🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## File excerpt\n'
sed -n '600,660p' scripts/test-cross-tenant-staging.ts

printf '\n## Related helper\n'
sed -n '1,220p' scripts/set-site-administrator.ts

printf '\n## Supabase auth-admin type usage in repo\n'
rg -n "updateUserById\\(" -S .

printf '\n## Supabase client package version / types if present\n'
node - <<'NODE'
const fs = require('fs');
for (const p of ['package.json','package-lock.json','pnpm-lock.yaml','yarn.lock']) {
  if (fs.existsSync(p)) {
    console.log(`FOUND ${p}`);
    if (p === 'package.json') {
      const pkg = JSON.parse(fs.readFileSync(p,'utf8'));
      console.log('supabase-js dep:', pkg.dependencies?.['`@supabase/supabase-js`'] || pkg.devDependencies?.['`@supabase/supabase-js`'] || 'not found');
    }
    break;
  }
}
NODE

Repository: BigSimmo/Database

Length of output: 5512

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n## Relevant lines in scripts/test-cross-tenant-staging.ts\n'
nl -ba scripts/test-cross-tenant-staging.ts | sed -n '620,650p'

printf '\n## Relevant lines in scripts/set-site-administrator.ts\n'
nl -ba scripts/set-site-administrator.ts | sed -n '1,220p'

Repository: BigSimmo/Database

Length of output: 254

🌐 Web query:

Supabase auth.admin.updateUserById returns { data, error } app_metadata merge replace site_role administrator docs

💡 Result:

The supabase.auth.admin.updateUserById method employs shallow merge semantics when updating the app_metadata object [1]. When you provide a new app_metadata object, Supabase merges it with the existing metadata rather than replacing the entire object [1]. Specifically, the merge behavior functions as follows: - Existing keys not included in your update are preserved [1]. - Keys provided in the update overwrite their existing values [1]. - Keys explicitly set to null (or nil) in your update are removed from the object [1]. This means if you want to set a site_role, you can safely update just that field without clearing other existing data in app_metadata [1]. Example of updating the site_role to administrator: // Server-side (Edge Function or Node.js) const { data, error } = await supabase.auth.admin.updateUserById( 'user-uuid', { app_metadata: { site_role: 'administrator' } }); Important implementation notes: - Admin API Only: This method must be called from a secure, server-side context (e.g., Edge Functions, backend server) using the service_role key [2][3][4]. Never expose the service_role key in client-side code [4]. - Client Sync: Updates made via the admin API do not automatically notify or update the user's active session on the client-side [5]. To reflect these changes in the UI or trigger onAuthStateChange listeners, you must call supabase.auth.refreshSession on the client after the admin update is complete [2][5].

Citations:

• 1: https://deepwiki.com/supabase/auth/8.2-user-metadata
• 2: https://supabase.com/docs/reference/javascript/auth-admin-updateuserbyid
• 3: https://supabase.github.io/auth-js/v2/interfaces/AdminUserAttributes.html
• 4: https://supabase.com/docs/reference/python/auth-admin-updateuserbyid
• 5: Updating user_metadata from GoTrueAdminApi does not trigger the listener onAuthStateChange supabase/supabase-js#2103

🌐 Web query:

site:supabase.com auth-admin updateUserById app_metadata replace merge supabase-js

💡 Result:

When using the supabase-js library to update a user's app_metadata via updateUserById, the operation performs a merge by default, not a full replacement [1][2]. In Supabase, app_metadata is stored as a JSONB column [2]. When you provide a partial object to the app_metadata field in an update call, the new values are merged into the existing JSON object [1][3]. For example, if you call the update with { app_metadata: { plan: 'trial' } }, and the user already has { role: 'admin' }, the resulting app_metadata will contain both fields: { plan: 'trial', role: 'admin' }. To effectively "replace" the existing metadata with a new set of values, you must retrieve the current user's metadata first, construct the desired final object, and then perform the update with the complete object. Note that updateUserById must be called from a secure, server-side environment (such as an Edge Function or backend server) using your project's service_role key, as it provides administrative privileges that should never be exposed in client-side code [1][3].

Citations:

• 1: https://supabase.com/docs/reference/javascript/auth-admin-updateuserbyid
• 2: https://supabase.com/docs/guides/platform/migrating-to-supabase/auth0
• 3: https://supabase.com/docs/reference/python/auth-admin-updateuserbyid