Julian Tabel
177c02006a
Replace symmetric HS256 JWT verification with asymmetric RS256 using JWKS.
Backend now fetches and caches public keys from Supabase's JWKS endpoint
instead of using a shared secret.
- Add cryptography dependency for RS256 support
- Use PyJWKClient to fetch/cache JWKS from {SUPABASE_URL}/.well-known/jwks.json
- Remove SUPABASE_JWT_SECRET from config, docker-compose, deploy workflow, .env
- Update tests to use RS256 tokens with mocked JWKS client
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
21 lines
1.0 KiB
Plaintext
21 lines
1.0 KiB
Plaintext
# Backend settings
|
|
DEBUG=true
|
|
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/nuzlocke
|
|
|
|
# Supabase Auth (backend uses JWKS from this URL for JWT verification)
|
|
# For local dev with GoTrue container:
|
|
SUPABASE_URL=http://localhost:9999
|
|
SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzc0MDQwNjEzLCJleHAiOjIwODk0MDA2MTN9.EV6tRj7gLqoiT-l2vDFw_67myqRjwpcZTuRb3Xs1nr4
|
|
# For production, replace with your Supabase cloud values:
|
|
# SUPABASE_URL=https://your-project.supabase.co
|
|
# SUPABASE_ANON_KEY=your-anon-key
|
|
|
|
# Frontend settings (used by Vite)
|
|
VITE_API_URL=http://localhost:8000
|
|
# For local dev with GoTrue container:
|
|
VITE_SUPABASE_URL=http://localhost:9999
|
|
VITE_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzc0MDQwNjEzLCJleHAiOjIwODk0MDA2MTN9.EV6tRj7gLqoiT-l2vDFw_67myqRjwpcZTuRb3Xs1nr4
|
|
# For production, replace with your Supabase cloud values:
|
|
# VITE_SUPABASE_URL=https://your-project.supabase.co
|
|
# VITE_SUPABASE_ANON_KEY=your-anon-key
|