Update artifacts/api-server/src/lib/auth.ts

artifacts/api-server/src/lib/auth.ts

@@ -1,45 +1,42 @@
 import type { Request, Response, NextFunction } from "express";
-import { getAuth, clerkClient } from "@clerk/express";
+import { createClient } from "@supabase/supabase-js";
 
 export interface AuthedRequest extends Request {
   userId: string;
   userEmail: string | null;
 }
 
-const emailCache = new Map<string, { email: string | null; ts: number }>();
-const CACHE_TTL_MS = 15 * 60 * 1000;
+const supabase = createClient(
+  process.env.SUPABASE_URL || "",
+  process.env.SUPABASE_SERVICE_ROLE_KEY || ""
+);
 
 export async function requireAuth(
   req: Request,
   res: Response,
   next: NextFunction,
 ): Promise<void> {
-  const auth = getAuth(req);
-  const claimUserId =
-    typeof auth?.sessionClaims?.["userId"] === "string"
-      ? (auth.sessionClaims["userId"] as string)
-      : null;
-  const userId: string | null = claimUserId ?? auth?.userId ?? null;
-  if (!userId) {
+  const authHeader = req.headers.authorization;
+  
+  if (!authHeader?.startsWith("Bearer ")) {
     res.status(401).json({ error: "Unauthorized" });
     return;
   }
 
-  let email: string | null = null;
-  const cached = emailCache.get(userId);
-  if (cached && Date.now() - cached.ts < CACHE_TTL_MS) {
-    email = cached.email;
-  } else {
-    try {
-      const user = await clerkClient.users.getUser(userId);
-      email = user.primaryEmailAddress?.emailAddress ?? null;
-    } catch (err) {
-      req.log.warn({ err }, "Failed to fetch user from Clerk");
+  const token = authHeader.split(" ")[1];
+
+  try {
+    const { data: { user }, error } = await supabase.auth.getUser(token);
+
+    if (error || !user) {
+      res.status(401).json({ error: "Unauthorized" });
+      return;
     }
-    emailCache.set(userId, { email, ts: Date.now() });
-  }
 
-  (req as AuthedRequest).userId = userId;
-  (req as AuthedRequest).userEmail = email;
-  next();
-}
+    (req as AuthedRequest).userId = user.id;
+    (req as AuthedRequest).userEmail = user.email ?? null;
+    next();
+  } catch (err) {
+    res.status(401).json({ error: "Unauthorized" });
+  }
+}