fix: tighten API P0 auth and route handling

2026-05-28 12:42:42 +01:00
parent 550d405935
commit 54760083b5
6 changed files with 309 additions and 96 deletions
@@ -20,6 +20,10 @@ class SupabaseBearer(HTTPBearer):
            token = credentials.credentials
            # Decode using the string-based verifier to avoid async dependency conflicts
            payload = verify_supabase_jwt_str(token)
+            # Keep the bearer token available to downstream dependencies that must
+            # call Supabase as the user (RLS/storage policies), without requiring
+            # each router to decode the Authorization header again.
+            payload["_access_token"] = token
            return payload
        except Exception as e:
            logger.error(f"Token verification failed: {str(e)}")