker:
+    name: Test auth-js (Docker - Full Coverage)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          filter: tree:0
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci
+      - uses: nrwl/nx-set-shas@v4
+
+      - name: Run auth-js Docker tests (if affected)
+        run: npx nx affected --target=test:docker --projects=@supabase/auth-js
+        timeout-minutes: 10
+
   # Separate job for postgrest-js tests (Docker-based, retriable)
   test-postgrest-js:
     name: Test postgrest-js
@@ -200,6 +224,7 @@ jobs:
     needs:
       [
         setup-build-test-node-20,
+        test-auth-js-docker,
         test-postgrest-js,
         check-postgrest-generated-types,
         test-postgrest-js-v12,

nx.json

@@ -122,6 +122,11 @@
       "cache": true,
       "outputs": ["{projectRoot}/coverage"]
     },
+    "test:auth": {
+      "inputs": ["testing", "^production"],
+      "cache": true,
+      "outputs": ["{projectRoot}/coverage"]
+    },
     "test:storage": {
       "cache": false
     },
@@ -139,6 +144,25 @@
     "test:clean-post": {
       "cache": false
     },
+    "test:docker": {
+      "inputs": ["testing", "^production"],
+      "cache": false,
+      "outputs": []
+    },
+    "test:docker:clean-pre": {
+      "cache": false
+    },
+    "test:docker:infra": {
+      "cache": false
+    },
+    "test:docker:suite": {
+      "inputs": ["testing", "^production"],
+      "cache": false,
+      "outputs": []
+    },
+    "test:docker:clean-post": {
+      "cache": false
+    },
     "vite:test": {
       "inputs": ["testing", "^production"],
       "cache": true,

packages/core/auth-js/README.md

@@ -104,60 +104,84 @@ npx nx docs auth-js          # Generate documentation
 
 ### Testing
 
-**Docker Required!** The auth-js tests require a local Supabase Auth server (GoTrue) running in Docker.
+The auth-js package has two test suites:
+
+1. **CLI Tests** - Main test suite using Supabase CLI (331 tests)
+2. **Docker Tests** - Edge case tests requiring specific GoTrue configurations (11 tests)
+
+#### Prerequisites
+
+- **Supabase CLI** - Required for main test suite ([installation guide](https://supabase.com/docs/guides/cli))
+- **Docker** - Required for edge case tests
+
+#### Running Tests
 
 ```bash
-# Run complete test suite (from monorepo root)
+# Run main test suite with Supabase CLI (recommended)
 npx nx test:auth auth-js
+
+# Run Docker-only edge case tests
+npx nx test:docker auth-js
+
+# Run both test suites
+npx nx test:auth auth-js && npx nx test:docker auth-js
 ```
 
-This command automatically:
+#### Main Test Suite (Supabase CLI)
 
-1. Stops any existing test containers
-2. Starts a Supabase Auth server (GoTrue) and PostgreSQL database in Docker
-3. Waits for services to be ready (30 seconds)
-4. Runs the test suite
-5. Cleans up Docker containers after tests complete
+The `test:auth` command automatically:
 
-#### Individual Test Commands
+1. Stops any existing Supabase instance
+2. Starts a local Supabase instance via CLI
+3. Runs the test suite (excludes `docker-tests/` folder)
+4. Cleans up after tests complete
 
 ```bash
-# Run just the test suite (requires infrastructure to be running)
-npx nx test:suite auth-js
+# Individual commands for manual control
+npx nx test:infra auth-js    # Start Supabase CLI
+npx nx test:suite auth-js    # Run tests only
+npx nx test:clean-post auth-js  # Stop Supabase CLI
+```
 
-# Manually manage test infrastructure
-npx nx test:infra auth-js   # Start Docker containers
-npx nx test:clean auth-js   # Stop and remove containers
+#### Docker Tests (Edge Cases)
+
+The `test:docker` target runs tests that require specific GoTrue configurations not possible with a single Supabase CLI instance:
+
+- **Signup disabled** - Tests for disabled signup functionality
+- **Asymmetric JWT (RS256)** - Tests for RS256 JWT verification
+- **Phone OTP / SMS** - Tests requiring Twilio SMS provider
+- **Anonymous sign-in disabled** - Tests for disabled anonymous auth
+
+These tests are located in `test/docker-tests/` and use the Docker Compose setup in `infra/docker-compose.yml`.
+
+```bash
+# Individual commands for manual control
+npx nx test:docker:infra auth-js    # Start Docker containers
+npx nx test:docker:suite auth-js    # Run Docker tests only
+npx nx test:docker:clean-post auth-js  # Stop Docker containers
 ```
 
