test(auth): use supabase cli where possible - docker for extra tests

.github/workflows/ci-core.yml

@@ -61,17 +61,17 @@ jobs:
           flag-name: realtime-js
           fail-on-error: false
         continue-on-error: true
-      - name: Run auth-js tests (if affected)
+
+      - name: Run auth-js tests with Supabase CLI (if affected)
         run: npx nx affected --target=test:auth
+        timeout-minutes: 10
 
-      - name: Upload coverage for auth-js (if affected)
-        uses: coverallsapp/github-action@v2
+      - name: Upload auth-js CLI coverage artifact
+        uses: actions/upload-artifact@v4
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          path-to-lcov: ./packages/core/auth-js/test/coverage/lcov.info
-          parallel: true
-          flag-name: auth-js
-          fail-on-error: false
+          name: auth-js-coverage
+          path: packages/core/auth-js/coverage/lcov.info
+          if-no-files-found: ignore
         continue-on-error: true
 
       - name: Setup Supabase CLI (for storage-js tests)
@@ -91,6 +91,76 @@ jobs:
           flag-name: storage-js
           fail-on-error: false
         continue-on-error: true
+
+  # Separate job for auth-js Docker tests (full coverage including edge cases)
+  test-auth-js-docker:
+    name: Test auth-js (Docker - Full Coverage)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          filter: tree:0
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci
+      - uses: nrwl/nx-set-shas@v4
+
+      - name: Run auth-js Docker tests (if affected)
+        run: npx nx affected --target=test:docker --projects=@supabase/auth-js
+        timeout-minutes: 10
+
+      - name: Upload auth-js Docker coverage artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: auth-js-docker-coverage
+          path: packages/core/auth-js/coverage-docker/lcov.info
+          if-no-files-found: ignore
+        continue-on-error: true
+
+  # Merge auth-js coverage reports from both test suites
+  merge-auth-js-coverage:
+    name: Merge auth-js coverage
+    runs-on: ubuntu-latest
+    needs: [setup-build-test-node-20, test-auth-js-docker]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Download CLI coverage artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: auth-js-coverage
+          path: packages/core/auth-js/coverage
+        continue-on-error: true
+
+      - name: Download Docker coverage artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: auth-js-docker-coverage
+          path: packages/core/auth-js/coverage-docker
+        continue-on-error: true
+
+      - name: Merge coverage reports
+        run: node packages/core/auth-js/merge-coverage.js
+        continue-on-error: true
+
+      - name: Upload merged coverage to Coveralls
+        uses: coverallsapp/github-action@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path-to-lcov: ./packages/core/auth-js/coverage-merged/lcov.info
+          parallel: true
+          flag-name: auth-js
+          fail-on-error: false
+        continue-on-error: true
+
   # Separate job for postgrest-js tests (Docker-based, retriable)
   test-postgrest-js:
     name: Test postgrest-js
@@ -200,6 +270,8 @@ jobs:
     needs:
       [
         setup-build-test-node-20,
+        test-auth-js-docker,
+        merge-auth-js-coverage,
         test-postgrest-js,
         check-postgrest-generated-types,
         test-postgrest-js-v12,

.gitignore

@@ -29,6 +29,8 @@ deno.lock
 # Coverage directories (anywhere in tree)
 coverage/
 coverage
+coverage-docker/
+coverage-merged/
 .nyc_output
 *.lcov
 lib-cov
@@ -100,5 +102,5 @@ vite.config.*.timestamp*
 vitest.config.*.timestamp*
 test-output
 
