Edge function JWT verification errors return { msg } instead of { error } in serve.main.ts

[shkuls]

Affected area

Edge Functions

Supabase CLI version

Verified against develop (the JWT-verification code path in apps/cli/src/shared/functions/serve.main.ts hasn't changed recently, so this likely affects the latest published release too).

Operating system

N/A — source-level bug in the edge-runtime bootstrap template, reproducible on any OS running supabase functions serve / supabase start.

Command

supabase start
supabase functions serve   # or the equivalent local dev worker started by `supabase start`
curl -X POST http://127.0.0.1:<port>/<function-with-verify_jwt-true>

Actual output

{"msg":"Invalid JWT"}

Expected behavior

{"error":"Invalid JWT"}

matching the shape the platform edge-runtime gateway returns, and the shape already used elsewhere in the same file (serve.main.ts) for worker boot/crash errors ({ code, message }).

Steps to reproduce

1. supabase start
2. Deploy or serve a function with verify_jwt = true.
3. Send a request with no Authorization header, or an invalid/wrongly-signed JWT.
4. Observe the response body uses {"msg": "..."} instead of {"error": "..."}.

This means any consumer that reads the error key (matching the platform gateway's shape) never sees the real failure reason on supabase start — it silently falls through to a generic fallback message instead. This is exactly what happened in Supabase Studio's edge function test panel: see supabase/supabase#47835 for the full repro and root-cause writeup, and supabase/supabase#47836 for the Studio-side fix.

Additional context

@aantti requested fixing this at the source (this worker) rather than only patching Studio's error parsing — see the discussion on supabase/supabase#47836.

A fix is ready: two msg → error occurrences in apps/cli/src/shared/functions/serve.main.ts, plus the legacy Go CLI's bundled copy of the same template regenerated via the repo's own pnpm generate:go-serve-template script (kept in sync via the drift-guard test in serve-main-go-template.unit.test.ts), plus a new e2e test (serve-main-jwt-error-shape.e2e.test.ts) that boots the real bundled worker under edge-runtime and asserts on the response shape for both JWT-failure paths. Full functions/ test suite passes (6 files, 20 tests). Happy to open the PR once this issue is triaged and labeled open-for-contribution, per CONTRIBUTING.md.

[7ttp]

hey @shkuls thanks for reporting!
taking this up on the cli side :)

[shkuls]

Hey @7ttp , I have a draft PR ready, would be great if you can take a look and if this aligns with your idea.

[7ttp]

Hey @7ttp , I have a draft PR ready, would be great if you can take a look and if this aligns with your idea.

:) I did already open a pr for the same here:

• fix(cli): jwt errors #5862

[shkuls]

Oh no worries, however you seem fit :)