feat: replace Firebase with Supabase JWT auth (ES256/JWKS + HS256 fallback)

app/config.py

@@ -22,19 +22,11 @@ class Settings(BaseSettings):
     NVIDIA_DEEPSEEK_KEY: str
     NVIDIA_LLAMA_VISION_KEY: str
     NVIDIA_EMBED_KEY: str
-
-    # Firebase Admin SDK
-    FIREBASE_PROJECT_ID: str
-    FIREBASE_CLIENT_EMAIL: str
-    FIREBASE_PRIVATE_KEY: str
-
-    @field_validator("FIREBASE_PRIVATE_KEY")
-    @classmethod
-    def clean_private_key(cls, v: str) -> str:
-        if v:
-            # Replace escaped newlines if they are passed as text \n
-            return v.replace("\\n", "\n").replace('"', "")
-        return v
+    # Supabase Auth Settings
+    SUPABASE_URL: str = "https://lxqysvqlhajjweorgztt.supabase.co"
+    SUPABASE_ANON_KEY: str = ""
+    SUPABASE_SERVICE_ROLE_KEY: str = ""
+    SUPABASE_JWT_SECRET: str = "super-secret-jwt-token-with-at-least-32-characters-long"
 
     # Storage API (Supabase Storage S3-Compatible)
     CLOUDFLARE_R2_ACCOUNT_ID: str

app/routers/auth.py

@@ -4,7 +4,7 @@ from sqlalchemy.future import select
 from datetime import datetime, timedelta
 from app.database import get_db
 from app import models, schemas
-from app.utils.firebase import verify_id_token, create_session_cookie
+from app.utils.auth import verify_supabase_jwt
 from app.utils.security import get_current_user
 from app.config import settings
 
@@ -12,13 +12,13 @@ router = APIRouter(prefix="/auth", tags=["Auth"])
 
 @router.post("/verify-token", response_model=schemas.UserResponse)
 async def verify_token(request: Request, response: Response, body: dict, db: AsyncSession = Depends(get_db)):
-    id_token = body.get("id_token")
+    id_token = body.get("id_token") or body.get("access_token")
     if not id_token:
-        raise HTTPException(status_code=400, detail="ID token is required")
+        raise HTTPException(status_code=400, detail="ID token or access_token is required")
         
     try:
-        # Verify Firebase ID token
-        decoded_claims = verify_id_token(id_token)
+        # Verify Supabase JWT token offline
+        decoded_claims = verify_supabase_jwt(id_token)
     except Exception as e:
         raise HTTPException(status_code=401, detail=f"Invalid ID token: {str(e)}")
         
@@ -53,18 +53,18 @@ async def verify_token(request: Request, response: Response, body: dict, db: Asy
         await db.commit()
         await db.refresh(user)
         
-    # Create Firebase Session Cookie (valid for 5 days)
-    expires_in = timedelta(days=5)
-    expires_in_seconds = int(expires_in.total_seconds())
-    try:
-        session_cookie = create_session_cookie(id_token, expires_in_seconds=expires_in_seconds)
-    except Exception as e:
-        raise HTTPException(status_code=401, detail=f"Failed to create session cookie: {str(e)}")
+    # Determine the token's remaining lifetime from 'exp' claim
+    token_exp = decoded_claims.get("exp")
+    if token_exp:
+        now = datetime.utcnow().timestamp()
+        expires_in_seconds = max(int(token_exp - now), 0)
+    else:
+        expires_in_seconds = 5 * 24 * 60 * 60  # Default fallback to 5 days
         
-    # Set httpOnly cookie in response
+    # Set httpOnly cookie in response using the Supabase JWT directly
     response.set_cookie(
         key="archvise_session",
-        value=session_cookie,
+        value=id_token,
         max_age=expires_in_seconds,
         expires=expires_in_seconds,
         httponly=True,