-supabase/.branches
-supabase/.temp
+supabase/.branches/*
+supabase/.temp/*

nx.json

@@ -15,6 +15,8 @@
       "!{projectRoot}/**/*.md",
       "!{projectRoot}/docs/**/*",
       "!{projectRoot}/coverage/**/*",
+      "!{projectRoot}/coverage-docker/**/*",
+      "!{projectRoot}/coverage-merged/**/*",
       "sharedGlobals",
       "!{projectRoot}/.eslintrc.json",
       "!{projectRoot}/eslint.config.mjs",
@@ -122,6 +124,11 @@
       "cache": true,
       "outputs": ["{projectRoot}/coverage"]
     },
+    "test:auth": {
+      "inputs": ["testing", "^production"],
+      "cache": true,
+      "outputs": ["{projectRoot}/coverage"]
+    },
     "test:storage": {
       "cache": false
     },
@@ -139,6 +146,39 @@
     "test:clean-post": {
       "cache": false
     },
+    "test:docker": {
+      "inputs": ["testing", "^production"],
+      "cache": false,
+      "outputs": ["{projectRoot}/coverage-docker"]
+    },
+    "test:docker:clean-pre": {
+      "cache": false
+    },
+    "test:docker:infra": {
+      "cache": false
+    },
+    "test:docker:suite": {
+      "inputs": ["testing", "^production"],
+      "cache": false,
+      "outputs": ["{projectRoot}/coverage-docker"]
+    },
+    "test:docker:clean-post": {
+      "cache": false
+    },
+    "test:merge-coverage": {
+      "inputs": ["testing", "^production"],
+      "cache": true,
+      "outputs": ["{projectRoot}/coverage-merged"]
+    },
+    "test:all": {
+      "inputs": ["testing", "^production"],
+      "cache": false,
+      "outputs": [
+        "{projectRoot}/coverage",
+        "{projectRoot}/coverage-docker",
+        "{projectRoot}/coverage-merged"
+      ]
+    },
     "vite:test": {
       "inputs": ["testing", "^production"],
       "cache": true,

packages/core/auth-js/README.md

@@ -104,60 +104,112 @@ npx nx docs auth-js          # Generate documentation
 
 ### Testing
 
-**Docker Required!** The auth-js tests require a local Supabase Auth server (GoTrue) running in Docker.
+The auth-js package has two test suites:
+
+1. **CLI Tests** - Main test suite using Supabase CLI (331 tests)
+2. **Docker Tests** - Edge case tests requiring specific GoTrue configurations (11 tests)
+
+#### Prerequisites
+
+- **Supabase CLI** - Required for main test suite ([installation guide](https://supabase.com/docs/guides/cli))
+- **Docker** - Required for edge case tests
+
+#### Running Tests
 
 ```bash
-# Run complete test suite (from monorepo root)
+# Run main test suite with Supabase CLI (recommended)
 npx nx test:auth auth-js
+
+# Run Docker-only edge case tests
+npx nx test:docker auth-js
+
+# Run both test suites
+npx nx test:auth auth-js && npx nx test:docker auth-js
 ```
 
-This command automatically:
+#### Main Test Suite (Supabase CLI)
 
-1. Stops any existing test containers
-2. Starts a Supabase Auth server (GoTrue) and PostgreSQL database in Docker
-3. Waits for services to be ready (30 seconds)
-4. Runs the test suite
-5. Cleans up Docker containers after tests complete
+The `test:auth` command automatically:
 
-#### Individual Test Commands
+1. Stops any existing Supabase instance
+2. Starts a local Supabase instance via CLI
+3. Runs the test suite (excludes `docker-tests/` folder)
+4. Cleans up after tests complete
 
 ```bash
-# Run just the test suite (requires infrastructure to be running)
-npx nx test:suite auth-js
+# Individual commands for manual control
+npx nx test:infra auth-js    # Start Supabase CLI
+npx nx test:suite auth-js    # Run tests only
+npx nx test:clean-post auth-js  # Stop Supabase CLI
+```
+
+#### Docker Tests (Edge Cases)
+
+The `test:docker` target runs tests that require specific GoTrue configurations not possible with a single Supabase CLI instance:
+
+- **Signup disabled** - Tests for disabled signup functionality
+- **Asymmetric JWT (RS256)** - Tests for RS256 JWT verification
+- **Phone OTP / SMS** - Tests requiring Twilio SMS provider
+- **Anonymous sign-in disabled** - Tests for disabled anonymous auth
 
-# Manually manage test infrastructure
-npx nx test:infra auth-js   # Start Docker containers
-npx nx test:clean auth-js   # Stop and remove containers
+These tests are located in `test/docker-tests/` and use the Docker Compose setup in `infra/docker-compose.yml`.
+
+```bash
+# Individual commands for manual control
+npx nx test:docker:infra auth-js    # Start Docker containers
+npx nx test:docker:suite auth-js    # Run Docker tests only
+npx nx test:docker:clean-post auth-js  # Stop Docker containers
 ```
 
 #### Development Testing
 
 For actively developing and debugging tests:
 
 ```bash
-# Start infrastructure once
+# Start Supabase CLI once
 npx nx test:infra auth-js
 
-# Run tests multiple times (faster since containers stay up)
+# Run tests multiple times (faster since instance stays up)
 npx nx test:suite auth-js
 
 # Clean up when done
-npx nx test:clean auth-js
+npx nx test:clean-post auth-js
 ```
 
