Skip to content

chore: switch Supabase host to sb.capgo.app#1743

Open
riderx wants to merge 1 commit intomainfrom
riderx/sb-capgo-domain
Open

chore: switch Supabase host to sb.capgo.app#1743
riderx wants to merge 1 commit intomainfrom
riderx/sb-capgo-domain

Conversation

@riderx
Copy link
Member

@riderx riderx commented Mar 5, 2026

Summary (AI generated)

  • Replaced production and preproduction SUPA_URL defaults with https://sb.capgo.app in config and docs.
  • Updated internal scripts and trigger calls that were hardcoded to the previous *.supabase.co host.
  • Added compatibility parsing so sb.capgo.app still maps to legacy project ref xvwzpoazmxkqosrdewyv where supbaseId is derived.

Motivation (AI generated)

Use the new canonical Supabase domain across the system without breaking legacy project-id dependent logic.

Business Impact (AI generated)

This reduces migration risk and ensures production/preprod traffic and tooling target the new domain consistently.

Test plan (AI generated)

  • bun run lint:backend && bun lint

Screenshots (AI generated)

  • N/A (no frontend behavior change)

Checklist (AI generated)

  • My code follows the code style of this project and passes bun run lint:backend && bun run lint.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • My change has adequate E2E test coverage.
  • I have tested my code manually, and I have provided steps how to reproduce my tests.

Generated with AI

Summary by CodeRabbit

  • Chores
    • Updated service endpoint values for production and pre-production environments.
  • Refactor
    • Centralized and simplified host/config resolution logic for supabase endpoints.
  • Documentation
    • Updated docs and inline comments to reflect the new endpoint and host mappings.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 5, 2026

📝 Walkthrough

Walkthrough

Updates replace legacy Supabase hosts with the new sb.capgo.app across configs, scripts, and backend functions and introduce helper logic to derive project IDs with a legacy mapping for sb.capgo.app.

Changes

Cohort / File(s) Summary
Documentation & Config
README.md, configs.json
Updated SUPA_URL defaults and prod/preprod supa_url values from legacy supabase.co host to https://sb.capgo.app.
Utility Scripts
scripts/add_replicate.ts, scripts/change_app_owner.ts, scripts/create_missing_customers_for_orgs.ts, scripts/del_replicate.ts, scripts/fix_app_stats_day_1.mjs
Replaced hard-coded Supabase endpoint with https://sb.capgo.app; no other logic or control-flow changes.
Service Layer
src/services/supabase.ts
Added productionSupaHosts and legacySupabaseProjectRef, introduced getSupabaseIdFromHost() and adjusted local-config derivation to use the helper.
Backend Functions & Utils
supabase/functions/_backend/private/config.ts, supabase/functions/_backend/utils/stripe.ts, supabase/functions/_backend/utils/supaMetric.ts
Added getSupabaseProjectId() with robust host parsing and legacy mapping for sb.capgo.app; GET / config handler now prefers SUPABASE_REPLICATE_URL then SUPABASE_URL; updated comments/examples to new domain.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~23 minutes

Possibly related PRs

Suggested labels

enhancement

Poem

🐇 I nibble at code and hop with delight,
Changed hosts to sb.capgo.app overnight.
A gentle mapping, legacy kept in store,
Endpoints aligned — I hop, then explore! 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 30.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title 'chore: switch Supabase host to sb.capgo.app' clearly and concisely describes the main change in the pull request—updating the Supabase host domain across multiple files and configurations.
Description check ✅ Passed The description includes Summary, Motivation, Business Impact, and Test plan sections. However, the Screenshots section only states 'N/A' and the Checklist indicates that documentation updates to the website repo are marked as not yet completed, which is a gap.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch riderx/sb-capgo-domain

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2edc0fedcc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

"supa_url": {
"prod": "https://xvwzpoazmxkqosrdewyv.supabase.co",
"preprod": "https://xvwzpoazmxkqosrdewyv.supabase.co",
"prod": "https://sb.capgo.app",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep prod SUPA_URL parseable to the project ref

Switching supa_url.prod/preprod to https://sb.capgo.app breaks the default bun types path: scripts/utils.mjs resolves this value on the main branch, and scripts/getTypes.mjs then derives --project-id from the first hostname label (split('.')[0].split('-')[0]), which becomes sb instead of the legacy ref (xvwzpoazmxkqosrdewyv) used elsewhere in this commit. That makes type generation point at the wrong Supabase project (or fail) until getTypes is updated for the new host format.

