Reconcile search_schema_health index drift on live Supabase

src/app/api/documents/[id]/route.ts

@@ -8,6 +8,7 @@ import { invalidateRagCachesForDocumentMutation } from "@/lib/rag";
 import { committedIndexGeneration, isCommittedGenerationMetadata } from "@/lib/reindex-pipeline";
 import { createAdminClient } from "@/lib/supabase/admin";
 import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 import { writeAuditLog } from "@/lib/audit";
 import { parseJsonBody } from "@/lib/validation/body";
 import { parseRouteParams } from "@/lib/validation/params";
@@ -280,13 +281,11 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
 
     const { id } = parseRouteParams({ id: rawId }, documentRouteParamsSchema, "Invalid document id.");
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(request, supabase);
-    const { data: document, error } = await supabase
-      .from("documents")
-      .select("*")
-      .eq("id", id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const access = await publicAccessContext(request, supabase);
+    const { data: document, error } = await withOwnerReadScope(
+      supabase.from("documents").select("*").eq("id", id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (error) throw new Error(error.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });

src/app/api/documents/[id]/search/route.ts

@@ -5,7 +5,8 @@ import { isDemoMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
 import { committedIndexGeneration, isCommittedGenerationMetadata } from "@/lib/reindex-pipeline";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 import { parseRouteParams } from "@/lib/validation/params";
 import { parseRequestQuery, queryInteger } from "@/lib/validation/query";
 
@@ -181,13 +182,11 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
 
     const { id } = parseRouteParams({ id: rawId }, documentSearchParamsSchema, "Invalid document id.");
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(request, supabase);
-    const { data: document, error: documentError } = await supabase
-      .from("documents")
-      .select("id,metadata")
-      .eq("id", id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const access = await publicAccessContext(request, supabase);
+    const { data: document, error: documentError } = await withOwnerReadScope(
+      supabase.from("documents").select("id,metadata").eq("id", id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (documentError) throw new Error(documentError.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });
@@ -197,7 +196,7 @@ export async function GET(request: Request, { params }: { params: Promise<{ id:
       p_document_id: id,
       p_query: query,
       match_count: limit,
-      p_owner_id: user.id,
+      p_owner_id: access.ownerId,
     });
 
     if (!rpcError) {

src/app/api/documents/[id]/signed-url/route.ts

@@ -5,7 +5,8 @@ import { env } from "@/lib/env";
 import { isDemoMode } from "@/lib/env";
 import { jsonError, PublicApiError } from "@/lib/http";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 
 export const runtime = "nodejs";
 
@@ -31,13 +32,11 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (!routeIdSchema.safeParse(id).success) throw new PublicApiError("Invalid document id.");
 
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(_request, supabase);
-    const { data: document, error } = await supabase
-      .from("documents")
-      .select("storage_path,file_type")
-      .eq("id", id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const access = await publicAccessContext(_request, supabase);
+    const { data: document, error } = await withOwnerReadScope(
+      supabase.from("documents").select("storage_path,file_type").eq("id", id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (error) throw new Error(error.message);
     if (!document) return NextResponse.json({ error: "Document not found." }, { status: 404 });

src/app/api/documents/route.ts

@@ -4,7 +4,8 @@ import { demoDocuments } from "@/lib/demo-data";
 import { isDemoMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 import { parseRequestQuery, queryBoolean, queryInteger } from "@/lib/validation/query";
 
 export const runtime = "nodejs";
@@ -130,11 +131,11 @@ export async function GET(request: Request) {
     } = parseRequestQuery(request, documentListQuerySchema, "Invalid document list query.");
 
