chore(deps): update actions/checkout action to v7.0.1

docs: fix example jwt expiration epoch
Issue: the example epoch date is wrapped in parentheses. This causes the server to return PGRST303: "The JWT 'exp' claim must be a number" Fix: remove parentheses (cherry picked from commit 69d21a82c9)
2026-07-23 20:11:44 +00:00 · 2026-07-02 10:57:21 +02:00 · 2026-06-19 19:07:40 +00:00 · 2026-06-03 07:40:07 +00:00 · 2026-05-12 13:10:49 +00:00 · 2026-04-15 09:30:17 +02:00
36 changed files with 232 additions and 928 deletions
@@ -1,119 +0,0 @@
-name: Artifact from Cirrus
-
-description: Waits for a specific Cirrus CI run to complete, then downloads the artifact and uploads it to the current workflow. This will silently succeed if Cirrus CI did not schedule a task within 2 minutes.
-
-inputs:
-  download:
-    description: Name of Artifact to download from Cirrus CI
-    required: true
-  task:
-    description: Name of Cirrus Task
-    required: true
-  token:
-    description: GitHub Token
-    required: true
-  upload:
-    description: Name of Artifact to upload on GitHub Actions
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - shell: bash
-      run: echo "GH_TOKEN=${{ inputs.token }}" >> "$GITHUB_ENV"
-    - name: Wait for Check Suite to be created
-      id: check-suite
-      env:
-        # GITHUB_SHA does weird things for pull request, so we roll our own:
-        COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
-      shell: bash
-      run: |
-        get_check_runs_url() {
-          gh api "repos/{owner}/{repo}/commits/${COMMIT}/check-suites" \
-            | jq -r '.check_suites[] | select(.app.slug == "cirrus-ci") | .check_runs_url'
-        }
-        for _ in $(seq 1 12); do
-          check_runs_url="$(get_check_runs_url)"
-          if [ -z "$check_runs_url" ]; then
-            echo "Cirrus CI task has not started, yet. Waiting..."
-            sleep 10
-          else
-            echo "check_runs_url=$check_runs_url" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-        done
-        >&2 echo "Cirrus CI check suite not found. Is Cirrus CI enabled for this repo?"
-    - name: Find task by name
-      id: find-task
-      if: steps.check-suite.outputs.check_runs_url
-      shell: bash
-      run: |
-        get_number_of_tasks() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -r '.check_runs | map(select(.name == "${{ inputs.task }}")) | length'
-        }
-        tasks="$(get_number_of_tasks)"
-        case "$tasks" in
-          0)
-            echo "Task not found, assuming it's skipped intentionally..."
-            exit 0
-            ;;
-          1)
-            echo "task_found=1" >> "$GITHUB_OUTPUT"
-            exit 0
-            ;;
-          *)
-            >&2 echo "More than 1 task with the same name found. Don't know what to do..."
-            exit 1
-            ;;
-        esac
-    - name: Wait for Cirrus CI to complete task
-      if: steps.find-task.outputs.task_found
-      shell: bash
-      run: |
-        get_conclusion() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -r '.check_runs[] | select(.name == "${{ inputs.task }}" and .status == "completed") | .conclusion'
-        }
-        while true; do
-          conclusion="$(get_conclusion)"
-          if [ -z "$conclusion" ]; then
-            echo "Cirrus CI task has not completed, yet. Waiting..."
-            sleep 30
-          else
-            if [ "$conclusion" == "success" ]; then
-              break
-            else
-              exit 1
-            fi
-          fi
-        done
-    - name: Download artifact from Cirrus CI
-      if: steps.find-task.outputs.task_found
-      id: download
-      shell: bash
-      run: |
-        get_external_id() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -er '.check_runs[] | select(.name == "${{ inputs.task }}") | .external_id'
-        }
-        archive="$(mktemp)"
-        artifacts="$(mktemp -d)"
-        until curl --no-progress-meter --fail -o "${archive}" \
-                "https://api.cirrus-ci.com/v1/artifact/task/$(get_external_id)/${{ inputs.download }}.zip"
-        do
-          # This happens when a tag is pushed on the same commit. In this case the
-          # job is immediately marked as "completed" for us, so we end up here after a few
-          # seconds - but the actual Cirrus CI task is still running and didn't produce its artifact, yet.
-          echo "Artifact not found on Cirrus CI, yet. Waiting..."
-          sleep 30
-        done
-        unzip "${archive}" -d "${artifacts}"
-        echo "artifacts=${artifacts}" >> "$GITHUB_OUTPUT"
-    - name: Save artifact to GitHub Actions
-      if: steps.find-task.outputs.task_found
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-      with:
-        name: ${{ inputs.upload }}
-        path: ${{ steps.download.outputs.artifacts }}
-        if-no-files-found: error
@@ -1,35 +0,0 @@
-name: Cache on main
-
-description: Stores caches on main and release branches only, but restores them on all branches.
-
-inputs:
-  path:
-    description: Path(s) to cache
-    required: true
-  save-prs:
-    description: Whether to additionally store the cache in a pull request, too. Should only be used for very small caches.
-    type: boolean
-  prefix:
-    description: Cache key prefix to be used in both primary key and restore-keys.
-    required: true
-  suffix:
-    description: Cache key suffix to be used only in primary key.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      if: ${{ startsWith(github.ref, 'refs/heads/') || (inputs.save-prs && startsWith(github.ref, 'refs/pull/')) }}
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
-        restore-keys: |
-          ${{ runner.os }}-${{ inputs.prefix }}-
-    - uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      if: ${{ !startsWith(github.ref, 'refs/heads/') && !(inputs.save-prs && startsWith(github.ref, 'refs/pull/'))  }}
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
-        restore-keys: |
-          ${{ runner.os }}-${{ inputs.prefix }}-
@@ -11,12 +11,12 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: nixbuild/nix-quick-install-action@1f095fee853b33114486cfdeae62fa099cda35a9 # v33
+    - uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35
      with:
        nix_conf: |-
          always-allow-substitutes = true
          max-jobs = auto
-    - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+    - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
      with:
        name: postgrest
        authToken: ${{ inputs.authToken }}
@@ -1,210 +0,0 @@
-name: Build
-
-on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+
-    paths:
-      - .github/workflows/build.yaml
-      - .github/actions/**
-      - .github/scripts/**
-      - .github/*
-      - '*.nix'
-      - nix/**
-      - .cirrus.yml
-      - cabal.project*
-      - postgrest.cabal
-      - stack.yaml*
-      - '**.hs'
-      - '!**.md'
-
-concurrency:
-  # Terminate all previous runs of the same workflow for pull requests
-  group: build-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  static:
-    name: Nix - Linux x86-64 static
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      - name: Build static executable
-        run: nix-build -A postgrestStatic
-      - name: Save built executable as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: postgrest-linux-static-x86-64
-          path: result/bin/postgrest
-          if-no-files-found: error
-
-      - name: Build Docker image
-        run: nix-build -A docker.image --out-link postgrest-docker.tar.gz
-      - name: Save built Docker image as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: postgrest-docker-x86-64
-          path: postgrest-docker.tar.gz
-          if-no-files-found: error
-
-
-  macos:
-    name: Nix - MacOS
-    runs-on: macos-14
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - name: Install gnu sed
-        run: brew install gnu-sed
-
-      - name: Build everything
-        run: |
-          # The --dry-run will give us a list of derivations to download from cachix and
-          # derivations to build. We only take those that would have to be built and then build
-          # those explicitly. This has the advantage that pure verification will not include
-          # a download anymore, making it much faster. If something needs to be built, only
-          # the dependencies required to do so will be downloaded, but not everything.
-          nix-build --dry-run 2>&1 \
-            | gsed -e '1,/derivations will be built:$/d' -e '/paths will be fetched/Q' \
-            | xargs nix-build
-
-
-  stack:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Linux aarch64
-            runs-on: ubuntu-24.04-arm
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
-            artifact: postgrest-ubuntu-aarch64
-            deps: sudo apt-get update && sudo apt-get install libpq-dev
-
-          - name: MacOS aarch64
-            runs-on: macos-14
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
-            artifact: postgrest-macos-aarch64
-            deps: brew link --force libpq
-
-          - name: MacOS x86-64
-            runs-on: macos-13
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
-            artifact: postgrest-macos-x86-64
-            deps: brew link --force libpq
-
-          - name: Windows
-            runs-on: windows-2022
-            cache: |
-              C:\sr\pantry
-              C:\sr\snapshots
-              C:\sr\stack.sqlite3
-            deps: Add-Content $env:GITHUB_PATH $env:PGBIN
-            artifact: postgrest-windows-x86-64
-
-    name: Stack - ${{ matrix.name }}
-    runs-on: ${{ matrix.runs-on }}
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: haskell-actions/setup@7909071ceec0344debcc968c6c7a96a52e8dd0d7 # v2.8.1
-        with:
-          # This must match the version in stack.yaml's resolver
-          ghc-version: 9.6.7
-          enable-stack: true
-          stack-no-global: true
-          stack-setup-ghc: true
-      - name: Cache ~/.stack
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: ${{ matrix.cache }}
-          prefix: stack
-          suffix: ${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
-      - name: Cache .stack-work
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: .stack-work
-          save-prs: true
-          prefix: stack-work-${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
-          suffix: ${{ hashFiles('main/**/*.hs', 'src/**/*.hs') }}
-      - name: Install dependencies
-        if: matrix.deps
-        run: ${{ matrix.deps }}
-      - name: Build with Stack
-        run: stack build --lock-file error-on-write --local-bin-path result --copy-bins
-      - name: Strip Executable
-        run: strip result/postgrest*
-      - name: Save built executable as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: ${{ matrix.artifact }}
-          path: |
-            result/postgrest
-            result/postgrest.exe
-          if-no-files-found: error
-
-
-  freebsd:
-    name: Stack - FreeBSD from CirrusCI
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: ./.github/actions/artifact-from-cirrus
-        with:
-          token: ${{ github.token }}
-          task: Build FreeBSD (Stack)
-          download: bin
-          upload: postgrest-freebsd-x86-64
-
-
-  cabal:
-    strategy:
-      matrix:
-        ghc: ['9.6.7', '9.8.4']
-      fail-fast: false
-    name: Cabal - Linux x86-64 - GHC ${{ matrix.ghc }}
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: haskell-actions/setup@7909071ceec0344debcc968c6c7a96a52e8dd0d7 # v2.8.1
-        with:
-          ghc-version: ${{ matrix.ghc }}
-      - name: Cache .cabal
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: |
-            ~/.cabal/packages
-            ~/.cabal/store
-          prefix: cabal-${{ matrix.ghc }}-${{ hashFiles('cabal.project.freeze') }}
-          suffix: ${{ hashFiles('postgrest.cabal', 'cabal.project') }}
-      - name: Cache dist-newstyle
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: dist-newstyle
-          save-prs: true
-          prefix: cabal-${{ matrix.ghc }}-dist-newstyle-${{ hashFiles('postgrest.cabal', 'cabal.project', 'cabal.project.freeze') }}
-          suffix: ${{ hashFiles('**/*.hs') }}
-      - name: Install dependencies
-        run: cabal build --only-dependencies --enable-tests --enable-benchmarks
-      - name: Build
-        run: cabal build --enable-tests --enable-benchmarks all
@@ -1,32 +0,0 @@
-name: Check
-
-on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+
-
-concurrency:
-  # Terminate all previous runs of the same workflow for pull requests
-  group: style-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  lint-style:
-    name: Lint & Style
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: style.lint.bin style.styleCheck.bin
-      - name: Run linter (check locally with `nix-shell --run postgrest-lint`)
-        run: postgrest-lint
-      - name: Run style check (auto-format with `nix-shell --run postgrest-style`)
-        run: postgrest-style-check
@@ -1,70 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - main
-      - v[0-9]+
-
-jobs:
-  check:
-    name: Check
-    uses: ./.github/workflows/check.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  docs:
-    name: Docs
