From c9b09b8250b4094732d94e61c3ebb3987b58ccf8 Mon Sep 17 00:00:00 2001 From: Julian Tabel Date: Sun, 22 Mar 2026 12:10:03 +0100 Subject: [PATCH] fix: fix supabase auth url --- backend/src/app/core/auth.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/backend/src/app/core/auth.py b/backend/src/app/core/auth.py index 84cffaf..8c28b5d 100644 --- a/backend/src/app/core/auth.py +++ b/backend/src/app/core/auth.py @@ -26,11 +26,21 @@ class AuthUser: role: str | None = None +def _build_jwks_url(base_url: str) -> str: + """Build the JWKS URL, adding /auth/v1 prefix for Supabase Cloud.""" + base = base_url.rstrip("/") + if "/auth/v1" in base: + return f"{base}/.well-known/jwks.json" + # Supabase Cloud URLs need the /auth/v1 prefix; + # local GoTrue serves JWKS at root but uses HS256 fallback anyway. + return f"{base}/auth/v1/.well-known/jwks.json" + + def _get_jwks_client() -> PyJWKClient | None: """Get or create a cached JWKS client.""" global _jwks_client if _jwks_client is None and settings.supabase_url: - jwks_url = f"{settings.supabase_url.rstrip('/')}/.well-known/jwks.json" + jwks_url = _build_jwks_url(settings.supabase_url) _jwks_client = PyJWKClient(jwks_url, cache_jwk_set=True, lifespan=300) return _jwks_client