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(request, supabase);
-    let query = supabase
-      .from("documents")
-      .select(DOCUMENT_LIST_COLUMNS, { count: "exact" })
-      .eq("owner_id", user.id)
+    const access = await publicAccessContext(request, supabase);
+    let query = withOwnerReadScope(
+      supabase.from("documents").select(DOCUMENT_LIST_COLUMNS, { count: "exact" }),
+      access.ownerId,
+    )
       .order("created_at", { ascending: false })
       .range(offset, offset + limit - 1);
 

src/app/api/images/[id]/signed-url/route.ts

@@ -6,7 +6,8 @@ import { isDemoMode } from "@/lib/env";
 import { jsonError, PublicApiError } from "@/lib/http";
 import { committedIndexGeneration, isCommittedGenerationMetadata } from "@/lib/reindex-pipeline";
 import { createAdminClient } from "@/lib/supabase/admin";
-import { AuthenticationError, requireAuthenticatedUser, unauthorizedResponse } from "@/lib/supabase/auth";
+import { AuthenticationError, unauthorizedResponse } from "@/lib/supabase/auth";
+import { publicAccessContext, withOwnerReadScope } from "@/lib/public-api-access";
 
 export const runtime = "nodejs";
 
@@ -31,7 +32,7 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (!routeIdSchema.safeParse(id).success) throw new PublicApiError("Invalid image id.");
 
     const supabase = createAdminClient();
-    const user = await requireAuthenticatedUser(_request, supabase);
+    const access = await publicAccessContext(_request, supabase);
     const { data: image, error } = await supabase
       .from("document_images")
       .select("document_id,storage_path,mime_type,caption,metadata")
@@ -41,12 +42,10 @@ export async function GET(_request: Request, { params }: { params: Promise<{ id:
     if (error) throw new Error(error.message);
     if (!image) return NextResponse.json({ error: "Image not found." }, { status: 404 });
 
-    const { data: document, error: documentError } = await supabase
-      .from("documents")
-      .select("id,metadata")
-      .eq("id", image.document_id)
-      .eq("owner_id", user.id)
-      .maybeSingle();
+    const { data: document, error: documentError } = await withOwnerReadScope(
+      supabase.from("documents").select("id,metadata").eq("id", image.document_id),
+      access.ownerId,
+    ).maybeSingle();
 
     if (documentError) throw new Error(documentError.message);
     if (!document) return NextResponse.json({ error: "Image not found." }, { status: 404 });

src/app/api/registry/records/[slug]/route.ts

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { consumeSubjectApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
-import { publicAccessContext } from "@/lib/public-api-access";
+import { hasPublicApiAuthSignal, publicAccessContext } from "@/lib/public-api-access";
 import { getFormRecord } from "@/lib/forms";
 import {
   deriveGovernanceColumns,
@@ -62,6 +62,15 @@ export async function GET(request: Request, context: { params: Promise<{ slug: s
       });
     }
 
+    if (!hasPublicApiAuthSignal(request)) {
+      const payload = publicRegistryDetailPayload(kind, normalizedSlug);
+      if (!payload) return notFoundResponse(normalizedSlug);
+      return registryResponse({
+        ...payload,
+        publicAccess: true,
+      });
+    }
+
     const supabase = createAdminClient();
     const access = await publicAccessContext(request, supabase);
 

src/app/api/registry/records/route.ts

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { consumeSubjectApiRateLimit, rateLimitJsonResponse } from "@/lib/api-rate-limit";
 import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
 import { jsonError } from "@/lib/http";
-import { publicAccessContext } from "@/lib/public-api-access";
+import { hasPublicApiAuthSignal, publicAccessContext } from "@/lib/public-api-access";
 import { rankFormRecords, formRecords } from "@/lib/forms";
 import {
   deriveGovernanceColumns,
@@ -78,6 +78,13 @@ export async function GET(request: Request) {
       });
     }
 
+    if (!hasPublicApiAuthSignal(request)) {
+      return registryResponse({
+        ...publicRegistryPayload(kind, q, limit),
+        publicAccess: true,
+      });
+    }
+
     const supabase = createAdminClient();
     const access = await publicAccessContext(request, supabase);
 