app/utils/auth.py

@@ -0,0 +1,139 @@
+import jwt
+import httpx
+import time
+from jwt.algorithms import ECAlgorithm
+from app.config import settings
+
+# ---------------------------------------------------------------------------
+# JWKS cache — fetched once and refreshed every 12 hours
+# ---------------------------------------------------------------------------
+_jwks_cache: dict = {}
+_jwks_cache_ts: float = 0.0
+_JWKS_TTL = 12 * 60 * 60  # 12 hours in seconds
+
+SUPABASE_JWKS_URL = f"{settings.SUPABASE_URL}/auth/v1/.well-known/jwks.json"
+
+
+def _get_jwks() -> dict:
+    """Fetch JWKS from Supabase, using an in-process cache."""
+    global _jwks_cache, _jwks_cache_ts
+    now = time.time()
+    if _jwks_cache and (now - _jwks_cache_ts) < _JWKS_TTL:
+        return _jwks_cache
+
+    try:
+        response = httpx.get(SUPABASE_JWKS_URL, timeout=5.0)
+        response.raise_for_status()
+        data = response.json()
+        _jwks_cache = {key["kid"]: key for key in data.get("keys", [])}
+        _jwks_cache_ts = now
+        return _jwks_cache
+    except Exception as e:
+        # If refresh fails but we have a stale cache, use it rather than break
+        if _jwks_cache:
+            return _jwks_cache
+        raise RuntimeError(f"Failed to fetch Supabase JWKS: {e}") from e
+
+
+def _get_public_key(kid: str):
+    """Return the PyJWT-compatible public key object for the given key ID."""
+    jwks = _get_jwks()
+    jwk = jwks.get(kid)
+    if not jwk:
+        # Refresh cache once and retry (key rotation scenario)
+        global _jwks_cache_ts
+        _jwks_cache_ts = 0.0
+        jwks = _get_jwks()
+        jwk = jwks.get(kid)
+    if not jwk:
+        raise ValueError(f"Unknown JWKS key ID: {kid}")
+    return ECAlgorithm.from_jwk(jwk)
+
+
+def verify_supabase_jwt(token: str) -> dict:
+    """
+    Decodes and verifies a Supabase-issued JWT.
+
+    Supports both:
+    - ES256 (ECC P-256)  — current Supabase signing algorithm via JWKS
+    - HS256              — legacy shared-secret tokens (fallback)
+
+    Returns a normalised claims dict compatible with the rest of the backend.
+    """
+    # Decode header without verification to determine the algorithm and kid
+    try:
+        unverified_header = jwt.get_unverified_header(token)
+    except jwt.exceptions.DecodeError as e:
+        raise ValueError(f"Malformed JWT header: {e}") from e
+
+    alg = unverified_header.get("alg", "")
+    kid = unverified_header.get("kid")
+
+    if alg == "ES256" and kid:
+        # ----------------------------------------------------------------
+        # Verify using JWKS (ECC P-256 — current Supabase default)
+        # ----------------------------------------------------------------
+        public_key = _get_public_key(kid)
+        try:
+            claims = jwt.decode(
+                token,
+                public_key,
+                algorithms=["ES256"],
+                options={"verify_aud": True},
+                audience="authenticated",
+            )
+        except jwt.InvalidAudienceError:
+            claims = jwt.decode(
+                token,
+                public_key,
+                algorithms=["ES256"],
+                options={"verify_aud": False},
+            )
+    else:
+        # ----------------------------------------------------------------
+        # Fallback: HS256 verification with shared JWT secret
+        # ----------------------------------------------------------------
+        try:
+            claims = jwt.decode(
+                token,
+                settings.SUPABASE_JWT_SECRET,
+                algorithms=["HS256"],
+                options={"verify_aud": True},
+                audience="authenticated",
+            )
+        except jwt.InvalidAudienceError:
+            claims = jwt.decode(
+                token,
+                settings.SUPABASE_JWT_SECRET,
+                algorithms=["HS256"],
+                options={"verify_aud": False},
+            )
+
+    # ------------------------------------------------------------------
+    # Normalise claims to a consistent dict expected by the rest of the app
+    # ------------------------------------------------------------------
+    user_metadata = claims.get("user_metadata", {}) or {}
+    uid = claims.get("sub")
+    email = claims.get("email")
+    name = (
+        user_metadata.get("full_name")
+        or claims.get("name")
+        or user_metadata.get("name")
+    )
+    picture = (
+        user_metadata.get("avatar_url")
+        or claims.get("picture")
+        or user_metadata.get("picture")
+    )
+
+    return {
+        "uid": uid,
+        "sub": uid,
+        "email": email,
+        "user_metadata": user_metadata,
+        "full_name": name,
+        "name": name,
+        "avatar_url": picture,
+        "picture": picture,
+        "exp": claims.get("exp"),
+    }

app/utils/security.py

@@ -4,7 +4,7 @@ from sqlalchemy.future import select
 from datetime import datetime, timedelta
 from app.database import get_db
 from app import models
-from app.utils.firebase import verify_session_cookie
+from app.utils.auth import verify_supabase_jwt
 
 async def get_current_user(request: Request, db: AsyncSession = Depends(get_db)) -> models.User:
     session_cookie = request.cookies.get("archvise_session")
@@ -29,8 +29,8 @@ async def get_current_user(request: Request, db: AsyncSession = Depends(get_db))
                 "picture": None
             }
         else:
-            # Verify Firebase Session Cookie
-            decoded_claims = verify_session_cookie(session_cookie, check_revoked=True)
+            # Verify Supabase JWT Offline
+            decoded_claims = verify_supabase_jwt(session_cookie)
     except Exception as e:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,

requirements.txt

@@ -5,7 +5,6 @@ asyncpg==0.29.0
 alembic==1.13.1
 redis==5.0.4
 rq==1.16.1
-firebase-admin==6.5.0
 stripe==9.9.0
 boto3==1.34.122
 PyGithub==2.3.0