feat: migrate from Clerk+NeoDB to Supabase Auth+DB - #105
Merged
Conversation
- Replace Clerk auth with Supabase Auth (@supabase/ssr) middleware - Migrate all API routes from NeoDB sql() to Supabase client - Add server-side tenant verification (tenantId from auth session, not request) - Fix hard deletes: save-shifts and push tokens now use soft-delete - Fix /api/user/profile data leak (remove arbitrary userId param) - Fix /api/checkout auth (requireAuth + role check) - Add tenant_members table migration with RLS policies - Add signup trigger: handle_new_user creates tenant + profile + membership - Deduplicate conflict detection: import from @packages/validators - Fix mobile availability INSERT to include tenant_id - Delete duplicate 20240001_core_schema.sql migration - Update env.example for Supabase credentials
|
Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- Implement realtime roster refresh via Supabase Realtime + 30s polling fallback - Update demo mode to use Supabase Auth signInWithPassword (replace Clerk tokens) - Fix mobile push token insert to include tenant_id - Fix mobile push token unregister to use soft-delete instead of DELETE - Add REPLICA IDENTITY FULL for shifts, rosters, clock_events - Remove empty ui-shared package
- P2-3: Generate Database types from migrations into packages/validators/src/database.types.ts with full Table/Row/Insert/Update types for all 9 tables plus Functions and Enums. Added database export path to package.json. - P2-4: Delete stale tests/web/ directory and root playwright.config.ts (all test cases already covered by apps/web/e2e/). - Fix migration landmine: create 20260725_fixup_tenants_columns.sql adding missing tenants.slug and tenants.owner_id columns (referenced by handle_new_user trigger), and fix tenant_members.role DEFAULT from invalid 'member' to valid 'employee'.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…les routes
Three API routes still accepted tenantId from request params (GET + POST),
enabling cross-tenant data access. This completes the P0-2 security fix:
- /api/roster: GET and POST now derive tenantId via getTenantId() instead
of searchParams.get('tenantId') and body.tenantId
- /api/timesheets: Derives tenantId server-side, removes from query params
- /api/profiles: Derives tenantId server-side, removes from query params
All client-side API callers updated to stop sending tenantId:
- rosterApi.fetchCurrentRoster(weekStart) — removed tenantId param
- rosterApi.copyForwardRoster(weekStart, rosterId) — removed tenantId param
- useTimesheets — removed tenantId from query string
- RosterGrid — removed tenantId from /api/profiles fetch and create-shift POST
- rosterStore — removed tenantId from fetchCurrentRoster and copyForwardRoster
- useRosterRealtime — removed tenantId from fetchCurrentRoster calls
CodeQL fixes:
- Removed unused format import from RosterHeader.tsx
- Removed unused modalEmployeeId/modalDayIndex state from RosterGrid.tsx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates crewRoster web from Clerk + NeoDB to Supabase Auth + Supabase DB, unifying web and mobile on the same auth/database stack. Fixes 11 security and functional issues found during audit, plus 3 additional API routes that still accepted client-supplied tenantId.
Changes
@supabase/ssr) + Supabase JS client across all API routes, middleware, auth hooks, and UI components (login, signup, demo)roster,timesheets,timesheets/approve,profiles,user/profile,checkout) now derivetenantIdserver-side viarequireAuth()→ profile lookup. No route acceptstenantIdfrom query params or request body. All client-side callers updated to stop sending it.save-shiftsand push notification edge function now use soft-delete (deleted_at) instead of hard DELETE; push token unregister on mobile also uses soft-deletehandle_new_user,handle_invited_user)20240001_core_schema.sql, moved.supersededtodocs/archive/, removed channels/messages from RLS policies20260725_fixup_tenants_columns.sql): Added missingtenants.slugandtenants.owner_idcolumns (referenced byhandle_new_usertrigger but missing from core schema); fixedtenant_members.roleDEFAULT from invalid'member'to valid'employee'RosterGrid.tsx(774→220 lines) extracted intoShiftCreationModal.tsx,ShiftItem.tsx,RosterHeader.tsxDatabaseinterface from migrations inpackages/validators/src/database.types.ts(9 tables, functions, enums, relationships)tests/web/(4 spec files, all scenarios covered byapps/web/e2e/); deleted rootplaywright.config.ts@clerk/nextjs,@neondatabase/serverless,postgres; added@supabase/ssr,@supabase/supabase-jsTesting
pnpm tsc --noEmitinpackages/validators/— passespnpm tsc --noEmitinapps/web/— passespnpm --filter @packages/validators test— 51/51 passing (4 test files: conflicts, conflict edge cases, shift, auth)pnpm install— passesapps/web/e2e/) and RLS pgTap verification pending live Supabase project accessSession Details
(aside)to your comment to have me ignore it.