security(web): remove Supabase publishable key from browser (by Wren)

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.prettierignore

@@ -0,0 +1,6 @@
+node_modules
+.next
+dist
+.yarn
+coverage
+*.lock

package.json

@@ -37,7 +37,8 @@
     "test": "yarn workspaces run test",
     "lint": "yarn workspaces run lint",
     "type-check": "yarn workspaces run type-check",
-    "clean": "yarn workspaces run clean && rm -rf node_modules && pm2 delete all"
+    "clean": "yarn workspaces run clean && rm -rf node_modules && pm2 delete all",
+    "prepare": "husky"
   },
   "engines": {
     "node": ">=18.0.0",
@@ -57,7 +58,13 @@
   "author": "",
   "license": "MIT",
   "devDependencies": {
-    "pm2": "^6.0.14"
+    "husky": "^9.1.7",
+    "lint-staged": "^16.2.7",
+    "pm2": "^6.0.14",
+    "prettier": "^3.8.1"
+  },
+  "lint-staged": {
+    "*.{ts,tsx,js,jsx,json,css,md}": "prettier --write"
   },
   "packageManager": "yarn@4.12.0"
 }

packages/api/src/data/supabase/client.ts

@@ -5,6 +5,19 @@ import type { Database } from './types';
 
 let supabaseClient: SupabaseClient<Database> | null = null;
 
+/**
+ * Singleton Supabase client for PostgREST data queries using the service role key.
+ *
+ * ⚠️  DO NOT call session-mutating auth methods on this client:
+ *     auth.refreshSession(), auth.signIn*(), auth.signUp(), auth.setSession()
+ *
+ * These methods overwrite the Authorization header from service_role to a user JWT,
+ * silently subjecting all subsequent PostgREST queries to RLS. persistSession:false
+ * does NOT prevent this — it only skips disk storage, the in-memory session is still set.
+ *
+ * Safe: .from('table').*, auth.getUser(jwt), auth.admin.*
+ * Ref: https://github.com/orgs/supabase/discussions/30146
+ */
 export function createSupabaseClient(): SupabaseClient<Database> {
   if (supabaseClient) {
     return supabaseClient;
@@ -13,7 +26,7 @@ export function createSupabaseClient(): SupabaseClient<Database> {
   try {
     supabaseClient = createClient<Database>(env.SUPABASE_URL, env.SUPABASE_SECRET_KEY, {
       auth: {
-        autoRefreshToken: true,
+        autoRefreshToken: false,
         persistSession: false,
       },
     });

