Fix/issue 1244 shared httpx client url mutation

src/functions/src/supabase_functions/_async/functions_client.py

@@ -53,9 +53,33 @@ def __init__(
         self.timeout = int(abs(timeout)) if timeout is not None else 60
 
         if http_client is not None:
-            http_client.base_url = self.url
-            http_client.headers.update({**self.headers})
-            self._client = http_client
+            # Create a new client with the same configuration as the provided client
+            # but with the service-specific base_url and headers.
+            # This prevents mutation of the shared httpx client instance.
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(self.headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            self._client = AsyncClient(
+                base_url=self.url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
         else:
             self._client = AsyncClient(
                 base_url=self.url,

src/functions/src/supabase_functions/_sync/functions_client.py

@@ -53,9 +53,33 @@ def __init__(
         self.timeout = int(abs(timeout)) if timeout is not None else 60
 
         if http_client is not None:
-            http_client.base_url = self.url
-            http_client.headers.update({**self.headers})
-            self._client = http_client
+            # Create a new client with the same configuration as the provided client
+            # but with the service-specific base_url and headers.
+            # This prevents mutation of the shared httpx client instance.
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(self.headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            self._client = Client(
+                base_url=self.url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
         else:
             self._client = Client(
                 base_url=self.url,

src/postgrest/src/postgrest/_async/client.py

@@ -85,9 +85,33 @@ def create_session(
             http_client = self.http_client
 
         if http_client is not None:
-            http_client.base_url = base_url
-            http_client.headers.update({**headers})
-            return http_client
+            # Create a new client with the same configuration as the provided client
+            # but with the service-specific base_url and headers.
+            # This prevents mutation of the shared httpx client instance.
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            return AsyncClient(
+                base_url=base_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
 
         return AsyncClient(
             base_url=base_url,

src/postgrest/src/postgrest/_sync/client.py

@@ -85,9 +85,33 @@ def create_session(
             http_client = self.http_client
 
         if http_client is not None:
-            http_client.base_url = base_url
-            http_client.headers.update({**headers})
-            return http_client
+            # Create a new client with the same configuration as the provided client
+            # but with the service-specific base_url and headers.
+            # This prevents mutation of the shared httpx client instance.
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            return Client(
+                base_url=base_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
 
         return Client(
             base_url=base_url,

src/storage/src/storage3/_async/client.py

@@ -75,9 +75,33 @@ def _create_session(
         http_client: Optional[AsyncClient] = None,
     ) -> AsyncClient:
         if http_client is not None:
-            http_client.base_url = base_url
-            http_client.headers.update({**headers})
-            return http_client
+            # Create a new client with the same configuration as the provided client
+            # but with the service-specific base_url and headers.
+            # This prevents mutation of the shared httpx client instance.
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            return AsyncClient(
+                base_url=base_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
 
         return AsyncClient(
             base_url=base_url,

src/storage/src/storage3/_sync/client.py

@@ -75,9 +75,33 @@ def _create_session(
         http_client: Optional[Client] = None,
     ) -> Client:
         if http_client is not None:
-            http_client.base_url = base_url
-            http_client.headers.update({**headers})
-            return http_client
+            # Create a new client with the same configuration as the provided client
+            # but with the service-specific base_url and headers.
+            # This prevents mutation of the shared httpx client instance.
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            return Client(
+                base_url=base_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
 
         return Client(
             base_url=base_url,

src/supabase/src/supabase/_async/client.py

@@ -242,9 +242,35 @@ def _init_storage_client(
         proxy: Optional[str] = None,
         http_client: Union[AsyncHttpxClient, None] = None,
     ) -> AsyncStorageClient:
+        """Private method for creating an instance of the Storage client."""
         if http_client is not None:
-            # If an http client is provided, use it
-            kwargs = {"http_client": http_client}
+            # Create a new client with same configuration but isolated from shared state
+            # This prevents mutation of the shared httpx client instance
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            isolated_client = AsyncHttpxClient(
+                base_url=storage_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
+            kwargs = {"http_client": isolated_client}
         else:
             kwargs = {
                 "timeout": storage_client_timeout,
@@ -291,8 +317,33 @@ def _init_postgrest_client(
     ) -> AsyncPostgrestClient:
         """Private helper for creating an instance of the Postgrest client."""
         if http_client is not None:
-            # If an http client is provided, use it
-            kwargs = {"http_client": http_client}
+            # Create a new client with same configuration but isolated from shared state
+            # This prevents mutation of the shared httpx client instance
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            isolated_client = AsyncHttpxClient(
+                base_url=rest_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
+            kwargs = {"http_client": isolated_client}
         else:
             kwargs = {
                 "timeout": timeout,

src/supabase/src/supabase/_sync/client.py

@@ -241,9 +241,35 @@ def _init_storage_client(
         proxy: Optional[str] = None,
         http_client: Union[SyncHttpxClient, None] = None,
     ) -> SyncStorageClient:
+        """Private method for creating an instance of the Storage client."""
         if http_client is not None:
-            # If an http client is provided, use it
-            kwargs = {"http_client": http_client}
+            # Create a new client with same configuration but isolated from shared state
+            # This prevents mutation of the shared httpx client instance
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            isolated_client = SyncHttpxClient(
+                base_url=storage_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
+            kwargs = {"http_client": isolated_client}
         else:
             kwargs = {
                 "timeout": storage_client_timeout,
@@ -290,8 +316,33 @@ def _init_postgrest_client(
     ) -> SyncPostgrestClient:
         """Private helper for creating an instance of the Postgrest client."""
         if http_client is not None:
-            # If an http client is provided, use it
-            kwargs = {"http_client": http_client}
+            # Create a new client with same configuration but isolated from shared state
+            # This prevents mutation of the shared httpx client instance
+            # Be careful about header merging to avoid duplication
+            merged_headers = {}
+
+            # Start with service-specific headers
+            merged_headers.update(headers)
+
+            # Add non-conflicting headers from the original client
+            for key, value in http_client.headers.items():
+                lower_key = key.lower()
+                # Skip headers that are service-specific or auth-related to avoid duplication
+                if lower_key not in ["authorization", "apikey", "x-client-info"]:
+                    # Only add if not already present
+                    if key not in merged_headers:
+                        merged_headers[key] = value
+
+            isolated_client = SyncHttpxClient(
+                base_url=rest_url,
+                headers=merged_headers,
+                timeout=http_client.timeout,
+                auth=http_client.auth,
+                params=http_client.params,
+                cookies=http_client.cookies,
+                follow_redirects=http_client.follow_redirects,
+            )
+            kwargs = {"http_client": isolated_client}
         else:
             kwargs = {
                 "timeout": timeout,