-    uses: ./.github/workflows/docs.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  test:
-    name: Test
-    uses: ./.github/workflows/test.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-
-  build:
-    name: Build
-    uses: ./.github/workflows/build.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  tag:
-    name: Tag
-    concurrency:
-      # Never tag outdated commits on the main branch by skipping superseded commits
-      group: ci-tag-${{ (github.ref == 'refs/heads/main' && github.ref) || github.run_id }}
-      # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
-      cancel-in-progress: false
-    if: vars.RELEASE_ENABLED
-    runs-on: ubuntu-24.04
-    needs:
-      - docs
-      - test
-      - build
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          ssh-key: ${{ secrets.POSTGREST_SSH_KEY }}
-      - name: Tag latest commit
-        run: |
-          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-
-          if [[ "$cabal_version" == *.*.* ]]; then
-            git fetch --tags
-
-            if [ -z "$(git tag --list "v$cabal_version")" ]; then
-              git tag "v$cabal_version"
-              git push origin "v$cabal_version"
-            fi
-          else
-            git tag -f "devel"
-            git push -f origin "devel"
-          fi
@@ -27,7 +27,7 @@ jobs:
    name: Build
    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Setup Nix Environment
      uses: ./.github/actions/setup-nix
      with:
@@ -41,7 +41,7 @@ jobs:
    name: Spellcheck
    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Setup Nix Environment
      uses: ./.github/actions/setup-nix
      with:
@@ -1,17 +0,0 @@
-name: Linkcheck
-
-on:
-  schedule:
-    - cron: '1 2 * * 3'
-
-jobs:
-  linkcheck:
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-    - name: Setup Nix Environment
-      uses: ./.github/actions/setup-nix
-      with:
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-        tools: docs.linkcheck.bin
-    - run: postgrest-docs-linkcheck
@@ -1,205 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - devel
-      - v*
-
-concurrency:
-  # Terminate all previous runs of the same workflow for the same tag.
-  group: release-${{ github.ref }}
-  # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
-  cancel-in-progress: false
-
-jobs:
-  build:
-    name: Build
-    uses: ./.github/workflows/build.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  prepare:
-    name: Prepare
-    runs-on: ubuntu-24.04
-    needs:
-      - build
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Check the version to be released
-        run: |
-          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-
-          if [ "${GITHUB_REF_NAME}" != "devel" ] && [ "${GITHUB_REF_NAME}" != "v$cabal_version" ]; then
-            echo "Tagged version ($GITHUB_REF_NAME) does not match the one in postgrest.cabal (v$cabal_version). Aborting release..."
-            exit 1
-          fi
-      - name: Identify changes from CHANGELOG.md
-        run: |
-          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
-            echo "Getting unreleased changes..."
-            sed -n "1,/## Unreleased/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
-          else
-            version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-            echo "Propper release, getting changes for version $version ..."
-            sed -n "1,/## \[$version\]/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
-          fi
-
-          echo "Relevant extract from CHANGELOG.md:"
-          cat CHANGES.md
-      - name: Save CHANGES.md as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: release-changes
-          path: CHANGES.md
-          if-no-files-found: error
-
-
-  github:
-    name: GitHub
-    permissions:
-      contents: write
-    runs-on: ubuntu-24.04
-    needs:
-      - prepare
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Download all artifacts
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          path: artifacts
-      - name: Create release bundle with archives for all builds
-        run: |
-          find artifacts -type f -iname postgrest -exec chmod +x {} \;
-
-          mkdir -p release-bundle
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-linux-static-x86-64.tar.xz" \
-            -C artifacts/postgrest-linux-static-x86-64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-macos-aarch64.tar.xz" \
-            -C artifacts/postgrest-macos-aarch64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-macos-x86-64.tar.xz" \
-            -C artifacts/postgrest-macos-x86-64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-freebsd-x86-64.tar.xz" \
-            -C artifacts/postgrest-freebsd-x86-64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-ubuntu-aarch64.tar.xz" \
-            -C artifacts/postgrest-ubuntu-aarch64 postgrest
-
-          zip --junk-paths "release-bundle/postgrest-${GITHUB_REF_NAME}-windows-x86-64.zip" \
-            artifacts/postgrest-windows-x86-64/postgrest.exe
-
-      - name: Save release bundle
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: release-bundle
-          path: release-bundle
-          if-no-files-found: error
-
-      - name: Publish release on GitHub
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "Releasing version ${GITHUB_REF_NAME} on GitHub..."
-
-          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
-            # To replace the existing release, we must first delete the old assets,
-            # then modify the release, then add the new assets.
-            gh release view devel --json assets \
-              | jq -r '.assets[] | .name' \
-              | xargs -rn1 \
-              gh release delete-asset -y devel
-            gh release edit devel \
-              -t devel \
-              --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
-              --prerelease
-            gh release upload --clobber devel release-bundle/*
-          else
-            gh release create "${GITHUB_REF_NAME}" \
-              -t "${GITHUB_REF_NAME}" \
-              --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
-              release-bundle/*
-          fi
-
-
-  docker:
-    name: Docker Hub
-    runs-on: ubuntu-24.04-arm
-    needs:
-      - prepare
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER
-    env:
-      DOCKER_REPO: ${{ vars.DOCKER_REPO }}
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Download x86-64 Docker image
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: postgrest-docker-x86-64
-      - name: Download aarch64 binary
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
-        with:
-          name: postgrest-ubuntu-aarch64
-      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
-      - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
-        with:
-          username: ${{ vars.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_PASS }}
-      - name: Build aarch64 Docker image
-        run: |
-          # This only pushes the image via digest, not a tag. This will not appear
-          # in the image list on Docker Hub, yet. It will be later added to the main
-          # tag's manifest.
-          docker buildx build \
-            -t "$DOCKER_REPO/postgrest" \
-            --platform linux/arm64 \
-            --output push-by-digest=true,type=image,push=true \
-            --metadata-file metadata.json \
-            .
-          echo "SHA256_ARM=$(jq -r '."containerimage.digest"' metadata.json)" >> "$GITHUB_ENV"
-      - name: Publish images on Docker Hub
-        run: |
-          docker load -i postgrest-docker.tar.gz
-
-          docker tag postgrest:latest "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-          docker push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-          docker buildx imagetools create --append \
-            -t "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}" \
-            "$DOCKER_REPO/postgrest@$SHA256_ARM"
-
-          # Only tag 'latest' for full releases
-          if [ "${GITHUB_REF_NAME}" != "devel" ]; then
-            echo "Pushing to 'latest' tag for full release of ${GITHUB_REF_NAME} ..."
-            docker tag postgrest:latest "$DOCKER_REPO"/postgrest:latest
-            docker push "$DOCKER_REPO"/postgrest:latest
-            docker buildx imagetools create --append \
-              -t "$DOCKER_REPO/postgrest:latest" \
-              "$DOCKER_REPO/postgrest@$SHA256_ARM"
-          else
-            echo "Skipping push to 'latest' tag for pre-release..."
-          fi
-
-
-  docker-description:
-    name: Docker Hub Description
-    runs-on: ubuntu-24.04
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER &&
-      github.ref == 'refs/tags/devel'
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2
-        with:
-          username: ${{ vars.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_PASS }}
-          repository: ${{ vars.DOCKER_REPO }}/postgrest
-          short-description: ${{ github.event.repository.description }}
-          readme-filepath: ./docker-hub-readme.md
-
@@ -1,161 +0,0 @@
-name: Test
-
-on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
-      CODECOV_TOKEN:
-        required: false
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+
-    paths:
-      - .github/workflows/test.yaml
-      - .github/workflows/report.yaml
-      - .github/actions/setup-nix/**
-      - default.nix
-      - nix/**
-      - .stylish-haskell.yaml
-      - cabal.project
-      - postgrest.cabal
-      - '**.hs'
-      - test/**
-      - '!**.md'
-
-concurrency:
-  # Terminate all previous runs of the same workflow for pull requests
-  group: test-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  coverage:
-    name: Coverage
-    runs-on: ubuntu-24.04
-    defaults:
-      run:
-        # Hack for enabling color output, see:
-        # https://github.com/actions/runner/issues/241#issuecomment-842566950
-        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: tests.coverage.bin tests.testDoctests.bin tests.testSpecIdempotence.bin
-
-      - name: Run coverage (IO tests and Spec tests against PostgreSQL 15)
-        run: postgrest-coverage
-      - name: Upload coverage to codecov
-        uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
-        with:
-          files: ./coverage/codecov.json
-          token: ${{ secrets.CODECOV_TOKEN }}
-
-      - name: Run doctests
-        if: always()
-        run: postgrest-test-doctests
-
-      - name: Check the spec tests for idempotence
-        if: always()
-        run: postgrest-test-spec-idempotence
-
-
-  postgres:
-    strategy:
-      fail-fast: false
-      matrix:
-        pgVersion: [12, 13, 14, 15, 16, 17]
-    name: PG ${{ matrix.pgVersion }}
-    runs-on: ubuntu-24.04
-    defaults:
-      run:
-        # Hack for enabling color output, see:
-        # https://github.com/actions/runner/issues/241#issuecomment-842566950
-        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: tests.testSpec.bin tests.testIO.bin tests.testBigSchema.bin withTools.postgresql-${{ matrix.pgVersion }}.bin
-
-      - name: Run spec tests
-        if: always()
-        run: postgrest-with-postgresql-${{ matrix.pgVersion }} postgrest-test-spec
-
-      - name: Run IO tests
-        if: always()
-        run: postgrest-with-postgresql-${{ matrix.pgVersion }} postgrest-test-io -vv
-
-      - name: Run IO tests on a big schema
-        if: always()
-        run: postgrest-with-postgresql-${{ matrix.pgVersion }} postgrest-test-big-schema -vv
-
-
-  memory:
-    name: Memory
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: tests.testMemory.bin
-      - name: Run memory tests
-        run: postgrest-test-memory
-
-
-  loadtest:
-    strategy:
-      matrix:
-        kind: ['mixed', 'jwt']
-    name: Loadtest
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: loadtest.loadtestAgainst.bin loadtest.report.bin
-      - name: Run loadtest
-        env:
-          TARGET_BRANCH: ${{ github.base_ref || github.ref_name }}
-        run: |
-          if [ "$TARGET_BRANCH" = "main" ]; then
-            latest_tag=$(git tag --sort=-creatordate --list "v*" | head -n1)
-          else
-            latest_tag=$(git tag --merged HEAD --sort=-creatordate "v*" | head -n1)
-          fi
-          postgrest-loadtest-against -k ${{ matrix.kind }} "$TARGET_BRANCH" "$latest_tag"
-          postgrest-loadtest-report >> "$GITHUB_STEP_SUMMARY"
-
-  flake:
-    strategy:
-      fail-fast: false
-      matrix:
-        runs-on:
-          - macos-13 # x86_64-darwin
-          - macos-14 # aarch64-darwin
-          - ubuntu-24.04 # x86_64-linux
-          - ubuntu-24.04-arm # aarch64-linux
-    name: Flake Check
-    runs-on: ${{ matrix.runs-on }}
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - name: Run flake check
-        run: |
-          nix flake check
@@ -32,7 +32,7 @@ PostgREST ongoing development is only possible thanks to our Sponsors and Backer
      </td>
      <td align="center" valign="middle">
        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
-          <img width="296px" src="static/supabase.png">
+          <img width="296px" src="static/supabase.svg">
        </a>
      </td>
    </tr>
@@ -5,6 +5,21 @@ This project adheres to [Semantic Versioning](http://semver.org/).