packages/api/src/data/supabase/types.ts

@@ -1,6 +1,3 @@
-// Database types - Auto-generated from Supabase schema
-// Run `mcp__supabase__generate_typescript_types` to regenerate
-
 export type Json =
   | string
   | number
@@ -410,7 +407,6 @@ export type Database = {
           change_summary: string | null
           change_type: string | null
           changed_by_agent_id: string | null
-          changed_by_identity_id: string | null
           changed_by_user_id: string | null
           content: string
           created_at: string | null
@@ -423,7 +419,6 @@ export type Database = {
           change_summary?: string | null
           change_type?: string | null
           changed_by_agent_id?: string | null
-          changed_by_identity_id?: string | null
           changed_by_user_id?: string | null
           content: string
           created_at?: string | null
@@ -436,7 +431,6 @@ export type Database = {
           change_summary?: string | null
           change_type?: string | null
           changed_by_agent_id?: string | null
-          changed_by_identity_id?: string | null
           changed_by_user_id?: string | null
           content?: string
           created_at?: string | null
@@ -459,84 +453,6 @@ export type Database = {
             referencedRelation: "users"
             referencedColumns: ["id"]
           },
-          {
-            foreignKeyName: "artifact_history_changed_by_identity_id_fkey"
-            columns: ["changed_by_identity_id"]
-            isOneToOne: false
-            referencedRelation: "agent_identities"
-            referencedColumns: ["id"]
-          },
-        ]
-      }
-      artifact_comments: {
-        Row: {
-          artifact_id: string
-          content: string
-          created_at: string | null
-          created_by_agent_id: string | null
-          created_by_identity_id: string | null
-          deleted_at: string | null
-          id: string
-          metadata: Json | null
-          parent_comment_id: string | null
-          updated_at: string | null
-          user_id: string
-        }
-        Insert: {
-          artifact_id: string
-          content: string
-          created_at?: string | null
-          created_by_agent_id?: string | null
-          created_by_identity_id?: string | null
-          deleted_at?: string | null
-          id?: string
-          metadata?: Json | null
-          parent_comment_id?: string | null
-          updated_at?: string | null
-          user_id: string
-        }
-        Update: {
-          artifact_id?: string
-          content?: string
-          created_at?: string | null
-          created_by_agent_id?: string | null
-          created_by_identity_id?: string | null
-          deleted_at?: string | null
-          id?: string
-          metadata?: Json | null
-          parent_comment_id?: string | null
-          updated_at?: string | null
-          user_id?: string
-        }
-        Relationships: [
-          {
-            foreignKeyName: "artifact_comments_artifact_id_fkey"
-            columns: ["artifact_id"]
-            isOneToOne: false
-            referencedRelation: "artifacts"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "artifact_comments_created_by_identity_id_fkey"
-            columns: ["created_by_identity_id"]
-            isOneToOne: false
-            referencedRelation: "agent_identities"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "artifact_comments_parent_comment_id_fkey"
-            columns: ["parent_comment_id"]
-            isOneToOne: false
-            referencedRelation: "artifact_comments"
-            referencedColumns: ["id"]
-          },
-          {
-            foreignKeyName: "artifact_comments_user_id_fkey"
-            columns: ["user_id"]
-            isOneToOne: false
-            referencedRelation: "users"
-            referencedColumns: ["id"]
-          },
         ]
       }
       artifacts: {
@@ -547,7 +463,6 @@ export type Database = {
           content_type: string | null
           created_at: string | null
           created_by_agent_id: string | null
-          created_by_identity_id: string | null
           id: string
           metadata: Json | null
           tags: string[] | null
@@ -565,7 +480,6 @@ export type Database = {
           content_type?: string | null
           created_at?: string | null
           created_by_agent_id?: string | null
-          created_by_identity_id?: string | null
           id?: string
           metadata?: Json | null
           tags?: string[] | null
@@ -583,7 +497,6 @@ export type Database = {
           content_type?: string | null
           created_at?: string | null
           created_by_agent_id?: string | null
-          created_by_identity_id?: string | null
           id?: string
           metadata?: Json | null
           tags?: string[] | null
@@ -602,13 +515,6 @@ export type Database = {
             referencedRelation: "users"
             referencedColumns: ["id"]
           },
-          {
-            foreignKeyName: "artifacts_created_by_identity_id_fkey"
-            columns: ["created_by_identity_id"]
-            isOneToOne: false
-            referencedRelation: "agent_identities"
-            referencedColumns: ["id"]
-          },
         ]
       }
       audit_log: {
@@ -1136,7 +1042,7 @@ export type Database = {
           last_used_at: string | null
           refresh_token: string
           scopes: string[] | null
-          supabase_refresh_token: string
+          supabase_refresh_token: string | null
           updated_at: string | null
           user_id: string
         }
@@ -1148,7 +1054,7 @@ export type Database = {
           last_used_at?: string | null
           refresh_token: string
           scopes?: string[] | null
-          supabase_refresh_token: string
+          supabase_refresh_token?: string | null
           updated_at?: string | null
           user_id: string
         }
@@ -1160,7 +1066,7 @@ export type Database = {
           last_used_at?: string | null
           refresh_token?: string
           scopes?: string[] | null
-          supabase_refresh_token?: string
+          supabase_refresh_token?: string | null
           updated_at?: string | null
           user_id?: string
         }