Useful? React with 👍 / 👎.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🧹 Nitpick comments (1)
supabase/functions/_backend/utils/stripe.ts (1)

24-37: Extract Supabase project-id parsing into one shared backend utility.

This logic now exists here and in supabase/functions/_backend/private/config.ts with subtle behavioral differences, which can drift over time. Consider centralizing one helper under _backend/utils and reusing it in both places.

Based on learnings: Use shared backend code in supabase/functions/_backend/ for all three deployment platforms rather than platform-specific code.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@supabase/functions/_backend/utils/stripe.ts` around lines 24 - 37, The
Supabase project-id parsing logic is duplicated with subtle differences; extract
it into a single shared helper (e.g., parseSupabaseProjectRef or
getSupabaseProjectId) under supabase/functions/_backend/utils and replace the
inline logic that uses legacySupabaseProjectRef, host, and the URL/split
fallback in both this file and supabase/functions/_backend/private/config.ts so
both call the new helper; ensure the helper preserves the special-case for
'sb.capgo.app' returning legacySupabaseProjectRef and otherwise returns
host.split('.')[0] or null.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/add_replicate.ts`:
- Line 4: Replace the hard-coded supabaseUrl constant in
scripts/add_replicate.ts by importing and using the shared config accessor
getRightKey from scripts/utils.mjs; remove the literal const supabaseUrl =
'https://sb.capgo.app' and instead call getRightKey with the appropriate key
name (e.g., 'supabaseUrl') to retrieve the environment-specific URL, ensuring
you add the import for getRightKey at the top of the file and use the returned
value wherever supabaseUrl was referenced.

In `@scripts/change_app_owner.ts`:
- Line 7: Replace the hard-coded supabaseUrl assignment with an env-aware lookup
by using getRightKey from scripts/utils.mjs: locate the const supabaseUrl
declaration in change_app_owner.ts and call getRightKey('SUPABASE_URL') (or the
appropriate key name used everywhere else) to obtain the environment-specific
URL instead of 'https://sb.capgo.app'; ensure you import or require getRightKey
from scripts/utils.mjs at the top of the file if not already imported.

In `@scripts/create_missing_customers_for_orgs.ts`:
- Line 21: Replace the hard-coded trigger URL with one built from the shared
supabase config by calling getRightKey('supa_url') and appending the path
'/functions/v1/triggers/on_organization_create'; import or ensure getRightKey
from scripts/utils.mjs is available in create_missing_customers_for_orgs.ts and
change the string
'https://sb.capgo.app/functions/v1/triggers/on_organization_create' to use the
constructed base from getRightKey('supa_url') + the function path.

In `@scripts/del_replicate.ts`:
- Line 5: Replace the hard-coded const supabaseUrl definition with a call to the
shared config utility: import and use getRightKey(...) from scripts/utils.mjs
and set supabaseUrl = getRightKey('SUPABASE_URL') (or the appropriate key name
used by your config). Update the top of the file to import getRightKey and
remove the literal 'https://sb.capgo.app', ensuring downstream code still
references the same const supabaseUrl.

In `@scripts/fix_app_stats_day_1.mjs`:
- Line 4: Replace the hard-coded supabaseUrl constant with an environment-aware
lookup: import and call getRightKey('supa_url') and assign its return to
supabaseUrl (replace the literal "https://sb.capgo.app"); ensure the file
imports getRightKey from the scripts utils module (reference:
getRightKey('supa_url') and the supabaseUrl constant) so the script honors
environment-specific configuration.