 ## Unreleased

+## [13.0.8] - 2025-10-24
+
+### Fixed
+
+- Fix loading utf-8 config files with `ASCII` locale set by @taimoorzaeem in #4386
+
+## [13.0.7] - 2025-09-14
+
+### Added
+
+- Improve the `PGRST106` error when the requested schema is invalid by @laurenceisla in #4089
+  + It now shows the invalid schema in the `message` field.
+  + The exposed schemas are now listed in the `hint` instead of the `message` field.
+- Improve error details of `PGRST301` error by @taimoorzaeem in #4051
+
 ## [13.0.6] - 2025-08-30

 ### Fixed
@@ -1,21 +0,0 @@
-# PostgREST Docker Hub image for aarch64.
-# The x86-64 is a single-static-binary image built via Nix, see:
-# nix/tools/docker/README.md
-
-FROM ubuntu:noble@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9 AS postgrest
-
-RUN apt-get update -y \
-    && apt install -y --no-install-recommends libpq-dev zlib1g-dev jq gcc libnuma-dev \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY postgrest /usr/bin/postgrest
-RUN chmod +x /usr/bin/postgrest
-
-EXPOSE 3000
-
-USER 1000
-
-# Use the array form to avoid running the command using bash, which does not handle `SIGTERM` properly. 
-# See https://docs.docker.com/compose/faq/#why-do-my-services-take-10-seconds-to-recreate-or-stop 
-CMD ["postgrest"]
@@ -41,7 +41,7 @@ API than you are likely to write from scratch.
      </td>
      <td align="center" valign="middle">
        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
-          <img width="296px" src="static/supabase.png">
+          <img width="296px" src="static/supabase.svg">
        </a>
      </td>
    </tr>
@@ -1 +1 @@
-index-state: hackage.haskell.org 2025-07-08T15:50:10Z
+index-state: hackage.haskell.org 2025-10-13T04:53:27Z
@@ -38,7 +38,7 @@ write from scratch.
      </td>
      <td align="center" valign="middle">
        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
-          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/supabase.png">
+          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/supabase.svg">
        </a>
      </td>
    </tr>
@@ -302,6 +302,7 @@ linkcheck_ignore = [
    r"https://blog.frankel.ch/poor-man-api",
    # Odd SSL error
    r"https://www.dripdepot.com",
+    r"https://www.euronodes.com",
    # New GitHub UI delays comment load, so anchor fails
    r"https://github.com/.*#issuecomment",
    # Random 500 Internal Server Error
@@ -6,7 +6,7 @@ Community Tutorials
 * `Building a Contacts List with PostgREST and Vue.js <https://www.youtube.com/watch?v=iHtsALtD5-U>`_ -
  In this video series, DigitalOcean shows how to build and deploy an Nginx + PostgREST(using a managed PostgreSQL database) + Vue.js webapp in an Ubuntu server droplet.

-* `PostgREST + Auth0: Create REST API in mintutes, and add social login using Auth0 <https://samkhawase.com/blog/postgrest/>`_ - A step-by-step tutorial to show how to dockerize and integrate Auth0 to PostgREST service.
+* `PostgREST + Auth0: Create REST API in minutes, and add social login using Auth0 <https://samkhawase.com/blog/postgrest-1-introduction/>`_ - A step-by-step tutorial to show how to dockerize and integrate Auth0 to PostgREST service.

 * `"CodeLess" backend using postgres, postgrest and oauth2 authentication with keycloak <https://www.mathieupassenaud.fr/codeless_backend/>`_ -
  A step-by-step tutorial for using PostgREST with KeyCloak(hosted on a managed service).
@@ -65,12 +65,12 @@ Sponsors

  .. container:: img-dark

-    .. image:: ../static/supabase-dark.png
+    .. image:: ../static/supabase-dark.svg
      :target: https://supabase.com/?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage

  .. container:: img-light

-    .. image:: ../static/supabase.png
+    .. image:: ../static/supabase.svg
      :target: https://supabase.com/?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage

  .. The static/empty.png(created with `convert -size 320x95 xc:#fcfcfc empty.png`) is an ugly workaround
@@ -206,7 +206,6 @@ In Production
 Here are some companies that use PostgREST in production.

