"""
Supabase client for the business-news system (ADR-0015). Lazily initialized —
unlike groq_client.py's eager key check, this only raises if something
actually tries to use Supabase without it being configured, so importing this
module (or any module that imports it) never breaks the test suite or routes
that don't touch news.

Uses the service-role key: this client is server-side only (backend/news/*,
backend/routes/news.py) and must never be sent to or used from the frontend.
"""

import os
from supabase import create_client, Client

_client: Client | None = None


def get_supabase() -> Client:
    global _client
    if _client is not None:
        return _client

    url = os.environ.get("SUPABASE_URL")
    key = os.environ.get("SUPABASE_SERVICE_ROLE_KEY")
    if not url or not key:
        raise RuntimeError(
            "SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY not set — the news system needs a "
            "Supabase project (see backend/sql/news_schema.sql and ADR-0015) before "
            "/api/news/* routes can do anything."
        )
    _client = create_client(url, key)
    return _client