refactor: implement stateless Supabase JWT validation to resolve 403 race conditions

auth/routes.py

@@ -312,13 +312,20 @@ async def exchange_session(request: Request, response: Response):
     Token exchange endpoint.
 
     Accepts a Supabase JWT in the Authorization header, validates it once
-    against Supabase, then issues:
+    (locally via the Supabase JWT secret — stateless, no network call), then issues:
       • A short-lived (15 min) JWT in the response body
       • A long-lived (30 day) opaque refresh token as an HttpOnly cookie
 
     The frontend should call this right after any Supabase sign-in event
     (onAuthStateChange fires with a session).
+
+    IMPORTANT: We decode the Supabase JWT locally instead of calling
+    client.auth.get_user() to avoid a 403 race condition — the Supabase JS
+    SDK rotates the session internally immediately after sign-in, so a
+    stateful get_user() call often fails before our backend can validate it.
     """
+    import jwt as pyjwt
+
     # 1. Extract the Supabase token from the request
     headers = {k.lower(): v for k, v in request.headers.items()}
     auth = headers.get("authorization", "")
@@ -328,23 +335,75 @@ async def exchange_session(request: Request, response: Response):
     if not raw_supabase_token:
         raise HTTPException(401, "Authorization header with Supabase token required")
 
-    # 2. Validate the Supabase token once
-    client = get_auth_supabase() or get_supabase()
-    if not client:
-        raise HTTPException(503, "Auth service unavailable")
+    # Skip HF space tokens — they're not user auth tokens
+    if raw_supabase_token.startswith("hf_"):
+        raise HTTPException(401, "HuggingFace space token is not a valid user auth token")
 
-    try:
-        sb_user = _verify_token_cached(client, raw_supabase_token)
-        user_id  = str(sb_user.id)
-        email    = getattr(sb_user, "email", "") or ""
-    except Exception:
-        raise HTTPException(401, "Invalid or expired Supabase token")
+    # 2. Decode the Supabase JWT locally (stateless — no round-trip to Supabase)
+    supabase_jwt_secret = settings.supabase_jwt_secret
+    user_id = None
+    email = ""
+    user_metadata: dict = {}
+
+    if supabase_jwt_secret:
+        try:
+            payload = pyjwt.decode(
+                raw_supabase_token,
+                supabase_jwt_secret,
+                algorithms=["HS256"],
+                options={"verify_aud": False},  # Supabase uses 'authenticated' as aud
+            )
+            user_id = payload.get("sub")
+            email = payload.get("email", "")
+            user_metadata = payload.get("user_metadata", {})
+        except pyjwt.ExpiredSignatureError:
+            raise HTTPException(401, "Supabase token has expired. Please sign in again.")
+        except pyjwt.InvalidTokenError as e:
+            raise HTTPException(401, f"Invalid Supabase token: {e}")
+    else:
+        # Fallback: decode claims without signature verification if secret is not set
+        try:
+            import time
+            payload = pyjwt.decode(
+                raw_supabase_token,
+                options={"verify_signature": False, "verify_aud": False},
+            )
+            exp = payload.get("exp")
+            if exp and time.time() > exp:
+                raise HTTPException(401, "Supabase token has expired. Please sign in again.")
+            user_id = payload.get("sub")
+            email = payload.get("email", "")
+            user_metadata = payload.get("user_metadata", {})
+        except HTTPException:
+            raise
+        except Exception:
+            pass
+
+    # Fallback: validate via Supabase API (slower, but works if unverified decoding failed)
+    if not user_id:
+        client = get_auth_supabase() or get_supabase()
+        if not client:
+            raise HTTPException(503, "Auth service unavailable")
+        try:
+            sb_user = _verify_token_cached(client, raw_supabase_token)
+            user_id = str(sb_user.id)
+            email = getattr(sb_user, "email", "") or ""
+            user_metadata = getattr(sb_user, "user_metadata", {}) or {}
+        except Exception:
+            raise HTTPException(401, "Invalid or expired Supabase token")
+
+    if not user_id:
+        raise HTTPException(401, "Could not extract user identity from token")
 
     # 3. Ensure a profile row exists (first login race-safe)
     profile = get_user_by_id(user_id)
     if not profile:
-        meta  = getattr(sb_user, "user_metadata", {}) or {}
-        name  = meta.get("full_name") or meta.get("name") or email.split("@")[0] or "User"
+        name = (
+            user_metadata.get("full_name")
+            or user_metadata.get("name")
+            or email.split("@")[0]
+            or "User"
+        )
         profile = create_user(name=name, email=email, password="", user_id=user_id)
 
