Catalog fails to load: Supabase returns 401 with embedded key (Linux, v0.2.9)

[andreagosto]

Summary

On Linux (.deb, v0.2.9-1), the Models section shows "Catalog unavailable. Check your connection and Supabase configuration." and the catalog never loads, even after pressing refresh. This is not a network problem on the client side: the same Supabase request the app performs succeeds with curl from the same machine at the same time.

Environment

• Arctic ComfyUI Helper 0.2.9-1 (arctic-comfyui-helper_0.2.9-1_amd64.deb)
• Ubuntu 24.04 (kernel 6.x), no system proxy, no VPN tunnel active
• App launched from the official .desktop file

App log (RUST_LOG=debug)

INFO  arctic_downloader::catalog] Catalog initialised with 0 models (0 LoRAs, 0 workflows).
INFO  arctic_downloader::catalog] Refreshing catalog from Supabase table catalog_documents.main
WARN  arctic_downloader::catalog] Supabase catalog refresh skipped: server returned 401 (401)

Server-side verification (same machine, same moment)

The Supabase project embedded in the binary (https://qhiizvlygtukshiiujcp.supabase.co) is reachable and the embedded publishable key is valid:

# apikey only -> works
curl -H "apikey: sb_publishable_FRTam0Ykg86M4pxUKZhF4g_ooW6vmE2" \
  "https://qhiizvlygtukshiiujcp.supabase.co/rest/v1/catalog_documents?select=catalog_key&limit=1"
# -> HTTP 200  [{"catalog_key":"main"}]

The full document also downloads fine: HTTP 200, ~71 KB, catalog_version: 1 with 14 models / 2 LoRAs / 2 workflows.

Likely root cause

Current hosted Supabase (PostgREST) returns 401 when a request carries a valid apikey header together with an empty/invalid Authorization: Bearer header:

# valid apikey + EMPTY Bearer -> 401
curl -H "apikey: sb_publishable_FRTam0Ykg86M4pxUKZhF4g_ooW6vmE2" \
     -H "Authorization: Bearer " \
  "https://qhiizvlygtukshiiujcp.supabase.co/rest/v1/catalog_documents?select=catalog_key&limit=1"
# -> HTTP 401 {"message":"Invalid API key"}

So if the app builds the request as Authorization: Bearer ${ARCTIC_SUPABASE_ANON_KEY} with the env var unset (empty token), hosted Supabase now rejects the whole request even though the apikey is valid. This PostgREST behavior appears to have changed recently on the hosted platform, which would break all 0.2.9 installs at once, regardless of the user's network.

Workaround (confirmed working)

Launching the app with the env vars set explicitly fixes the catalog load:

ARCTIC_SUPABASE_URL="https://qhiizvlygtukshiiujcp.supabase.co" \
ARCTIC_SUPABASE_ANON_KEY="sb_publishable_FRTam0Ykg86M4pxUKZhF4g_ooW6vmE2" \
ARCTIC_SUPABASE_PUBLISHABLE_KEY="sb_publishable_FRTam0Ykg86M4pxUKZhF4g_ooW6vmE2" \
arctic-comfyui-helper

Log then shows:

INFO arctic_downloader::catalog] Catalog updated from Supabase.
INFO arctic_downloader::app] Catalog refreshed from remote in the background.

Suggested fix

• Don't send an Authorization header at all when the token is empty, or
• Always send the embedded publishable key as both apikey and Authorization: Bearer (this combination returns 200), or
• Treat 401 on catalog fetch as "auth/config issue" with a clearer message pointing to the env-var override.

Happy to test any build.