fix(storage): do not rewrite signed URL to render endpoint for empty transform object

[mandarini]

Passing { transform: {} } to createSignedUrl incorrectly rewrote the returned URL from /object/sign/ to /render/image/sign/, causing a 422 on non-image files. The server already treats an empty transform object as "no transformation" and returns /object/sign/. The client-side normalization (added to handle older storage-api versions) was triggering on {} because it is truthy in JavaScript. Fixed by checking that the transform object has at least one key before treating it as a transform request.

Fixes: #2159

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 4161dfb5-6e74-47ba-9e9c-5ede39887ff1

📥 Commits

Reviewing files that changed from the base of the PR and between 3c5b6e3 and 259cd2b.

📒 Files selected for processing (1)

• packages/core/storage-js/test/storageFileApi.test.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Signed URL generation now includes image transform parameters only when an actual transform object is provided.
  • URL normalization for signed URLs uses the render path only when a transform is present, preventing incorrect render endpoints.

• Tests

  • Added a test to ensure empty transform objects do not trigger image render behavior.

Walkthrough

This pull request adds a hasTransform check to createSignedUrl so an empty transform object (e.g., {}) is treated as no transform. The change conditions sending transform in the POST payload and selecting the returned signed URL path on the presence of an actual transform object, preventing empty transforms from switching the endpoint to the render/image path.

Sequence Diagram(s)

(omitted)

Assessment against linked issues

Objective	Addressed	Explanation
Prevent empty transform objects from being treated as actual transforms [#2159]	✅
Restore original URL path behavior when transform object is empty [#2159]	✅
Only include transform in the payload when the transform object has actual properties [#2159]	✅

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2162

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2162

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2162

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2162

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2162

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2162

commit: afe3c61