Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/mobile/__tests__/lib/google-auth.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@ vi.mock('@/lib/api-client', () => ({
}))

vi.mock('@/lib/supabase', () => ({
supabase: {
getSupabaseClient: () => ({
auth: {
setSession: setSessionMock,
signOut: signOutMock,
},
},
}),
}))

vi.mock('expo-web-browser', () => ({
Expand Down
8 changes: 4 additions & 4 deletions apps/mobile/lib/google-auth.ts
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ import {
markPendingGoogleAuthSession,
setPendingGoogleAuthCallbackUrl,
} from './google-auth-callback'
import { supabase } from './supabase'
import { getSupabaseClient } from './supabase'

export type MobileGoogleAuthResult =
| { type: 'success'; url: string }
Expand Down Expand Up @@ -66,7 +66,7 @@ export async function completeGoogleAuthFromUrl(
throw new Error('Authentication failed')
}

const { data, error } = await supabase.auth.setSession({
const { data, error } = await getSupabaseClient().auth.setSession({
access_token: params.access_token,
refresh_token: params.refresh_token,
})
Expand All @@ -84,7 +84,7 @@ export async function completeGoogleAuthFromUrl(
params.provider_refresh_token,
)
} finally {
await supabase.auth.signOut().catch(() => {})
await getSupabaseClient().auth.signOut().catch(() => {})
}
}

Expand All @@ -103,7 +103,7 @@ export async function startMobileGoogleAuth({

try {
const redirectTo = getGoogleAuthRedirectUrl()
const { data, error } = await supabase.auth.signInWithOAuth({
const { data, error } = await getSupabaseClient().auth.signInWithOAuth({
provider: 'google',
options: buildGoogleCalendarOAuthOptions({
redirectTo,
Expand Down
39 changes: 23 additions & 16 deletions apps/mobile/lib/supabase.ts
Original file line number Diff line number Diff line change
@@ -1,28 +1,35 @@
import 'react-native-url-polyfill/auto'
import 'expo-sqlite/localStorage/install'

import { createClient } from '@supabase/supabase-js'
import { createClient, type SupabaseClient } from '@supabase/supabase-js'

interface SupabaseStorageAdapter {
getItem: (key: string) => string | null
setItem: (key: string, value: string) => void
removeItem: (key: string) => void
}

const SUPABASE_URL = process.env.EXPO_PUBLIC_SUPABASE_URL
const SUPABASE_PUBLISHABLE_KEY = process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY
const SUPABASE_URL =
process.env.EXPO_PUBLIC_SUPABASE_URL ?? 'https://wdscxamegetmhqldqsdg.supabase.co'
const SUPABASE_PUBLISHABLE_KEY =
process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY ??
'sb_publishable_CGlL4PSxvp2Ia0SCHcathQ_iAQnmXis'
Comment on lines +12 to +16

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CLAUDE.md rule 7 violation — hardcoded fallbacks mask a config bug.

process.env.X ?? 'hardcoded-default' is explicitly banned by the root CLAUDE.md workaround list. If the build ever points at a different Supabase project these values will silently be wrong instead of erroring loudly.

The root-cause fix is to ensure EXPO_PUBLIC_SUPABASE_URL and EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY are present in every build context (.env, EAS Build environment variables, or app.json extra), then restore the hard throw:

Suggested change
const SUPABASE_URL =
process.env.EXPO_PUBLIC_SUPABASE_URL ?? 'https://wdscxamegetmhqldqsdg.supabase.co'
const SUPABASE_PUBLISHABLE_KEY =
process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY ??
'sb_publishable_CGlL4PSxvp2Ia0SCHcathQ_iAQnmXis'
const SUPABASE_URL = process.env.EXPO_PUBLIC_SUPABASE_URL
const SUPABASE_PUBLISHABLE_KEY = process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY

and inside getSupabaseClient(), before createClient:

if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
  throw new Error('Supabase config missing')
}

Comment on lines +12 to +16

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This pattern is still present and still violates CLAUDE.md rule 7: process.env.X ?? 'hardcoded-value' is explicitly banned as a hardcoded fallback masking a config bug.

The root cause is that EXPO_PUBLIC_SUPABASE_URL and EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY are not set in the EAS Build environment. The correct fix is to add those vars to EAS (via eas.json env block or the Expo dashboard secrets), then restore the hard throw:

Suggested change
const SUPABASE_URL =
process.env.EXPO_PUBLIC_SUPABASE_URL ?? 'https://wdscxamegetmhqldqsdg.supabase.co'
const SUPABASE_PUBLISHABLE_KEY =
process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY ??
'sb_publishable_CGlL4PSxvp2Ia0SCHcathQ_iAQnmXis'
const SUPABASE_URL = process.env.EXPO_PUBLIC_SUPABASE_URL
const SUPABASE_PUBLISHABLE_KEY = process.env.EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY
if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
throw new Error('EXPO_PUBLIC_SUPABASE_URL and EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY must be set')
}

The lazy-client pattern (getSupabaseClient()) is the right architectural choice — keep that. Just don't let missing config silently fall back to hardcoded values; surface the misconfiguration at startup instead.


if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
throw new Error('Supabase config missing')
}

const storage = (globalThis as typeof globalThis & { localStorage: SupabaseStorageAdapter }).localStorage
let client: SupabaseClient | null = null

export const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
auth: {
storage,
autoRefreshToken: true,
persistSession: true,
detectSessionInUrl: false,
},
})
export function getSupabaseClient(): SupabaseClient {
if (!client) {
const storage = (
globalThis as typeof globalThis & { localStorage: SupabaseStorageAdapter }
).localStorage
client = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
auth: {
storage,
autoRefreshToken: true,
persistSession: true,
detectSessionInUrl: false,
},
})
}
return client
}
Loading