 #### Development Testing
 
 For actively developing and debugging tests:
 
 ```bash
-# Start infrastructure once
+# Start Supabase CLI once
 npx nx test:infra auth-js
 
-# Run tests multiple times (faster since containers stay up)
+# Run tests multiple times (faster since instance stays up)
 npx nx test:suite auth-js
 
 # Clean up when done
-npx nx test:clean auth-js
+npx nx test:clean-post auth-js
 ```
 
 #### Test Infrastructure
 
-The Docker setup includes:
-
-- **Supabase Auth (GoTrue)** - The authentication server
-- **PostgreSQL** - Database for auth data
-- Pre-configured with test users and settings
-
-#### Prerequisites
-
-- **Docker** must be installed and running
-- Ports used by test infrastructure (check `infra/docker-compose.yml`)
-- No full Supabase instance needed - just the Auth server
+| Suite        | Infrastructure | Configuration               |
+| ------------ | -------------- | --------------------------- |
+| CLI Tests    | Supabase CLI   | `test/supabase/config.toml` |
+| Docker Tests | Docker Compose | `infra/docker-compose.yml`  |
 
 ### Contributing
 

packages/core/auth-js/jest.config.js

@@ -7,7 +7,7 @@ module.exports = {
     '^.+\\.tsx?$': ['ts-jest', { tsconfig: '<rootDir>/tsconfig.test.json' }],
   },
   collectCoverage: true,
-  coverageDirectory: 'test/coverage',
+  coverageDirectory: './coverage',
   coverageReporters: ['json', 'html', 'lcov'],
   collectCoverageFrom: [
     'src/**/*.{js,ts}',

packages/core/auth-js/package.json

@@ -29,10 +29,6 @@
     "build": "npm run build:main && npm run build:module",
     "build:main": "tsc -p tsconfig.json",
     "build:module": "tsc -p tsconfig.module.json",
-    "test:auth": "npm run test:clean && npm run test:infra && npm run test:suite && npm run test:clean",
-    "test:suite": "jest --runInBand --coverage",
-    "test:infra": "cd infra && docker compose down && docker compose pull && docker compose up -d && sleep 30",
-    "test:clean": "cd infra && docker compose down",
     "docs": "typedoc src/index.ts --out docs/v2 --excludePrivate --excludeProtected",
     "docs:json": "typedoc --json docs/v2/spec.json --excludeExternals --excludePrivate --excludeProtected src/index.ts"
   },

packages/core/auth-js/project.json

@@ -0,0 +1,95 @@
+{
+  "name": "@supabase/auth-js",
+  "targets": {
+    "test:clean-pre": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "supabase stop --no-backup || true",
+        "cwd": "{projectRoot}/test/supabase"
+      }
+    },
+    "test:infra": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "supabase start",
+        "cwd": "{projectRoot}/test/supabase"
+      },
+      "dependsOn": ["test:clean-pre"]
+    },
+    "test:suite": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "jest --runInBand --coverage --testPathIgnorePatterns=docker-tests",
+        "cwd": "{projectRoot}"
+      },
+      "outputs": ["{projectRoot}/coverage"],
+      "dependsOn": ["test:infra"]
+    },
+    "test:clean-post": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "supabase stop --no-backup || true",
+        "cwd": "{projectRoot}/test/supabase"
+      },
+      "dependsOn": ["test:suite"]
+    },
+    "test:auth": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "echo 'Auth-js CLI tests complete'",
+        "cwd": "{projectRoot}"
+      },
+      "dependsOn": ["test:clean-post"],
+      "metadata": {
+        "description": "Run auth-js tests with Supabase CLI (excludes docker-tests folder)"
+      }
+    },
+    "test:docker:clean-pre": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "docker compose -f infra/docker-compose.yml down || true",
+        "cwd": "{projectRoot}"
+      }
+    },
+    "test:docker:infra": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": [
+          "docker compose -f infra/docker-compose.yml pull",
+          "docker compose -f infra/docker-compose.yml up -d",
+          "sleep 30"
+        ],
+        "cwd": "{projectRoot}",
+        "parallel": false
+      },
+      "dependsOn": ["test:docker:clean-pre"]
+    },
+    "test:docker:suite": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "jest --runInBand --testPathPattern=docker-tests",
+        "cwd": "{projectRoot}"
+      },
+      "dependsOn": ["test:docker:infra"]
+    },
+    "test:docker:clean-post": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "docker compose -f infra/docker-compose.yml down",
+        "cwd": "{projectRoot}"
+      },
+      "dependsOn": ["test:docker:suite"]
+    },
+    "test:docker": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "echo 'Auth-js Docker tests complete'",
+        "cwd": "{projectRoot}"
+      },
+      "dependsOn": ["test:docker:clean-post"],
+      "metadata": {
+        "description": "Run Docker-only tests (signup-disabled, asymmetric-jwt, phone-otp, anonymous-disabled)"
+      }
+    }
+  }
+}