 * `Catarse <https://www.catarse.me>`_
-* `Datrium <https://www.datrium.com>`_
 * `Drip Depot <https://www.dripdepot.com>`_
 * `Image-charts <https://www.image-charts.com>`_
 * `Netwo <https://www.netwo.io>`_
@@ -122,7 +122,7 @@ Restart the database and watch the log file in real-time to understand how HTTP
 Metrics
 =======

-The ``metrics`` endpoint on the :ref:`admin_server` endpoint provides metrics in `Prometheus text format <https://prometheus.io/docs/instrumenting/exposition_formats/#text-based-format>`_.
+The ``metrics`` endpoint on the :ref:`admin_server` endpoint provides metrics in `Prometheus text format <https://prometheus.io/docs/instrumenting/exposition_formats/#prometheus-text-format>`_.

 .. code-block:: bash

@@ -172,7 +172,7 @@ Go back to :ref:`tut1_step3` and change the payload to

 .. code-block:: bash

-  payload=$(echo -n "{\"role\":\"todo_user\",\"exp\":\"123456789\"}" | _base64)
+  payload=$(echo -n "{\"role\":\"todo_user\",\"exp\":123456789}" | _base64)

  echo -n "$header.$payload.$signature"

@@ -50,6 +50,16 @@ let
      # jailbreak, because hspec limit for tests
      fuzzyset = prev.fuzzyset_0_2_4;

+      # TODO: Remove once available in nixpkgs haskellPackages
+      configurator-pg =
+        prev.callHackageDirect
+          {
+            pkg = "configurator-pg";
+            ver = "0.2.11";
+            sha256 = "sha256-mtGtNawDJgz2ZIEVca+IYXVu4oNw9xsfJiYWAqAbbgc=";
+          }
+          { };
+
      hasql-pool = lib.dontCheck (prev.callHackageDirect
        {
          pkg = "hasql-pool";
@@ -1,5 +1,5 @@
 name:               postgrest
-version:            13.0.6
+version:            13.0.8
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                    for tables, views, and functions, supporting all HTTP methods that security
@@ -100,7 +100,7 @@ library
                    , case-insensitive          >= 1.2 && < 1.3
                    , cassava                   >= 0.4.5 && < 0.6
                    , clock                     >= 0.8.3 && < 0.9.0
-                    , configurator-pg           >= 0.2 && < 0.3
+                    , configurator-pg           >= 0.2.11 && < 0.3
                    , containers                >= 0.5.7 && < 0.7
                    , cookie                    >= 0.4.2 && < 0.6
                    , directory                 >= 1.2.6 && < 1.4
@@ -207,7 +207,7 @@ getAction resource schema method =
 getSchema :: AppConfig -> RequestHeaders -> ByteString -> Either ApiRequestError (Schema, Bool)
 getSchema AppConfig{configDbSchemas} hdrs method = do
  case profile of
-    Just p | p `notElem` configDbSchemas -> Left $ UnacceptableSchema $ toList configDbSchemas
+    Just p | p `notElem` configDbSchemas -> Left $ UnacceptableSchema p $ toList configDbSchemas
           | otherwise                   -> Right (p, True)
    Nothing -> Right (defaultSchema, length configDbSchemas /= 1) -- if we have many schemas, assume the default schema was negotiated
  where
@@ -50,7 +50,8 @@ import PostgREST.Auth.JwtCache (lookupJwtCache)
 import PostgREST.Auth.Types    (AuthResult (..))
 import PostgREST.Config        (AppConfig (..), FilterExp (..),
                                JSPath, JSPathExp (..))
-import PostgREST.Error         (Error (..), JwtError (..))
+import PostgREST.Error         (Error (..), JwtClaimsError (..),
+                                JwtDecodeError (..), JwtError (..))

 import Protolude

@@ -58,7 +59,7 @@ import Protolude
 -- JSON object of JWT claims.
 parseToken :: AppConfig -> Maybe ByteString -> UTCTime -> ExceptT Error IO JSON.Value
 parseToken _ Nothing _ = return JSON.emptyObject
-parseToken _ (Just "") _ = throwE . JwtErr $ JwtDecodeError "Empty JWT is sent in Authorization header"
+parseToken _ (Just "") _ = throwE . JwtErr $ JwtDecodeErr EmptyAuthHeader
 parseToken AppConfig{..} (Just tkn) time = do
  secret <- liftEither . maybeToRight (JwtErr JwtSecretMissing) $ configJWKS
  tknWith3Parts <- liftEither $ hasThreeParts tkn
@@ -69,33 +70,33 @@ parseToken AppConfig{..} (Just tkn) time = do
      hasThreeParts :: ByteString -> Either Error ByteString
      hasThreeParts token = case length $ BS.split (BS.c2w '.') token of
        3 -> Right token
-        n -> Left $ JwtErr $ JwtDecodeError ("Expected 3 parts in JWT; got " <> show n)
+        n -> Left $ JwtErr $ JwtDecodeErr $ UnexpectedParts n
      jwtDecodeError :: JWT.JwtError -> JwtError
      -- The only errors we can get from JWT.decode function are:
      --   BadAlgorithm
      --   KeyError
      --   BadCrypto
-      jwtDecodeError (JWT.KeyError _)     = JwtDecodeError "No suitable key or wrong key type"
-      jwtDecodeError (JWT.BadAlgorithm _) = JwtDecodeError "Wrong or unsupported encoding algorithm"
-      jwtDecodeError JWT.BadCrypto        = JwtDecodeError "JWT cryptographic operation failed"
+      jwtDecodeError (JWT.KeyError m)     = JwtDecodeErr $ KeyError m
+      jwtDecodeError (JWT.BadAlgorithm m) = JwtDecodeErr $ BadAlgorithm m
+      jwtDecodeError JWT.BadCrypto        = JwtDecodeErr BadCrypto
      -- Control never reaches here, the decode function only returns the above three
-      jwtDecodeError _                    = JwtDecodeError "JWT couldn't be decoded"
+      jwtDecodeError _                    = JwtDecodeErr UnreachableDecodeError

      verifyClaims :: JWT.JwtContent -> Either JwtError JSON.Value
      verifyClaims (JWT.Jws (_, claims)) = case JSON.decodeStrict claims of
        Just jclaims@(JSON.Object mclaims) ->
-          verifyClaim mclaims "exp" isValidExpClaim "JWT expired" >>
-          verifyClaim mclaims "nbf" isValidNbfClaim "JWT not yet valid" >>
-          verifyClaim mclaims "iat" isValidIatClaim "JWT issued at future" >>
-          verifyClaim mclaims "aud" isValidAudClaim "JWT not in audience" >>
+          verifyClaim mclaims "exp" isValidExpClaim JWTExpired >>
+          verifyClaim mclaims "nbf" isValidNbfClaim JWTNotYetValid >>
+          verifyClaim mclaims "iat" isValidIatClaim JWTIssuedAtFuture >>
+          verifyClaim mclaims "aud" isValidAudClaim JWTNotInAudience >>
          return jclaims
-        _ -> Left $ JwtClaimsError "Parsing claims failed"
+        _ -> Left $ JwtClaimsErr ParsingClaimsFailed
      -- TODO: We could enable JWE support here (encrypted tokens)
-      verifyClaims _ = Left $ JwtDecodeError "Unsupported token type"
+      verifyClaims _ = Left $ JwtDecodeErr UnsupportedTokenType

      verifyClaim mclaims claim func err = do
        isValid <- maybe (Right True) func (KM.lookup claim mclaims)
-        unless isValid $ Left $ JwtClaimsError err
+        unless isValid $ Left $ JwtClaimsErr err

      allowedSkewSeconds = 30 :: Int64
      now = floor . nominalDiffTimeToSeconds $ utcTimeToPOSIXSeconds time
@@ -104,15 +105,15 @@ parseToken AppConfig{..} (Just tkn) time = do

      isValidExpClaim :: JSON.Value -> Either JwtError Bool
      isValidExpClaim (JSON.Number secs) = Right $ now <= (sciToInt secs + allowedSkewSeconds)
-      isValidExpClaim _ = Left $ JwtClaimsError "The JWT 'exp' claim must be a number"
+      isValidExpClaim _ = Left $ JwtClaimsErr ExpClaimNotNumber

      isValidNbfClaim :: JSON.Value -> Either JwtError Bool
      isValidNbfClaim (JSON.Number secs) = Right $ now >= (sciToInt secs - allowedSkewSeconds)
-      isValidNbfClaim _ = Left $ JwtClaimsError "The JWT 'nbf' claim must be a number"
+      isValidNbfClaim _ = Left $ JwtClaimsErr NbfClaimNotNumber

      isValidIatClaim :: JSON.Value -> Either JwtError Bool
      isValidIatClaim (JSON.Number secs) = Right $ now >= (sciToInt secs - allowedSkewSeconds)
-      isValidIatClaim _ = Left $ JwtClaimsError "The JWT 'iat' claim must be a number"
+      isValidIatClaim _ = Left $ JwtClaimsErr IatClaimNotNumber