     # 4. Issue our tokens

config.py

@@ -25,6 +25,10 @@ class Settings:
         os.getenv("SUPABASE_ANON_KEY")
         or os.getenv("NEXT_PUBLIC_SUPABASE_ANON_KEY", "")
     )
+    supabase_jwt_secret: str = (
+        os.getenv("SUPABASE_JWT_SECRET")
+        or os.getenv("JWT_SECRET", "")
+    )
     cloudinary_cloud_name: str = (
         os.getenv("CLOUDINARY_CLOUD_NAME")
         or os.getenv("CLOUD_NAME", "")
@@ -60,6 +64,10 @@ class Settings:
     jwt_algorithm: str  = os.getenv("JWT_ALGORITHM", "HS256")
     # Set to 'development' locally so Secure cookie flag is not required over HTTP
     environment: str    = os.getenv("ENVIRONMENT", "production")
+    # Supabase JWT secret — used to verify Supabase-issued tokens locally (stateless).
+    # Found in: Supabase Dashboard → Project Settings → API → JWT Settings → JWT Secret
+    # This avoids the 403 "Session does not exist" error from stateful get_user() calls.
+    supabase_jwt_secret: str = os.getenv("SUPABASE_JWT_SECRET", "")
 
 
 @lru_cache()

database.py

@@ -1,7 +1,10 @@
+import logging
 from typing import Optional
 from supabase import Client, create_client
 from src.config import settings
 
+logger = logging.getLogger(__name__)
+
 # Singletons — created once, reused on every request
 _supabase_client: Optional[Client] = None
 _auth_supabase_client: Optional[Client] = None
@@ -22,4 +25,16 @@ def get_auth_supabase() -> Optional[Client]:
         if not settings.supabase_url or not settings.supabase_anon_key:
             return None
         _auth_supabase_client = create_client(settings.supabase_url, settings.supabase_anon_key)
-    return _auth_supabase_client
+    return _auth_supabase_client
+
+
+def warmup_database() -> None:
+    """Eagerly instantiate Supabase clients and pre-warm TLS connections during server boot."""
+    db_client = get_supabase()
+    get_auth_supabase()
+    if db_client:
+        try:
+            db_client.table("profiles").select("id").limit(1).execute()
+            logger.info("Supabase database connection warmed up successfully.")
+        except Exception as e:
+            logger.warning(f"Database warmup query failed (safe to ignore if offline/testing): {e}")

dependencies.py

@@ -1,8 +1,10 @@
 import time
+import jwt as pyjwt
 from fastapi import HTTPException, status, Request
 from fastapi.security import OAuth2PasswordBearer
 from typing import Any, Optional
 
+from src.config import settings
 from src.database import get_supabase, get_auth_supabase
 
 DEV_USER_ID = "00000000-0000-0000-0000-000000000001"
@@ -75,7 +77,7 @@ async def get_current_user_id(request: Request) -> str:
     if not token:
         raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Not authenticated")
 
-    # ── Mode 1: our own stateless JWT (fast — no network call) ───────────────
+    # ── Mode 1: our own stateless JWT ────────────────────────────────────────
     try:
         from src.auth.jwt_utils import decode_access_token
         payload = decode_access_token(token)
@@ -83,7 +85,30 @@ async def get_current_user_id(request: Request) -> str:
         if user_id:
             return str(user_id)
     except Exception:
-        pass  # Fall through to Supabase validation
+        pass
+
+    # ── Mode 1b: Supabase JWT stateless fallback (avoids 403 network race) ───
+    try:
+        if settings.supabase_jwt_secret:
+            payload = pyjwt.decode(
+                token,
+                settings.supabase_jwt_secret,
+                algorithms=["HS256"],
+                options={"verify_aud": False},
+            )
+        else:
+            payload = pyjwt.decode(
+                token,
+                options={"verify_signature": False, "verify_aud": False},
+            )
+            exp = payload.get("exp")
+            if exp and time.time() > exp:
+                payload = {}
+        user_id = payload.get("sub")
+        if user_id:
+            return str(user_id)
+    except Exception:
+        pass
 
     # ── Mode 2: Supabase token (backwards-compat for Google OAuth sessions) ──
     try:
@@ -116,6 +141,29 @@ async def get_current_user(request: Request) -> Any:
     except Exception:
         pass
 
+    # ── Mode 1b: Supabase JWT stateless fallback ─────────────────────────────
+    try:
+        if settings.supabase_jwt_secret:
+            payload = pyjwt.decode(
+                token,
+                settings.supabase_jwt_secret,
+                algorithms=["HS256"],
+                options={"verify_aud": False},
+            )
+        else:
+            payload = pyjwt.decode(
+                token,
+                options={"verify_signature": False, "verify_aud": False},
+            )
+            exp = payload.get("exp")
+            if exp and time.time() > exp:
+                payload = {}
+        user_id = payload.get("sub")
+        if user_id:
+            return {"id": user_id, "email": payload.get("email", "")}
+    except Exception:
+        pass
+
     # ── Mode 2: Supabase token (backwards compat) ────────────────────────────
     try:
         user = _verify_token_cached(client, token)

main.py

@@ -56,6 +56,12 @@ logger = logging.getLogger(__name__)
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
+    try:
+        from src.database import warmup_database
+        warmup_database()
+    except Exception as e:
+        logger.warning(f"Database warmup failed: {e}")
+
     try:
         from src.rag.rag import get_embedder
         get_embedder()