From c45f3443f8cd71a8e7c0debddc2e8edfbffd8480 Mon Sep 17 00:00:00 2001
From: Abdulmuizz Hamzat <103611443+canhamzacode@users.noreply.github.com>
Date: Sun, 7 Dec 2025 15:41:42 +0100
Subject: [PATCH] refactor: remove Supabase dependency and related user
 validation logic (#610)

---
 apps/api/package.json                      |  1 -
 apps/api/src/utils/auth/validate-user.ts   | 21 ---------------
 apps/api/src/utils/redis/key-generators.ts | 28 +++----------------
 apps/api/src/utils/supabase.ts             | 31 ----------------------
 pnpm-lock.yaml                             |  3 ---
 5 files changed, 3 insertions(+), 81 deletions(-)
 delete mode 100644 apps/api/src/utils/auth/validate-user.ts
 delete mode 100644 apps/api/src/utils/supabase.ts

diff --git a/apps/api/package.json b/apps/api/package.json
index 149c29c4..d543d109 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -47,7 +47,6 @@
     "@hono/zod-validator": "^0.7.2",
     "@scalar/hono-api-reference": "^0.9.18",
     "@sentry/profiling-node": "^7.110.1",
-    "@supabase/supabase-js": "^2.32.0",
     "axios": "^1.4.0",
     "dotenv": "^16.3.1",
     "hono": "^4.9.7",
diff --git a/apps/api/src/utils/auth/validate-user.ts b/apps/api/src/utils/auth/validate-user.ts
deleted file mode 100644
index a96cc85f..00000000
--- a/apps/api/src/utils/auth/validate-user.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import { User } from '@supabase/supabase-js';
-import { getSupabase } from '../supabase';
-
-const supabase = getSupabase();
-
-export async function validateUser(accessToken: string): Promise<User> {
-  let user: User | null = null;
-
-  try {
-    const { data } = await supabase.auth.getUser(accessToken);
-    user = data.user;
-  } catch (error) {
-    console.error(error);
-  }
-
-  if (!user) {
-    throw new Error('Unauthenticated user');
-  }
-
-  return user;
-}
diff --git a/apps/api/src/utils/redis/key-generators.ts b/apps/api/src/utils/redis/key-generators.ts
index f11584dc..8dfba562 100644
--- a/apps/api/src/utils/redis/key-generators.ts
+++ b/apps/api/src/utils/redis/key-generators.ts
@@ -4,20 +4,6 @@
  */
 
 import type { Context } from 'hono';
-import { supabase } from '@api/utils/supabase';
-
-/**
- * Extract user ID from JWT token
- * In a real implementation, you'd decode and verify the JWT
- */
-export const extractUserIdFromToken = async (token: string): Promise<string | null> => {
-  try {
-    const { data } = await supabase.auth.getUser(token);
-    return data.user?.id || null;
-  } catch {
-    return null;
-  }
-};
 
 /**
  * Extract real client IP address considering various proxy headers
@@ -55,18 +41,10 @@ export const extractClientIp = (c: Context): string => {
  * Generate rate limit key for authenticated users
  */
 export const userKeyGenerator = (c: Context): string => {
-  const authHeader = c.req.header('authorization');
+  const user = c.get('user'); // Already extracted by global middleware
 
-  if (authHeader) {
-    const token = authHeader.split(' ')[1];
-    if (token && token !== 'null' && token !== 'undefined') {
-      const userId = extractUserIdFromToken(token);
-      if (userId) {
-        return `user:${userId}`;
-      }
-      // Fallback to token if user ID extraction fails
-      return `token:${token}`;
-    }
+  if (user?.id) {
+    return `user:${user.id}`;
   }
 
   // No valid auth, fall back to IP
diff --git a/apps/api/src/utils/supabase.ts b/apps/api/src/utils/supabase.ts
deleted file mode 100644
index 440e0101..00000000
--- a/apps/api/src/utils/supabase.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { SupabaseClient, createClient } from '@supabase/supabase-js';
-
-import { env } from '@api/config/env';
-
-const { PUBLIC_SUPABASE_ANON_KEY, PUBLIC_SUPABASE_URL, PRIVATE_SUPABASE_SERVICE_ROLE } = env;
-
-export let supabase: SupabaseClient | null = null;
-
-interface SupabaseConfig {
-  supabaseConfig: {
-    url: string;
-    anonKey: string;
-  };
-}
-
-export function getSupabase(config?: SupabaseConfig): SupabaseClient {
-  if (supabase) return supabase;
-
-  try {
-    // Use service role key to bypass RLS policies
-    supabase = createClient(PUBLIC_SUPABASE_URL, PRIVATE_SUPABASE_SERVICE_ROLE, {
-      auth: { persistSession: false }
-    });
-  } catch (error) {
-    console.error('Error starting supabase', error);
-    throw error;
-  }
-
-  return supabase;
-}
-
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ff5ed027..2bb2ba88 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -72,9 +72,6 @@ importers:
       '@sentry/profiling-node':
         specifier: ^7.110.1
         version: 7.120.4
-      '@supabase/supabase-js':
-        specifier: ^2.32.0
-        version: 2.78.0(bufferutil@4.0.9)(utf-8-validate@6.0.5)
       axios:
         specifier: ^1.4.0
         version: 1.13.1