src/components/DocumentViewer.tsx

@@ -1914,7 +1914,6 @@ export function DocumentViewer({
   const [documentSearchError, setDocumentSearchError] = useState<string | null>(null);
   const [reviewingTableFactId, setReviewingTableFactId] = useState<string | null>(null);
   const [isOnline, setIsOnline] = useState(true);
-  const [authLoadingTimedOut, setAuthLoadingTimedOut] = useState(false);
   const [localProjectReady, setLocalProjectReady] = useState(true);
   const [mobileActionsOpen, setMobileActionsOpen] = useState(false);
   const [useNativePdfViewer, setUseNativePdfViewer] = useState(() => getInitialPdfViewerMode().useNativePdfViewer);
@@ -1927,6 +1926,7 @@ export function DocumentViewer({
   const [serverDemoMode, setServerDemoMode] = useState(process.env.NEXT_PUBLIC_DEMO_MODE === "true");
   const localNoAuthMode = isLocalNoAuthMode();
   const clientDemoMode = localNoAuthMode || serverDemoMode;
+  const canViewSourceDocuments = localProjectReady;
   const canUsePrivateApis = localProjectReady && (clientDemoMode || authStatus === "authenticated");
 
   useEffect(() => {
@@ -2002,10 +2002,10 @@ export function DocumentViewer({
   }, [isConfigured]);
 
   useEffect(() => {
-    if (!canUsePrivateApis && authStatus === "loading") {
+    if (!canViewSourceDocuments && authStatus === "loading") {
       return () => undefined;
     }
-    if (!canUsePrivateApis) {
+    if (!canViewSourceDocuments) {
       return () => undefined;
     }
 
@@ -2141,7 +2141,7 @@ export function DocumentViewer({
   }, [
     authStatus,
     authorizationHeader,
-    canUsePrivateApis,
+    canViewSourceDocuments,
     clientDemoMode,
     documentId,
     chunkId,
@@ -2208,15 +2208,6 @@ export function DocumentViewer({
     };
   }, []);
 
-  useEffect(() => {
-    if (canUsePrivateApis || authStatus !== "loading") {
-      return () => undefined;
-    }
-
-    const timeout = window.setTimeout(() => setAuthLoadingTimedOut(true), 3000);
-    return () => window.clearTimeout(timeout);
-  }, [authStatus, canUsePrivateApis]);
-
   async function summarize() {
     if (!canSummarizeDocument) {
       setSummaryError("Load a source document before summarising.");
@@ -2247,15 +2238,8 @@ export function DocumentViewer({
     }
   }
 
-  const authViewerError =
-    !canUsePrivateApis && (authStatus !== "loading" || authLoadingTimedOut)
-      ? isConfigured
-        ? "Sign in to open private source documents."
-        : "Supabase browser authentication is not configured for private source documents."
-      : null;
-  const effectiveLoadingDocument = !canUsePrivateApis
-    ? authStatus === "loading" && !authLoadingTimedOut && loadingDocument
-    : loadingDocument;
+  const authViewerError = null;
+  const effectiveLoadingDocument = loadingDocument;
   const effectiveViewerError = authViewerError ?? viewerError;
   const viewerState = effectiveLoadingDocument
     ? "loading"

src/lib/public-api-access.ts

@@ -33,6 +33,17 @@ export function hasPublicApiAuthSignal(request: Request) {
   return cookieHeader.includes("sb-");
 }
 
+type OwnerScopedQuery<T> = {
+  eq(column: string, value: unknown): T;
+  is(column: string, value: null): T;
+};
+
+/** Scope document reads to the authenticated owner or public (owner_id IS NULL) rows. */
+export function withOwnerReadScope<T extends OwnerScopedQuery<T>>(query: T, ownerId: string | undefined): T {
+  if (ownerId) return query.eq("owner_id", ownerId);
+  return query.is("owner_id", null);
+}
+
 export async function publicAccessContext(request: Request, supabase: AdminClient) {
   const user = await getOptionalAuthenticatedUser(request, supabase);
   if (user) {

src/lib/supabase/auth.ts

@@ -128,10 +128,10 @@ export async function getOptionalAuthenticatedUser(
   const token = extractSessionAccessToken(request);
   if (token) {
     const { data, error } = await supabase.auth.getUser(token);
-    if (error || !data.user?.id) {
-      throw new AuthenticationError();
+    if (!error && data.user?.id) {
+      return { id: data.user.id };
     }
-    return { id: data.user.id };
+    // Invalid or expired Bearer token: fall through to cookie session, then anonymous.
   }
 
   return getUserFromRequestCookies(request);