refactor: remove Supabase dependency and related user validation logic (#610)

apps/api/package.json

@@ -47,7 +47,6 @@
     "@hono/zod-validator": "^0.7.2",
     "@scalar/hono-api-reference": "^0.9.18",
     "@sentry/profiling-node": "^7.110.1",
-    "@supabase/supabase-js": "^2.32.0",
     "axios": "^1.4.0",
     "dotenv": "^16.3.1",
     "hono": "^4.9.7",

apps/api/src/utils/auth/validate-user.ts

@@ -1,21 +0,0 @@
-import { User } from '@supabase/supabase-js';
-import { getSupabase } from '../supabase';
-
-const supabase = getSupabase();
-
-export async function validateUser(accessToken: string): Promise<User> {
-  let user: User | null = null;
-
-  try {
-    const { data } = await supabase.auth.getUser(accessToken);
-    user = data.user;
-  } catch (error) {
-    console.error(error);
-  }
-
-  if (!user) {
-    throw new Error('Unauthenticated user');
-  }
-
-  return user;
-}

apps/api/src/utils/redis/key-generators.ts

@@ -4,20 +4,6 @@
  */
 
 import type { Context } from 'hono';
-import { supabase } from '@api/utils/supabase';
-
-/**
- * Extract user ID from JWT token
- * In a real implementation, you'd decode and verify the JWT
- */
-export const extractUserIdFromToken = async (token: string): Promise<string | null> => {
-  try {
-    const { data } = await supabase.auth.getUser(token);
-    return data.user?.id || null;
-  } catch {
-    return null;
-  }
-};
 
 /**
  * Extract real client IP address considering various proxy headers
@@ -55,18 +41,10 @@ export const extractClientIp = (c: Context): string => {
  * Generate rate limit key for authenticated users
  */
 export const userKeyGenerator = (c: Context): string => {
-  const authHeader = c.req.header('authorization');
+  const user = c.get('user'); // Already extracted by global middleware
 
-  if (authHeader) {
-    const token = authHeader.split(' ')[1];
-    if (token && token !== 'null' && token !== 'undefined') {
-      const userId = extractUserIdFromToken(token);
-      if (userId) {
-        return `user:${userId}`;
-      }
-      // Fallback to token if user ID extraction fails
-      return `token:${token}`;
-    }
+  if (user?.id) {
+    return `user:${user.id}`;
   }
 
   // No valid auth, fall back to IP

apps/api/src/utils/supabase.ts

@@ -1,31 +0,0 @@
-import { SupabaseClient, createClient } from '@supabase/supabase-js';
-
-import { env } from '@api/config/env';
-
-const { PUBLIC_SUPABASE_ANON_KEY, PUBLIC_SUPABASE_URL, PRIVATE_SUPABASE_SERVICE_ROLE } = env;
-
-export let supabase: SupabaseClient | null = null;
-
-interface SupabaseConfig {
-  supabaseConfig: {
-    url: string;
-    anonKey: string;
-  };
-}
-
-export function getSupabase(config?: SupabaseConfig): SupabaseClient {
-  if (supabase) return supabase;
-
-  try {
-    // Use service role key to bypass RLS policies
-    supabase = createClient(PUBLIC_SUPABASE_URL, PRIVATE_SUPABASE_SERVICE_ROLE, {
-      auth: { persistSession: false }
-    });
-  } catch (error) {
-    console.error('Error starting supabase', error);
-    throw error;
-  }
-
-  return supabase;
-}
-

pnpm-lock.yaml

@@ -72,9 +72,6 @@ importers:
       '@sentry/profiling-node':
         specifier: ^7.110.1
         version: 7.120.4
-      '@supabase/supabase-js':
-        specifier: ^2.32.0
-        version: 2.78.0(bufferutil@4.0.9)(utf-8-validate@6.0.5)
       axios:
         specifier: ^1.4.0
         version: 1.13.1