`auth.admin.listUsers()` only lists up to 50 users

[skoshx]

Bug report

Describe the bug

When using auth.admin.listUsers(), it only returns 50 users, even though in the auth.users there are over 70+ users. This caused a massive fire couple days ago on our production site, when paying customers were faced with errors, since our backend relied on listUsers to find them by their email.

To Reproduce

Here is the code snippet we use to find users by their email:

async function getUserByEmail(email: string) {
	const { data: { users } } = await getSupabaseServiceRole().auth.admin.listUsers();
        // users.length === 50 here, even though there are over 70+ registered users, as can be seen in the supabase dashboard.
	if (!users) return undefined;
	return users.filter((user) => user.email === email)?.[0];
}

Expected behavior

listUsers() is expected to return all registered users, as the documentation says.

System information

• OS: macOS
• Browser (if applies) [e.g. chrome, safari]
• Version of supabase-js: 2.1.0
• Version of Node.js: v16.14.2

[j4crev]

@skoshx , listUsers() doesn't currently support passing in options to control this.

Instead, you can query the endpoint directly and use the url param per_page to get all of your records. It also supports page.

const res = await fetch(`${PUBLIC_SUPABASE_URL}/auth/v1/admin/users?per_page=1000`, {
  method: 'GET',
  headers: { Authorization: `Bearer ${SERVICE_ROLE_KEY}`, apikey: PUBLIC_SUPABASE_ANON_KEY }
})
const data = await res.json()
console.log(data.users.length) // 75

[j4crev]

@soedirgo would you mind moving this issue to gotrue-js, if you believe it's warranted? I have a PR on standby, which will allow some options to this method.

[j4crev]

As another workaround, people are using an rpc call.

https://discord.com/channels/839993398554656828/1041554126175215656

https://supabase.com/docs/reference/javascript/rpc