      isValidAudClaim :: JSON.Value -> Either JwtError Bool
      isValidAudClaim JSON.Null = Right True -- {"aud": null} is valid for all audiences
@@ -120,7 +121,7 @@ parseToken AppConfig{..} (Just tkn) time = do
      isValidAudClaim (JSON.Array arr)
        | null arr = Right True              -- {"aud": []} is valid for all audiences
        | allStrings arr = Right $ maybe True (\a -> JSON.String a `elem` arr) configJwtAudience
-      isValidAudClaim _ = Left $ JwtClaimsError "The JWT 'aud' claim must be a string or an array of strings"
+      isValidAudClaim _ = Left $ JwtClaimsErr AudClaimNotStringOrArray

 parseClaims :: Monad m =>
  AppConfig -> JSON.Value -> ExceptT Error m AuthResult
@@ -14,6 +14,8 @@ module PostgREST.Error
  , PgError(..)
  , Error(..)
  , JwtError (..)
+  , JwtDecodeError(..)
+  , JwtClaimsError(..)
  , errorPayload
  , status
  ) where
@@ -86,7 +88,7 @@ data ApiRequestError
  | QueryParamError QPError
  | RelatedOrderNotToOne Text Text
  | UnacceptableFilter Text
-  | UnacceptableSchema [Text]
+  | UnacceptableSchema Text [Text]
  | UnsupportedMethod ByteString
  | GucHeadersError
  | GucStatusError
@@ -194,7 +196,7 @@ instance ErrorBody ApiRequestError where
  message (InvalidBody errorMessage)   = T.decodeUtf8 errorMessage
  message (InvalidRange _)             = "Requested range not satisfiable"
  message InvalidFilters               = "Filters must include all and only primary key columns with 'eq' operators"
-  message (UnacceptableSchema schemas) = "The schema must be one of the following: " <> T.intercalate ", " schemas
+  message (UnacceptableSchema sch _)   = "Invalid schema: " <> sch
  message (MediaTypeError cts)         = "None of these media types are available: " <> T.intercalate ", " (map T.decodeUtf8 cts)
  message (NotEmbedded resource)       = "'" <> resource <> "' is not an embedded resource in this request"
  message GucHeadersError              = "response.headers guc must be a JSON array composed of objects with a single key and a string value"
@@ -234,6 +236,7 @@ instance ErrorBody ApiRequestError where
  -- HINT: Maybe JSON.Value
  hint (NotEmbedded resource) = Just $ JSON.String $ "Verify that '" <> resource <> "' is included in the 'select' query parameter."
  hint (PGRSTParseError raiseErr) = Just $ JSON.String $ pgrstParseErrorHint raiseErr
+  hint (UnacceptableSchema _ schemas) = Just $ JSON.String $ "Only the following schemas are exposed: "  <> T.intercalate ", " schemas

  hint _ = Nothing

@@ -647,10 +650,32 @@ data Error
  deriving Show

 data JwtError
-  = JwtDecodeError Text
+  = JwtDecodeErr JwtDecodeError
  | JwtSecretMissing
  | JwtTokenRequired
-  | JwtClaimsError Text
+  | JwtClaimsErr JwtClaimsError
+  deriving Show
+
+data JwtDecodeError
+  = EmptyAuthHeader
+  | UnexpectedParts Int
+  | KeyError Text
+  | BadAlgorithm Text
+  | BadCrypto
+  | UnsupportedTokenType
+  | UnreachableDecodeError
+  deriving Show
+
+data JwtClaimsError
+  = JWTExpired
+  | JWTNotYetValid
+  | JWTIssuedAtFuture
+  | JWTNotInAudience
+  | ParsingClaimsFailed
+  | ExpClaimNotNumber
+  | NbfClaimNotNumber
+  | IatClaimNotNumber
+  | AudClaimNotStringOrArray
  deriving Show

 instance PgrstError Error where
@@ -696,14 +721,14 @@ instance ErrorBody Error where
  hint (PgErr err)           = hint err

 instance PgrstError JwtError where
-  status JwtDecodeError{} = HTTP.unauthorized401
+  status JwtDecodeErr{}   = HTTP.unauthorized401
  status JwtSecretMissing = HTTP.status500
  status JwtTokenRequired = HTTP.unauthorized401
-  status JwtClaimsError{} = HTTP.unauthorized401
+  status JwtClaimsErr{}   = HTTP.unauthorized401

-  headers (JwtDecodeError m) = [invalidTokenHeader m]
+  headers e@(JwtDecodeErr _) = [invalidTokenHeader $ message e]
  headers JwtTokenRequired   = [requiredTokenHeader]
-  headers (JwtClaimsError m) = [invalidTokenHeader m]
+  headers e@(JwtClaimsErr _) = [invalidTokenHeader $ message e]
  headers _                  = mempty

 instance JSON.ToJSON JwtError where
@@ -712,15 +737,35 @@ instance JSON.ToJSON JwtError where

 instance ErrorBody JwtError where
  code JwtSecretMissing = "PGRST300"
-  code (JwtDecodeError _) = "PGRST301"
+  code (JwtDecodeErr _) = "PGRST301"
  code JwtTokenRequired = "PGRST302"
-  code (JwtClaimsError _) = "PGRST303"
+  code (JwtClaimsErr _) = "PGRST303"

  message JwtSecretMissing = "Server lacks JWT secret"
-  message (JwtDecodeError msg) = msg
+  message (JwtDecodeErr e) = case e of
+    EmptyAuthHeader        -> "Empty JWT is sent in Authorization header"
+    UnexpectedParts n      -> "Expected 3 parts in JWT; got " <> show n
+    KeyError _             -> "No suitable key or wrong key type"
+    BadAlgorithm _         -> "Wrong or unsupported encoding algorithm"
+    BadCrypto              -> "JWT cryptographic operation failed"
+    UnsupportedTokenType   -> "Unsupported token type"
+    UnreachableDecodeError -> "JWT couldn't be decoded"
  message JwtTokenRequired = "Anonymous access is disabled"
-  message (JwtClaimsError msg) = msg
+  message (JwtClaimsErr e) = case e of
+    JWTExpired               -> "JWT expired"
+    JWTNotYetValid           -> "JWT not yet valid"
+    JWTIssuedAtFuture        -> "JWT issued at future"
+    JWTNotInAudience         -> "JWT not in audience"
+    ParsingClaimsFailed      -> "Parsing claims failed"
+    ExpClaimNotNumber        -> "The JWT 'exp' claim must be a number"
+    NbfClaimNotNumber        -> "The JWT 'nbf' claim must be a number"
+    IatClaimNotNumber        -> "The JWT 'iat' claim must be a number"
+    AudClaimNotStringOrArray -> "The JWT 'aud' claim must be a string or an array of strings"

+  details (JwtDecodeErr jde) = case jde of
+    KeyError dets     -> Just $ JSON.String dets
+    BadAlgorithm dets -> Just $ JSON.String dets
+    _                 -> Nothing
  details _ = Nothing

  hint _    = Nothing
@@ -9,6 +9,7 @@ nix:
  pure: false

 extra-deps:
+  - configurator-pg-0.2.11
  - fuzzyset-0.2.4
  - hasql-pool-1.0.1
  - jose-jwt-0.10.0
@@ -4,6 +4,13 @@
 #   https://docs.haskellstack.org/en/stable/topics/lock_files

