From 01a10c9708f6a9d4d2d2b0756009aa895c7238f6 Mon Sep 17 00:00:00 2001
From: Vinzent <vinzent03@proton.me>
Date: Wed, 3 Apr 2024 10:18:05 +0200
Subject: [PATCH] fix: Don't send access token  in rest broadcast (#881)

* fix: don't send access token in rest broadcast

* test: add apikey header
---
 packages/realtime_client/lib/src/realtime_channel.dart | 6 +-----
 packages/realtime_client/test/channel_test.dart        | 1 +
 packages/supabase/lib/src/supabase_client.dart         | 2 +-
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/packages/realtime_client/lib/src/realtime_channel.dart b/packages/realtime_client/lib/src/realtime_channel.dart
index ed2019aa..a82774bd 100644
--- a/packages/realtime_client/lib/src/realtime_channel.dart
+++ b/packages/realtime_client/lib/src/realtime_channel.dart
@@ -483,11 +483,7 @@ class RealtimeChannel {
     }
 
     if (!canPush && type == RealtimeListenTypes.broadcast) {
-      final headers = {
-        'Content-Type': 'application/json',
-        'apikey': socket.accessToken ?? '',
-        ...socket.headers
-      };
+      final headers = {'Content-Type': 'application/json', ...socket.headers};
       final body = {
         'messages': [
           {
diff --git a/packages/realtime_client/test/channel_test.dart b/packages/realtime_client/test/channel_test.dart
index 32ce5519..080f428f 100644
--- a/packages/realtime_client/test/channel_test.dart
+++ b/packages/realtime_client/test/channel_test.dart
@@ -248,6 +248,7 @@ void main() {
       mockServer = await HttpServer.bind('localhost', 0);
       socket = RealtimeClient(
         'ws://${mockServer.address.host}:${mockServer.port}/realtime/v1',
+        headers: {'apikey': 'supabaseKey'},
         params: {'apikey': 'supabaseKey'},
       );
 
diff --git a/packages/supabase/lib/src/supabase_client.dart b/packages/supabase/lib/src/supabase_client.dart
index 7b4b9500..141f854e 100644
--- a/packages/supabase/lib/src/supabase_client.dart
+++ b/packages/supabase/lib/src/supabase_client.dart
@@ -260,7 +260,7 @@ class SupabaseClient {
       params: {
         'apikey': _supabaseKey,
       },
-      headers: headers,
+      headers: {'apikey': _supabaseKey, ...headers},
       logLevel: options.logLevel,
       httpClient: _authHttpClient,
     );