ENG-925 Upgrade supabase JWT keys by maparent · Pull Request #752 · DiscourseGraphs/discourse-graph

maparent · 2026-02-06T17:30:50Z

https://linear.app/discourse-graphs/issue/ENG-925/upgrade-supabase-jwt-keys

Status: This is now functional. We have to decide when to do it.
It is not urgent, but the work was done, and is worth using, since it is where supabase wants us to go.

The upsides are better key management and revocation.
The downside is that, when we change the keys, we have to change the function secrets. Supabase claims this may be automated someday.

https://github.com/supabase/supabase/blob/037e5f90a5689c3d847bd2adf9c8ec3956a0e7a0/apps/docs/content/guides/functions/auth.mdx

linear · 2026-02-06T17:30:54Z

ENG-925 Upgrade supabase JWT keys

supabase · 2026-02-06T17:31:03Z

Updates to Preview Branch (eng-925-upgrade-supabase-jwt-keys) ↗︎

Deployments	Status	Updated
Database	✅	Sat, 14 Feb 2026 00:47:53 UTC
Services	✅	Sat, 14 Feb 2026 00:47:53 UTC
APIs	✅	Sat, 14 Feb 2026 00:47:53 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Sat, 14 Feb 2026 00:47:53 UTC
Migrations	✅	Sat, 14 Feb 2026 00:47:54 UTC
Seeding	✅	Sat, 14 Feb 2026 00:47:54 UTC
Edge Functions	✅	Sat, 14 Feb 2026 00:47:56 UTC

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

devin-ai-integration

Devin Review found 3 potential issues.

View 5 additional findings in Devin Review.

packages/database/supabase/functions/create-space/index.ts

packages/database/supabase/functions/create-group/index.ts

devin-ai-integration · 2026-02-06T17:33:38Z

packages/database/src/dbDotEnv.mjs

 export const getVariant = () => {
  const processHasVars =
-    !!process.env["SUPABASE_URL"] && !!process.env["SUPABASE_ANON_KEY"];
+    !!process.env["SUPABASE_URL"] && !!process.env["SUPABASE_PUBLISHABLE_KEY"];


🔴 Local env generation produces SUPABASE_ANON_KEY but code expects SUPABASE_PUBLISHABLE_KEY

The createEnv.mts script generates local environment files by running supabase status -o env and prefixing variables with SUPABASE_. Supabase outputs ANON_KEY, which becomes SUPABASE_ANON_KEY. However, the PR changed all code to expect SUPABASE_PUBLISHABLE_KEY instead.

Root Cause

In packages/database/scripts/createEnv.mts:37-45, the script transforms supabase output:

const prefixed = stdout .split("\n") .map((line) => /^API_URL=/.test(line) ? `SUPABASE_URL=${line.substring(8)}` : `SUPABASE_${line}`, )

This produces SUPABASE_ANON_KEY from supabase's ANON_KEY output, but packages/database/src/dbDotEnv.mjs:20 and packages/database/src/dbDotEnv.mjs:77 now check for SUPABASE_PUBLISHABLE_KEY.

Impact: Local development will fail because SUPABASE_PUBLISHABLE_KEY will be undefined, causing the database connection to fail with "Missing required Supabase environment variables".

Prompt for agents

Update packages/database/scripts/createEnv.mts to transform ANON_KEY to SUPABASE_PUBLISHABLE_KEY instead of SUPABASE_ANON_KEY. In the makeLocalEnv function around line 37-45, add a transformation that converts ANON_KEY= to PUBLISHABLE_KEY= before prefixing with SUPABASE_, similar to how API_URL is handled. The transformation should result in SUPABASE_PUBLISHABLE_KEY being written to the .env.local file.

Was this helpful? React with 👍 or 👎 to provide feedback.

Supabase outputs both the ANON_KEY and the PUBLISHABLE_KEY, once the latter have been set up.

devin-ai-integration

Devin Review found 2 new potential issues.

View 6 additional findings in Devin Review.

packages/database/supabase/functions/create-space/index.ts

packages/database/supabase/functions/create-group/index.ts

devin-ai-integration

Devin Review found 2 new potential issues.

View 6 additional findings in Devin Review.

packages/database/supabase/functions/create-group/index.ts

packages/database/supabase/functions/create-space/index.ts

devin-ai-integration

Devin Review found 1 new potential issue.

View 7 additional findings in Devin Review.

packages/database/scripts/createEnv.mts

devin-ai-integration

Devin Review found 3 new potential issues.

🐛 1 issue in files not directly in the diff

🐛 `/api/supabase/env` route still returns `SUPABASE_ANON_KEY` but consumers expect `SUPABASE_PUBLISHABLE_KEY` (`apps/website/app/api/supabase/env/route.ts:9-14`)

The env API route was not migrated to the new key name, breaking the Roam production build pipeline.

Root Cause

apps/website/app/api/supabase/env/route.ts:9-14 still destructures and returns SUPABASE_ANON_KEY from process.env. This endpoint is called during the Roam build (packages/database/scripts/createEnv.mts:131), which fetches from https://discoursegraphs.com/api/supabase/env and writes the result to .env. The .env file will therefore contain SUPABASE_ANON_KEY=....

When envContents() at packages/database/src/dbDotEnv.mjs:82-83 reads and parses this file, the result will have SUPABASE_ANON_KEY as a key. But the compile scripts (apps/roam/scripts/compile.ts:165, apps/obsidian/scripts/compile.ts:126) now access dbEnv.SUPABASE_PUBLISHABLE_KEY, which will be undefined.

Impact: The Roam and Obsidian production builds (when triggered via ROAM_BUILD_SCRIPT) will embed null for the Supabase key, breaking all Supabase client initialization in the built extensions.

