Merge branch agent/p0-correctness-security

# Conflicts:
#	modules/database/supabase/utils/client.py

modules/auth/supabase_bearer.py

@@ -20,6 +20,10 @@ class SupabaseBearer(HTTPBearer):
             token = credentials.credentials
             # Decode using the string-based verifier to avoid async dependency conflicts
             payload = verify_supabase_jwt_str(token)
+            # Keep the bearer token available to downstream dependencies that must
+            # call Supabase as the user (RLS/storage policies), without requiring
+            # each router to decode the Authorization header again.
+            payload["_access_token"] = token
             return payload
         except Exception as e:
             logger.error(f"Token verification failed: {str(e)}")

modules/database/supabase/utils/client.py

@@ -24,12 +24,17 @@ def _create_base_client(url: str, key: str, access_token: Optional[str] = None,
     # Otherwise fall back to the API key
     auth_header = f"Bearer {access_token}" if access_token else f"Bearer {key}"
     
+    headers = {
+        "apikey": key,
+        "Authorization": auth_header,
+    }
+    if options:
+        headers.update(options.get("headers", {}))
+
     client_options = SyncClientOptions(
         schema="public",
         storage=SyncMemoryStorage(),
-        headers={
-            "Authorization": auth_header
-        }
+        headers=headers,
     )
     return create_client(url, key, options=client_options)
 
@@ -95,4 +100,9 @@ class SupabaseAnonClient:
         
         This enables per-user RLS enforcement via auth.uid() in the JWT.
         """
-        return cls(access_token=access_token)
+        if not access_token or not access_token.strip():
+            raise ValueError("access_token is required for per-user Supabase clients")
+        token = access_token.strip()
+        if token.lower().startswith("bearer "):
+            token = token.split(None, 1)[1]
+        return cls(access_token=token)