Inject Supabase env vars at runtime for Docker deployment

backend/app/main.py

@@ -39,6 +39,8 @@ def get_application() -> FastAPI:
         app.mount("/assets", StaticFiles(directory=os.path.join(DIST_DIR, "assets")), name="assets")
         
         # Catch-all for SPA routing (must be last)
+        from fastapi.responses import HTMLResponse
+        
         @app.get("/{full_path:path}")
         async def serve_spa(full_path: str):
             # If API request fell through to here, return 404
@@ -48,7 +50,32 @@ def get_application() -> FastAPI:
             # Use index.html for all other routes (SPA)
             index_path = os.path.join(DIST_DIR, "index.html")
             if os.path.exists(index_path):
-                return FileResponse(index_path)
+                # READ and INJECT runtime env vars
+                try:
+                    with open(index_path, "r", encoding="utf-8") as f:
+                        content = f.read()
+                    
+                    # Prepare env vars to inject
+                    # Note: We map SECRET env vars to VITE_ PUBLIC vars for the frontend
+                    supabase_url = os.getenv("SUPABASE_URL", "")
+                    supabase_key = os.getenv("SUPABASE_ANON_KEY", "")
+                    
+                    env_script = f"""
+                    <script>
+                        window.__ENV__ = {{
+                            VITE_SUPABASE_URL: "{supabase_url}",
+                            VITE_SUPABASE_ANON_KEY: "{supabase_key}"
+                        }};
+                    </script>
+                    """
+                    
+                    # Inject before </head>
+                    content = content.replace("</head>", f"{env_script}</head>")
+                    return HTMLResponse(content=content)
+                except Exception as e:
+                    print(f"Error serving SPA: {e}")
+                    return FileResponse(index_path) # Fallback
+                    
             return {"detail": "Frontend not found (build missing)"}
     else:
         print(f"⚠️ Frontend dist not found at {DIST_DIR}. Serving API only.")

frontend/src/supabaseClient.js

@@ -1,6 +1,18 @@
 import { createClient } from "@supabase/supabase-js";
 
-const supabaseUrl = import.meta.env.VITE_SUPABASE_URL;
-const supabaseKey = import.meta.env.VITE_SUPABASE_ANON_KEY;
+// Check for runtime config (injected by backend) or build-time config (local dev)
+const getEnv = (key) => {
+    if (typeof window !== "undefined" && window.__ENV__ && window.__ENV__[key]) {
+        return window.__ENV__[key];
+    }
+    return import.meta.env[key];
+};
 
-export const supabase = createClient(supabaseUrl, supabaseKey);
+const supabaseUrl = getEnv("VITE_SUPABASE_URL");
+const supabaseKey = getEnv("VITE_SUPABASE_ANON_KEY");
+
+if (!supabaseUrl || !supabaseKey) {
+    console.warn("Supabase credentials missing! App may fail.");
+}
+
+export const supabase = createClient(supabaseUrl || "", supabaseKey || "");