Support multiple supabase backends

[alexcouper]

Context

I am using 2 separate supabase backends for different parts of an application. This provides a clear separation of data ownership and makes auditing access trivial. Each system has it's own auth providers - the user may have different email/passwords in each system - and the application is responsible for maintaining sessions with both backends, using the correct backend for different pieces of data.

Supabase mostly supports this, except for in the way that tokens are delivered and validated by the GoTrue client.

Tokens

During a login, supabase returns a token in the form access_token=XXX;expires_in:Y;refresh_token:Z;token_type:bearer.
This is stored by default in session storage under a key like sb-<unique-subase-id>-auth-token.
Having multiple supabase clients is possible, as each looks for its own session storage token and works correctly.

However, when logging in to supabase backend B, supabase backend A removes its token from storage.

I believe this is due to both backends actively detecting that _isImplicitGrantFlow() is true, and then because A doesn't recognise B's token, the code in _initialize() deletes the session for A (even though this token was really for B):

      if (this.detectSessionInUrl && this._isImplicitGrantFlow()) {
        const { data, error } = await this._getSessionFromUrl()

        if (error) {
          // failed login attempt via url,
          // remove old session as in verifyOtp, signUp and signInWith*
          await this._removeSession()

          return { error }
        }

Here's the logic for isImplicitGrantFlow():

private _isImplicitGrantFlow(): boolean {
    return (
      isBrowser() &&
      (Boolean(getParameterByName('access_token')) ||
        Boolean(getParameterByName('error_description')))
    )
  }

Is there a way that we could customize the parameters used in the grant flow such that each client would be able to know if it's relevant for it?

[alexcouper]

The workaround for this at the moment is to use the detectSessionInUrl: false flag for both and handle manually through try/except on auth.setSession for both.