 packages:
+- completed:
+    hackage: configurator-pg-0.2.11@sha256:de0c56386591e85159436b0af04a8f15a4f4e156354e99709676c2c2ee959505,2850
+    pantry-tree:
+      sha256: 7b4daa4ea970335414f26b313a168cd12182b7b34ea8af2616c83d38699c4301
+      size: 2527
+  original:
+    hackage: configurator-pg-0.2.11
 - completed:
    hackage: fuzzyset-0.2.4@sha256:f1b6de8bf33277bf6255207541d65028f1f1ea93af5541b654c86b5674995485,1618
    pantry-tree:
@@ -0,0 +1,23 @@
+<svg width="581" height="113" viewBox="0 0 581 113" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M151.397 66.7608C151.996 72.3621 157.091 81.9642 171.877 81.9642C184.764 81.9642 190.959 73.7624 190.959 65.7607C190.959 58.559 186.063 52.6577 176.373 50.6571L169.379 49.1569C166.682 48.6568 164.884 47.1565 164.884 44.7559C164.884 41.9552 167.681 39.8549 171.178 39.8549C176.772 39.8549 178.87 43.5556 179.27 46.4564L190.359 43.9558C189.76 38.6546 185.064 29.7527 171.078 29.7527C160.488 29.7527 152.696 37.0543 152.696 45.8561C152.696 52.7576 156.991 58.4591 166.482 60.5594L172.976 62.0598C176.772 62.8599 178.271 64.6605 178.271 66.8609C178.271 69.4615 176.173 71.762 171.777 71.762C165.983 71.762 163.085 68.1611 162.786 64.2602L151.397 66.7608Z" fill="white"/>
+<path d="M233.421 80.4639H246.109C245.909 78.7635 245.609 75.3628 245.609 71.5618V31.2529H232.321V59.8592C232.321 65.5606 228.925 69.5614 223.031 69.5614C216.837 69.5614 214.039 65.1604 214.039 59.6592V31.2529H200.752V62.3599C200.752 73.0622 207.545 81.7642 219.434 81.7642C224.628 81.7642 230.325 79.7638 233.022 75.1627C233.022 77.1631 233.221 79.4636 233.421 80.4639Z" fill="white"/>
+<path d="M273.076 99.4682V75.663C275.473 78.9636 280.469 81.6644 287.263 81.6644C301.149 81.6644 310.439 70.6617 310.439 55.7584C310.439 41.1553 302.148 30.1528 287.762 30.1528C280.37 30.1528 274.875 33.4534 272.677 37.2544V31.253H259.79V99.4682H273.076ZM297.352 55.8585C297.352 64.6606 291.958 69.7616 285.164 69.7616C278.372 69.7616 272.877 64.5605 272.877 55.8585C272.877 47.1566 278.372 42.0554 285.164 42.0554C291.958 42.0554 297.352 47.1566 297.352 55.8585Z" fill="white"/>
+<path d="M317.964 67.0609C317.964 74.7627 324.357 81.8643 334.848 81.8643C342.139 81.8643 346.835 78.4634 349.332 74.5625C349.332 76.463 349.532 79.1635 349.832 80.4639H362.02C361.72 78.7635 361.422 75.2627 361.422 72.6622V48.4567C361.422 38.5545 355.627 29.7527 340.043 29.7527C326.855 29.7527 319.761 38.2544 318.963 45.9562L330.751 48.4567C331.151 44.1558 334.348 40.455 340.141 40.455C345.737 40.455 348.434 43.3556 348.434 46.8564C348.434 48.5568 347.536 49.9572 344.738 50.3572L332.65 52.1576C324.458 53.3579 317.964 58.2589 317.964 67.0609ZM337.644 71.962C333.349 71.962 331.25 69.1614 331.25 66.2608C331.25 62.4599 333.947 60.5594 337.345 60.0594L348.434 58.359V60.5594C348.434 69.2615 343.239 71.962 337.644 71.962Z" fill="white"/>
+<path d="M387.703 80.4641V74.4627C390.299 78.6637 395.494 81.6644 402.288 81.6644C416.276 81.6644 425.467 70.5618 425.467 55.6585C425.467 41.0552 417.174 29.9528 402.788 29.9528C395.494 29.9528 390.1 33.1535 387.902 36.6541V8.04785H374.815V80.4641H387.703ZM412.178 55.7584C412.178 64.7605 406.784 69.7616 399.99 69.7616C393.297 69.7616 387.703 64.6606 387.703 55.7584C387.703 46.7564 393.297 41.8554 399.99 41.8554C406.784 41.8554 412.178 46.7564 412.178 55.7584Z" fill="white"/>
+<path d="M432.99 67.0609C432.99 74.7627 439.383 81.8643 449.873 81.8643C457.165 81.8643 461.862 78.4634 464.358 74.5625C464.358 76.463 464.559 79.1635 464.858 80.4639H477.046C476.748 78.7635 476.448 75.2627 476.448 72.6622V48.4567C476.448 38.5545 470.653 29.7527 455.068 29.7527C441.881 29.7527 434.788 38.2544 433.989 45.9562L445.776 48.4567C446.177 44.1558 449.374 40.455 455.167 40.455C460.763 40.455 463.46 43.3556 463.46 46.8564C463.46 48.5568 462.561 49.9572 459.763 50.3572L447.676 52.1576C439.484 53.3579 432.99 58.2589 432.99 67.0609ZM452.671 71.962C448.375 71.962 446.276 69.1614 446.276 66.2608C446.276 62.4599 448.973 60.5594 452.371 60.0594L463.46 58.359V60.5594C463.46 69.2615 458.265 71.962 452.671 71.962Z" fill="white"/>
+<path d="M485.645 66.7608C486.243 72.3621 491.339 81.9642 506.124 81.9642C519.012 81.9642 525.205 73.7624 525.205 65.7607C525.205 58.559 520.311 52.6577 510.62 50.6571L503.626 49.1569C500.929 48.6568 499.132 47.1565 499.132 44.7559C499.132 41.9552 501.928 39.8549 505.425 39.8549C511.021 39.8549 513.118 43.5556 513.519 46.4564L524.607 43.9558C524.007 38.6546 519.312 29.7527 505.326 29.7527C494.735 29.7527 486.944 37.0543 486.944 45.8561C486.944 52.7576 491.238 58.4591 500.73 60.5594L507.224 62.0598C511.021 62.8599 512.519 64.6605 512.519 66.8609C512.519 69.4615 510.421 71.762 506.025 71.762C500.23 71.762 497.334 68.1611 497.034 64.2602L485.645 66.7608Z" fill="white"/>
+<path d="M545.385 50.2571C545.685 45.7562 549.482 40.5549 556.375 40.5549C563.967 40.5549 567.165 45.3561 567.365 50.2571H545.385ZM568.664 63.0601C567.065 67.4609 563.668 70.5617 557.474 70.5617C550.88 70.5617 545.385 65.8606 545.087 59.3593H580.252C580.252 59.159 580.451 57.1587 580.451 55.2582C580.451 39.4547 571.361 29.7527 556.175 29.7527C543.588 29.7527 531.998 39.9548 531.998 55.6584C531.998 72.262 543.886 81.9642 557.374 81.9642C569.462 81.9642 577.255 74.8626 579.753 66.3607L568.664 63.0601Z" fill="white"/>
+<path d="M63.7076 110.284C60.8481 113.885 55.0502 111.912 54.9813 107.314L53.9738 40.0627L99.1935 40.0627C107.384 40.0627 111.952 49.5228 106.859 55.9374L63.7076 110.284Z" fill="url(#paint0_linear)"/>
+<path d="M63.7076 110.284C60.8481 113.885 55.0502 111.912 54.9813 107.314L53.9738 40.0627L99.1935 40.0627C107.384 40.0627 111.952 49.5228 106.859 55.9374L63.7076 110.284Z" fill="url(#paint1_linear)" fill-opacity="0.2"/>
+<path d="M45.317 2.07103C48.1765 -1.53037 53.9745 0.442937 54.0434 5.041L54.4849 72.2922H9.83113C1.64038 72.2922 -2.92775 62.8321 2.1655 56.4175L45.317 2.07103Z" fill="#3ECF8E"/>
+<defs>
+<linearGradient id="paint0_linear" x1="53.9738" y1="54.974" x2="94.1635" y2="71.8295" gradientUnits="userSpaceOnUse">
+<stop stop-color="#249361"/>
+<stop offset="1" stop-color="#3ECF8E"/>
+</linearGradient>
+<linearGradient id="paint1_linear" x1="36.1558" y1="30.578" x2="54.4844" y2="65.0806" gradientUnits="userSpaceOnUse">
+<stop/>
+<stop offset="1" stop-opacity="0"/>
+</linearGradient>
+</defs>
+</svg>
@@ -0,0 +1,23 @@
+<svg width="581" height="113" viewBox="0 0 581 113" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M151.397 66.7608C151.996 72.3621 157.091 81.9642 171.877 81.9642C184.764 81.9642 190.959 73.7624 190.959 65.7607C190.959 58.559 186.063 52.6577 176.373 50.6571L169.379 49.1569C166.682 48.6568 164.884 47.1565 164.884 44.7559C164.884 41.9552 167.681 39.8549 171.178 39.8549C176.772 39.8549 178.87 43.5556 179.27 46.4564L190.359 43.9558C189.76 38.6546 185.064 29.7527 171.078 29.7527C160.488 29.7527 152.696 37.0543 152.696 45.8561C152.696 52.7576 156.991 58.4591 166.482 60.5594L172.976 62.0598C176.772 62.8599 178.271 64.6605 178.271 66.8609C178.271 69.4615 176.173 71.762 171.777 71.762C165.983 71.762 163.085 68.1611 162.786 64.2602L151.397 66.7608Z" fill="#1F1F1F"/>
+<path d="M233.421 80.4639H246.109C245.909 78.7635 245.609 75.3628 245.609 71.5618V31.2529H232.321V59.8592C232.321 65.5606 228.925 69.5614 223.031 69.5614C216.837 69.5614 214.039 65.1604 214.039 59.6592V31.2529H200.752V62.3599C200.752 73.0622 207.545 81.7642 219.434 81.7642C224.628 81.7642 230.325 79.7638 233.022 75.1627C233.022 77.1631 233.221 79.4636 233.421 80.4639Z" fill="#1F1F1F"/>
+<path d="M273.076 99.4682V75.663C275.473 78.9636 280.469 81.6644 287.263 81.6644C301.149 81.6644 310.439 70.6617 310.439 55.7584C310.439 41.1553 302.148 30.1528 287.762 30.1528C280.37 30.1528 274.875 33.4534 272.677 37.2544V31.253H259.79V99.4682H273.076ZM297.352 55.8585C297.352 64.6606 291.958 69.7616 285.164 69.7616C278.372 69.7616 272.877 64.5605 272.877 55.8585C272.877 47.1566 278.372 42.0554 285.164 42.0554C291.958 42.0554 297.352 47.1566 297.352 55.8585Z" fill="#1F1F1F"/>
+<path d="M317.964 67.0609C317.964 74.7627 324.357 81.8643 334.848 81.8643C342.139 81.8643 346.835 78.4634 349.332 74.5625C349.332 76.463 349.532 79.1635 349.832 80.4639H362.02C361.72 78.7635 361.422 75.2627 361.422 72.6622V48.4567C361.422 38.5545 355.627 29.7527 340.043 29.7527C326.855 29.7527 319.761 38.2544 318.963 45.9562L330.751 48.4567C331.151 44.1558 334.348 40.455 340.141 40.455C345.737 40.455 348.434 43.3556 348.434 46.8564C348.434 48.5568 347.536 49.9572 344.738 50.3572L332.65 52.1576C324.458 53.3579 317.964 58.2589 317.964 67.0609ZM337.644 71.962C333.349 71.962 331.25 69.1614 331.25 66.2608C331.25 62.4599 333.947 60.5594 337.345 60.0594L348.434 58.359V60.5594C348.434 69.2615 343.239 71.962 337.644 71.962Z" fill="#1F1F1F"/>
+<path d="M387.703 80.4641V74.4627C390.299 78.6637 395.494 81.6644 402.288 81.6644C416.276 81.6644 425.467 70.5618 425.467 55.6585C425.467 41.0552 417.174 29.9528 402.788 29.9528C395.494 29.9528 390.1 33.1535 387.902 36.6541V8.04785H374.815V80.4641H387.703ZM412.178 55.7584C412.178 64.7605 406.784 69.7616 399.99 69.7616C393.297 69.7616 387.703 64.6606 387.703 55.7584C387.703 46.7564 393.297 41.8554 399.99 41.8554C406.784 41.8554 412.178 46.7564 412.178 55.7584Z" fill="#1F1F1F"/>
+<path d="M432.99 67.0609C432.99 74.7627 439.383 81.8643 449.873 81.8643C457.165 81.8643 461.862 78.4634 464.358 74.5625C464.358 76.463 464.559 79.1635 464.858 80.4639H477.046C476.748 78.7635 476.448 75.2627 476.448 72.6622V48.4567C476.448 38.5545 470.653 29.7527 455.068 29.7527C441.881 29.7527 434.788 38.2544 433.989 45.9562L445.776 48.4567C446.177 44.1558 449.374 40.455 455.167 40.455C460.763 40.455 463.46 43.3556 463.46 46.8564C463.46 48.5568 462.561 49.9572 459.763 50.3572L447.676 52.1576C439.484 53.3579 432.99 58.2589 432.99 67.0609ZM452.671 71.962C448.375 71.962 446.276 69.1614 446.276 66.2608C446.276 62.4599 448.973 60.5594 452.371 60.0594L463.46 58.359V60.5594C463.46 69.2615 458.265 71.962 452.671 71.962Z" fill="#1F1F1F"/>
+<path d="M485.645 66.7608C486.243 72.3621 491.339 81.9642 506.124 81.9642C519.012 81.9642 525.205 73.7624 525.205 65.7607C525.205 58.559 520.311 52.6577 510.62 50.6571L503.626 49.1569C500.929 48.6568 499.132 47.1565 499.132 44.7559C499.132 41.9552 501.928 39.8549 505.425 39.8549C511.021 39.8549 513.118 43.5556 513.519 46.4564L524.607 43.9558C524.007 38.6546 519.312 29.7527 505.326 29.7527C494.735 29.7527 486.944 37.0543 486.944 45.8561C486.944 52.7576 491.238 58.4591 500.73 60.5594L507.224 62.0598C511.021 62.8599 512.519 64.6605 512.519 66.8609C512.519 69.4615 510.421 71.762 506.025 71.762C500.23 71.762 497.334 68.1611 497.034 64.2602L485.645 66.7608Z" fill="#1F1F1F"/>
+<path d="M545.385 50.2571C545.685 45.7562 549.482 40.5549 556.375 40.5549C563.967 40.5549 567.165 45.3561 567.365 50.2571H545.385ZM568.664 63.0601C567.065 67.4609 563.668 70.5617 557.474 70.5617C550.88 70.5617 545.385 65.8606 545.087 59.3593H580.252C580.252 59.159 580.451 57.1587 580.451 55.2582C580.451 39.4547 571.361 29.7527 556.175 29.7527C543.588 29.7527 531.998 39.9548 531.998 55.6584C531.998 72.262 543.886 81.9642 557.374 81.9642C569.462 81.9642 577.255 74.8626 579.753 66.3607L568.664 63.0601Z" fill="#1F1F1F"/>
+<path d="M63.7076 110.284C60.8481 113.885 55.0502 111.912 54.9813 107.314L53.9738 40.0627L99.1935 40.0627C107.384 40.0627 111.952 49.5228 106.859 55.9374L63.7076 110.284Z" fill="url(#paint0_linear)"/>
+<path d="M63.7076 110.284C60.8481 113.885 55.0502 111.912 54.9813 107.314L53.9738 40.0627L99.1935 40.0627C107.384 40.0627 111.952 49.5228 106.859 55.9374L63.7076 110.284Z" fill="url(#paint1_linear)" fill-opacity="0.2"/>
+<path d="M45.317 2.07103C48.1765 -1.53037 53.9745 0.442937 54.0434 5.041L54.4849 72.2922H9.83113C1.64038 72.2922 -2.92775 62.8321 2.1655 56.4175L45.317 2.07103Z" fill="#3ECF8E"/>
+<defs>
+<linearGradient id="paint0_linear" x1="53.9738" y1="54.974" x2="94.1635" y2="71.8295" gradientUnits="userSpaceOnUse">
+<stop stop-color="#249361"/>
+<stop offset="1" stop-color="#3ECF8E"/>
+</linearGradient>
+<linearGradient id="paint1_linear" x1="36.1558" y1="30.578" x2="54.4844" y2="65.0806" gradientUnits="userSpaceOnUse">
+<stop/>
+<stop offset="1" stop-opacity="0"/>
+</linearGradient>
+</defs>
+</svg>
@@ -0,0 +1,40 @@
+db-aggregates-enabled = false
+db-anon-role = ""
+db-channel = "pgrst"
+db-channel-enabled = true
+db-extra-search-path = "public"
+db-hoisted-tx-settings = "statement_timeout,plan_filter.statement_cost_limit,default_transaction_isolation"
+db-max-rows = ""
+db-plan-enabled = false
+db-pool = 10
+db-pool-acquisition-timeout = 10
+db-pool-max-lifetime = 1800
+db-pool-max-idletime = 30
+db-pool-automatic-recovery = true
+db-pre-request = ""
+db-prepared-statements = true
+db-root-spec = ""
+db-schemas = "public"
+db-config = true
+db-pre-config = ""
+db-tx-end = "commit"
+db-uri = "postgresql://"
+jwt-aud = ""
+jwt-role-claim-key = ".\"role\""
+jwt-secret = ""
+jwt-secret-is-base64 = false
+jwt-cache-max-lifetime = 0
+log-level = "crit"
+log-query = "disabled"
+openapi-mode = "follow-privileges"
+openapi-security-active = false
+openapi-server-proxy-uri = ""
+server-cors-allowed-origins = ""
+server-host = "!4"
+server-port = 3000
+server-trace-header = ""
+server-timing-enabled = false
+server-unix-socket = ""
+server-unix-socket-mode = "660"
+admin-server-host = "!4"
+admin-server-port = ""
@@ -0,0 +1,2 @@
+# Commènt utf-8 chàrs
+log-level = "crit"
@@ -93,6 +93,9 @@ def test_jwt_errors(defaultenv):
        response = postgrest.session.get("/", headers=headers)
        assert response.status_code == 401
        assert response.json()["message"] == "No suitable key or wrong key type"
+        assert (
+            response.json()["details"] == "None of the keys was able to decode the JWT"
+        )