 #### Test Infrastructure
 
-The Docker setup includes:
+| Suite        | Infrastructure | Configuration               |
+| ------------ | -------------- | --------------------------- |
+| CLI Tests    | Supabase CLI   | `test/supabase/config.toml` |
+| Docker Tests | Docker Compose | `infra/docker-compose.yml`  |
 
-- **Supabase Auth (GoTrue)** - The authentication server
-- **PostgreSQL** - Database for auth data
-- Pre-configured with test users and settings
+#### Coverage Reports
 
-#### Prerequisites
+The auth-js package uses **two complementary test suites** that are merged into a single coverage report:
+
+**1. CLI Tests (331 tests)**
+
+- Tests core authentication functionality via Supabase CLI
+- Covers email/password auth, OAuth providers, session management, MFA, SSO, and more
+- Represents features used by 90% of applications
+
+**2. Docker Tests (11 tests)**
+
+- Tests edge cases requiring custom GoTrue configurations
+- Covers signup-disabled, anonymous-disabled, asymmetric JWT (RS256), and phone/SMS flows
+- Complements CLI tests with scenarios requiring specific server settings
+
+**Coverage Strategy**: Both test suites collect coverage data that is automatically merged to provide a comprehensive view of total code coverage. You can generate the merged coverage report locally:
+
+```bash
+# Run both test suites and merge coverage
+npx nx test:all auth-js
+
+# Or merge existing coverage reports
+npx nx test:merge-coverage auth-js
+```
 
-- **Docker** must be installed and running
-- Ports used by test infrastructure (check `infra/docker-compose.yml`)
-- No full Supabase instance needed - just the Auth server
+The merged coverage report is located at `coverage-merged/lcov.info`.
 
 ### Contributing
 

packages/core/auth-js/jest.config.js

@@ -7,7 +7,7 @@ module.exports = {
     '^.+\\.tsx?$': ['ts-jest', { tsconfig: '<rootDir>/tsconfig.test.json' }],
   },
   collectCoverage: true,
-  coverageDirectory: 'test/coverage',
+  coverageDirectory: './coverage',
   coverageReporters: ['json', 'html', 'lcov'],
   collectCoverageFrom: [
     'src/**/*.{js,ts}',

packages/core/auth-js/merge-coverage.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+
+/**
+ * Merges coverage reports from CLI tests and Docker tests into a single report.
+ *
+ * This script combines the lcov.info files from both test suites:
+ * - coverage/lcov.info (CLI tests: core functionality)
+ * - coverage-docker/lcov.info (Docker tests: edge cases)
+ *
+ * Output: coverage-merged/lcov.info
+ */
+
+const fs = require('fs')
+const path = require('path')
+
+const coverageDir = path.join(__dirname, 'coverage')
+const coverageDockerDir = path.join(__dirname, 'coverage-docker')
+const coverageMergedDir = path.join(__dirname, 'coverage-merged')
+
+const lcovFile = path.join(coverageDir, 'lcov.info')
+const lcovDockerFile = path.join(coverageDockerDir, 'lcov.info')
+const lcovMergedFile = path.join(coverageMergedDir, 'lcov.info')
+
+try {
+  // Check if both coverage files exist
+  if (!fs.existsSync(lcovFile)) {
+    console.error(`Error: ${lcovFile} not found. Run 'nx test:auth auth-js' first.`)
+    process.exit(1)
+  }
+
+  if (!fs.existsSync(lcovDockerFile)) {
+    console.error(`Error: ${lcovDockerFile} not found. Run 'nx test:docker auth-js' first.`)
+    process.exit(1)
+  }
+
+  // Create merged directory
+  if (!fs.existsSync(coverageMergedDir)) {
+    fs.mkdirSync(coverageMergedDir, { recursive: true })
+  }
+
+  // Read both lcov files
+  console.log('Reading coverage files...')
+  const lcovContent = fs.readFileSync(lcovFile, 'utf8')
+  const lcovDockerContent = fs.readFileSync(lcovDockerFile, 'utf8')
+
+  // Merge by concatenation (Coveralls handles deduplication)
+  console.log('Merging coverage reports...')
+  const mergedContent = lcovContent + '\n' + lcovDockerContent
+
+  // Write merged file
+  fs.writeFileSync(lcovMergedFile, mergedContent)
+
+  console.log(`✓ Coverage reports merged successfully!`)
+  console.log(`  Output: ${lcovMergedFile}`)
+  console.log(`  CLI coverage: ${lcovFile}`)
+  console.log(`  Docker coverage: ${lcovDockerFile}`)
+} catch (error) {
+  console.error('Error merging coverage reports:', error.message)
+  process.exit(1)
+}