View 9 additional findings in Devin Review.

packages/database/scripts/createEnv.mts

packages/database/supabase/config.toml

devin-ai-integration

Devin Review found 1 new potential issue.

View 11 additional findings in Devin Review.

apps/website/app/api/supabase/env/route.ts

graphite-app · 2026-02-14T00:51:16Z

packages/database/supabase/functions/create-space/index.ts

+  const supabaseAnonClient: DGSupabaseClient = createClient(
+    url, token, { global: { headers: { Authorization: authHeader } } });


Critical Bug: The createClient call is passing the user's JWT token as the second parameter, but this parameter expects the Supabase anon/publishable key, not a user token. This will fail to create a valid Supabase client.

The token is already being passed in the Authorization header via options. The second parameter should be the SB_PUBLISHABLE_KEY from environment variables.

const anonKey = Deno.env.get("SB_PUBLISHABLE_KEY"); if (!anonKey) { return Response.json( { msg: 'Missing SB_PUBLISHABLE_KEY' }, { status: 500 } ) } const supabaseAnonClient: DGSupabaseClient = createClient( url, anonKey, { global: { headers: { Authorization: authHeader } } });

Suggested change

const supabaseAnonClient: DGSupabaseClient = createClient(

url, token, { global: { headers: { Authorization: authHeader } } });

const anonKey = Deno.env.get("SB_PUBLISHABLE_KEY");

if (!anonKey) {

return Response.json(

{ msg: 'Missing SB_PUBLISHABLE_KEY' },

{ status: 500 }

)

}

const supabaseAnonClient: DGSupabaseClient = createClient(

url, anonKey, { global: { headers: { Authorization: authHeader } } });

Spotted by Graphite Agent

Is this helpful? React 👍 or 👎 to let us know.

devin-ai-integration bot reviewed Feb 6, 2026

View reviewed changes

packages/database/supabase/functions/create-space/index.ts Outdated Show resolved Hide resolved

packages/database/supabase/functions/create-group/index.ts Outdated Show resolved Hide resolved

devin-ai-integration bot reviewed Feb 6, 2026

View reviewed changes

packages/database/supabase/functions/create-group/index.ts Show resolved Hide resolved

packages/database/supabase/functions/create-space/index.ts Show resolved Hide resolved

devin-ai-integration bot reviewed Feb 6, 2026

View reviewed changes

packages/database/scripts/createEnv.mts Show resolved Hide resolved

graphite-app bot reviewed Feb 6, 2026

View reviewed changes

packages/database/scripts/createEnv.mts Show resolved Hide resolved

maparent force-pushed the eng-925-upgrade-supabase-jwt-keys branch 2 times, most recently from 99e4c4b to bc00faa Compare February 7, 2026 18:11

devin-ai-integration bot reviewed Feb 7, 2026

View reviewed changes

packages/database/scripts/createEnv.mts Show resolved Hide resolved

packages/database/supabase/config.toml Show resolved Hide resolved

devin-ai-integration bot reviewed Feb 7, 2026

View reviewed changes

apps/website/app/api/supabase/env/route.ts Outdated Show resolved Hide resolved

maparent force-pushed the eng-925-upgrade-supabase-jwt-keys branch 2 times, most recently from f02939d to 7a7feac Compare February 12, 2026 19:56

maparent requested a review from mdroidian February 12, 2026 22:23

mdroidian approved these changes Feb 13, 2026

View reviewed changes

maparent added 8 commits February 13, 2026 19:45

ENG-925: Migrate to new JWT tokens

fad28f3

clean from previous experiment

e7f9da0

use keys from function secrets

68b3e04

Make keys available to local edge functions

be52a84

Handle absence of authorization headers

c958756

include changes in eng-1395

2a3e1b6

JWT key documentation

67b12c0

Check the incoming anonymous token in create-space

6341a73

maparent force-pushed the eng-925-upgrade-supabase-jwt-keys branch from 631abef to 6341a73 Compare February 14, 2026 00:45

let's not break when ANON_KEY is fully gone'

491651a

maparent merged commit 38fd0c1 into main Feb 14, 2026
9 of 10 checks passed

maparent deleted the eng-925-upgrade-supabase-jwt-keys branch February 14, 2026 00:50

graphite-app bot reviewed Feb 14, 2026

View reviewed changes

		const supabaseAnonClient: DGSupabaseClient = createClient(
		url, token, { global: { headers: { Authorization: authHeader } } });

-  const supabaseAnonClient: DGSupabaseClient = createClient(
-    url, token, { global: { headers: { Authorization: authHeader } } });
+  const anonKey = Deno.env.get("SB_PUBLISHABLE_KEY");
+  if (!anonKey) {
+    return Response.json(
+      { msg: 'Missing SB_PUBLISHABLE_KEY' },
+      { status: 500 }
+    )
+  }
+  const supabaseAnonClient: DGSupabaseClient = createClient(
+    url, anonKey, { global: { headers: { Authorization: authHeader } } });

Conversation

maparent commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear bot commented Feb 6, 2026

Uh oh!

supabase bot commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

maparent Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

🐛 /api/supabase/env route still returns SUPABASE_ANON_KEY but consumers expect SUPABASE_PUBLISHABLE_KEY (apps/website/app/api/supabase/env/route.ts:9-14)

Uh oh!

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

graphite-app bot Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maparent commented Feb 6, 2026 •

edited

Loading

supabase bot commented Feb 6, 2026 •

edited

Loading

🐛 `/api/supabase/env` route still returns `SUPABASE_ANON_KEY` but consumers expect `SUPABASE_PUBLISHABLE_KEY` (`apps/website/app/api/supabase/env/route.ts:9-14`)