        headers = jwtauthheader({"role": "not_existing"}, SECRET)
        response = postgrest.session.get("/", headers=headers)
@@ -141,6 +144,10 @@ def test_jwt_errors(defaultenv):
        response = postgrest.session.get("/", headers=headers)
        assert response.status_code == 401
        assert response.json()["message"] == "Wrong or unsupported encoding algorithm"
+        assert (
+            response.json()["details"]
+            == "JWT is unsecured but expected 'alg' was not 'none'"
+        )

    env = {
        **defaultenv,
@@ -72,9 +72,9 @@ spec =
          , matchHeaders = []
          }

-      it "fails trying to read table from unkown schema" $
-        request methodGet "/parents" [("Accept-Profile", "unkown")] "" `shouldRespondWith`
-          [json|{"message":"The schema must be one of the following: v1, v2, SPECIAL \"@/\\#~_-","code":"PGRST106","details":null,"hint":null}|]
+      it "fails trying to read table from unknown schema" $
+        request methodGet "/parents" [("Accept-Profile", "unknown")] "" `shouldRespondWith`
+          [json|{"message":"Invalid schema: unknown","code":"PGRST106","details":null,"hint":"Only the following schemas are exposed: v1, v2, SPECIAL \"@/\\#~_-"}|]
          {
            matchStatus = 406
          }
@@ -151,7 +151,7 @@ spec =
        request methodPost "/children" [("Content-Profile", "unknown")]
          [json|{"name": "child 4", "parent_id": 4}|]
          `shouldRespondWith`
-          [json|{"message":"The schema must be one of the following: v1, v2, SPECIAL \"@/\\#~_-","code":"PGRST106","details":null,"hint":null}|]
+          [json|{"message":"Invalid schema: unknown","code":"PGRST106","details":null,"hint":"Only the following schemas are exposed: v1, v2, SPECIAL \"@/\\#~_-"}|]
          {
            matchStatus = 406
          }
@@ -389,9 +389,9 @@ spec =
          let def = simpleBody r ^? key "definitions" . key "another_table"
          def `shouldBe` Nothing

-      it "fails trying to read definitions from unkown schema" $
-        request methodGet "/" [("Accept-Profile", "unkown")] "" `shouldRespondWith`
-          [json|{"message":"The schema must be one of the following: v1, v2, SPECIAL \"@/\\#~_-","code":"PGRST106","details":null,"hint":null}|]
+      it "fails trying to read definitions from unknown schema" $
+        request methodGet "/" [("Accept-Profile", "unknown")] "" `shouldRespondWith`
+          [json|{"message":"Invalid schema: unknown","code":"PGRST106","details":null,"hint":"Only the following schemas are exposed: v1, v2, SPECIAL \"@/\\#~_-"}|]
          {
            matchStatus = 406
          }
Author	SHA1	Message	Date
renovate[bot]andWolfgang Walther	feb83a8519	chore(deps): update actions/checkout action to v7.0.1	2026-07-23 20:11:44 +00:00
ncikandWolfgang Walther	835afbd383	docs: fix example jwt expiration epoch Issue: the example epoch date is wrapped in parentheses. This causes the server to return PGRST303: "The JWT 'exp' claim must be a number" Fix: remove parentheses (cherry picked from commit `69d21a82c9`)	2026-07-02 10:57:21 +02:00
renovate[bot]andWolfgang Walther	bcae4a366f	chore(deps): update all dependencies	2026-06-19 19:07:40 +00:00
renovate[bot]andWolfgang Walther	cf53fd5e1b	chore(deps): update all dependencies to v6.0.3	2026-06-03 07:40:07 +00:00
renovate[bot]andWolfgang Walther	74db7b7185	chore(deps): update cachix/cachix-action digest to 5f2d7c5	2026-05-12 13:10:49 +00:00
Wolfgang Walther	2a7a62ecc0	docs: fix broken link	2026-04-15 09:30:17 +02:00
renovate[bot]andWolfgang Walther	422c2934a2	chore(deps): update cachix/cachix-action action to v17	2026-03-18 21:24:19 +00:00
Wolfgang Walther	565b644951	ci: remove unused Dockerfile This was used by CI, which is disabled on this branch. Removing to prevent useless auto-updates by renovate.	2026-03-17 11:19:09 +01:00
renovate[bot]andWolfgang Walther	a4b1957981	chore(deps): update all dependencies	2026-03-13 14:06:25 +00:00
Wolfgang Walther	bbce632fc2	ci: remove all CI except docs We don't need to run full CI on the outdated and finished v13 branch anymore. We did the same thing to other branches in the past.	2026-03-13 15:01:51 +01:00
Wolfgang Walther	f6e44aa7e2	docs: fix prometheus text format link Reported by linkcheck.	2026-03-11 09:45:36 +01:00
dshukertjrandWolfgang Walther	8e728596b9	docs: Update the Supabase logo to a correct one	2026-02-19 10:53:22 +01:00
Wolfgang Walther	54490c4d22	docs: fix links datrium.com doesn't exist anymore, while euronodes.com seems to only fail SSL in CI.	2026-01-28 09:57:34 +01:00
renovate[bot]andWolfgang Walther	c1a1d3ae66	chore(deps): update haskell-actions/setup action to v2.10.2	2026-01-11 17:35:40 +00:00
renovate[bot]andWolfgang Walther	e10b027b10	chore(deps): update haskell-actions/setup action to v2.10.1	2026-01-05 19:01:54 +00:00
renovate[bot]andWolfgang Walther	fe64548aba	chore(deps): update docker/setup-buildx-action action to v3.12.0	2025-12-20 20:24:42 +00:00
renovate[bot]andWolfgang Walther	577fa9446f	chore(deps): update haskell-actions/setup action to v2.9.1	2025-12-17 18:01:20 +00:00
renovate[bot]andWolfgang Walther	dd2eafe9cc	chore(deps): update haskell-actions/setup action to v2.9.0	2025-12-15 21:01:30 +00:00
renovate[bot]andWolfgang Walther	d1abfa0c89	chore(deps): update actions/cache action to v5.0.1	2025-12-13 17:12:46 +00:00
renovate[bot]andWolfgang Walther	627df4dfb4	chore(deps): update all dependencies	2025-12-13 17:12:15 +00:00
renovate[bot]andWolfgang Walther	eb54461e73	chore(deps): update actions/cache action to v5	2025-12-12 08:29:08 +00:00
renovate[bot]andWolfgang Walther	e84aa247fc	chore(deps): update codecov/codecov-action action to v5.5.2	2025-12-10 12:24:30 +00:00
renovate[bot]andWolfgang Walther	e232a7bd78	chore(deps): update actions/checkout action to v6	2025-12-03 13:52:39 +00:00
Wolfgang Walther	aaf4bd8510	ci/test: remove macos x86 flake check See previous commit.	2025-11-18 11:05:49 +01:00
renovate[bot]andWolfgang Walther	5997949ac4	chore(deps): update actions/checkout action to v5.0.1	2025-11-18 10:04:37 +00:00
Wolfgang Walther	5c527b50c2	ci: remove macos x86 builds The x86 GitHub runner will not be available anymore, soon. We might be able to re-introduce this, once we can build a static executable via Nix on darwin, too.	2025-11-18 11:01:53 +01:00
renovate[bot]andWolfgang Walther	8bdef234c6	chore(deps): update ubuntu:noble docker digest to c35e29c	2025-11-15 13:52:14 +00:00
renovate[bot]andWolfgang Walther	07e23ff3c8	chore(deps): update all dependencies	2025-10-25 08:12:59 +00:00
steve-chavez	f9e1af2fa5	bump version to 13.0.8	2025-10-24 13:43:50 -05:00
Taimoor ZaeemandWolfgang Walther	c5af0cc3f9	fix: loading utf-8 config files with ascii locale set Updates configurator-pg to version 0.2.11. This resolves #4386. Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>	2025-10-24 17:58:09 +00:00
renovate[bot]andWolfgang Walther	aa34503ce0	chore(deps): update ubuntu:noble docker digest to 66460d5	2025-10-13 10:35:46 +00:00
renovate[bot]andWolfgang Walther	f1584c1e7e	chore(deps): update ubuntu:noble docker digest to 59a458b	2025-10-10 07:33:40 +00:00
renovate[bot]andWolfgang Walther	e02461d457	chore(deps): update ubuntu:noble docker digest to 728785b	2025-10-03 13:34:36 +00:00
renovate[bot]andWolfgang Walther	2d73644e71	chore(deps): update ubuntu:noble docker digest to fdb6c9c	2025-10-02 10:04:17 +00:00
renovate[bot]andWolfgang Walther	a77d9d5b2d	chore(deps): update all dependencies	2025-10-02 09:24:49 +00:00
renovate[bot]andWolfgang Walther	e6a2551813	chore(deps): update all dependencies	2025-10-02 09:23:44 +00:00
renovate[bot]andWolfgang Walther	8ceffa0efc	chore(deps): update nixbuild/nix-quick-install-action action to v34	2025-09-25 08:51:14 +00:00
renovate[bot]andWolfgang Walther	2f62bee183	chore(deps): update actions/cache action to v4.3.0	2025-09-25 08:22:00 +00:00
renovate[bot]andWolfgang Walther	308c2a789a	chore(deps): update ubuntu:noble docker digest to 353675e	2025-09-17 10:32:14 +00:00
renovate[bot]andWolfgang Walther	151002a7e0	chore(deps): update haskell-actions/setup action to v2.8.2	2025-09-16 19:13:05 +00:00
renovate[bot]andWolfgang Walther	81ef374723	chore(deps): update ubuntu:noble docker digest to 590e57a	2025-09-16 09:36:58 +00:00
steve-chavez	e30bc63f49	bump version to 13.0.7	2025-09-14 14:08:53 -05:00
Taimoor ZaeemandSteve Chavez	a8f40c4908	feat: improve error details of PGRST301 error	2025-09-14 13:37:17 -05:00
Taimoor ZaeemandSteve Chavez	75972e9ffe	refactor: move jwt error messages to Error.hs module	2025-09-14 13:37:17 -05:00
Laurence IslaandSteve Chavez	4ba6b1b30c	feat: improve error response when the requested schema is invalid - It now shows the invalid schema in the "message" - The exposed schemas are now listed in the "hint" instead of the "message"	2025-09-14 13:37:17 -05:00
renovate[bot]andWolfgang Walther	a4927141ee	chore(deps): update codecov/codecov-action action to v5.5.1	2025-09-04 19:25:55 +00:00
renovate[bot]andWolfgang Walther	1b353590ff	chore(deps): update ubuntu:noble docker digest to 9cbed75	2025-09-03 12:50:39 +00:00
renovate[bot]andWolfgang Walther	394aa026d3	chore(deps): update ubuntu:noble docker digest to f3b7f1b	2025-09-02 08:18:24 +00:00