In `@supabase/functions/_backend/private/config.ts`:
- Around line 12-23: The fallback host parsing in the catch block can retain a
trailing :port so the subsequent legacy mapping check (host === 'sb.capgo.app')
and the returned supabase id can be wrong; update the catch/fallback logic that
sets host to also strip any trailing :port (e.g., remove /:\d+$/ or take part
before ':' and normalize case) before performing the legacySupabaseProjectRef
check and returning host.split('.')[0] in the function where host is defined.

---

Nitpick comments:
In `@supabase/functions/_backend/utils/stripe.ts`:
- Around line 24-37: The Supabase project-id parsing logic is duplicated with
subtle differences; extract it into a single shared helper (e.g.,
parseSupabaseProjectRef or getSupabaseProjectId) under
supabase/functions/_backend/utils and replace the inline logic that uses
legacySupabaseProjectRef, host, and the URL/split fallback in both this file and
supabase/functions/_backend/private/config.ts so both call the new helper;
ensure the helper preserves the special-case for 'sb.capgo.app' returning
legacySupabaseProjectRef and otherwise returns host.split('.')[0] or null.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3c2d2eb5-71f9-40c6-be20-7cdb08d0c494

📥 Commits

Reviewing files that changed from the base of the PR and between e11ef04 and 2edc0fe.

📒 Files selected for processing (11)
  • README.md
  • configs.json
  • scripts/add_replicate.ts
  • scripts/change_app_owner.ts
  • scripts/create_missing_customers_for_orgs.ts
  • scripts/del_replicate.ts
  • scripts/fix_app_stats_day_1.mjs
  • src/services/supabase.ts
  • supabase/functions/_backend/private/config.ts
  • supabase/functions/_backend/utils/stripe.ts
  • supabase/functions/_backend/utils/supaMetric.ts

import type { Database } from '../supabase/functions/_backend/utils/supabase.types.ts'

const supabaseUrl = 'https://xvwzpoazmxkqosrdewyv.supabase.co'
const supabaseUrl = 'https://sb.capgo.app'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid hard-coding supabaseUrl in scripts.

Line 4 should resolve the URL via shared script config access to keep prod/preprod/dev behavior consistent.

♻️ Proposed fix
+import { getRightKey } from './utils.mjs'
-const supabaseUrl = 'https://sb.capgo.app'
+const supabaseUrl = getRightKey('supa_url')

As per coding guidelines, scripts/**/*.{js,mjs,ts}: Use getRightKey(keyname) from scripts/utils.mjs to access environment-specific configuration values instead of hard-coding URLs.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const supabaseUrl = 'https://sb.capgo.app'
import { getRightKey } from './utils.mjs'
const supabaseUrl = getRightKey('supa_url')
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/add_replicate.ts` at line 4, Replace the hard-coded supabaseUrl
constant in scripts/add_replicate.ts by importing and using the shared config
accessor getRightKey from scripts/utils.mjs; remove the literal const
supabaseUrl = 'https://sb.capgo.app' and instead call getRightKey with the
appropriate key name (e.g., 'supabaseUrl') to retrieve the environment-specific
URL, ensuring you add the import for getRightKey at the top of the file and use
the returned value wherever supabaseUrl was referenced.

import { createClient } from 'https://esm.sh/@supabase/supabase-js'

const supabaseUrl = 'https://xvwzpoazmxkqosrdewyv.supabase.co'
const supabaseUrl = 'https://sb.capgo.app'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Use env-aware config lookup instead of a hard-coded Supabase URL.

Line 7 hard-codes the host, which bypasses branch/environment selection logic used elsewhere.

♻️ Proposed fix
+import { getRightKey } from './utils.mjs'
-const supabaseUrl = 'https://sb.capgo.app'
+const supabaseUrl = getRightKey('supa_url')

As per coding guidelines, scripts/**/*.{js,mjs,ts}: Use getRightKey(keyname) from scripts/utils.mjs to access environment-specific configuration values instead of hard-coding URLs.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const supabaseUrl = 'https://sb.capgo.app'
import { getRightKey } from './utils.mjs'
const supabaseUrl = getRightKey('supa_url')
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/change_app_owner.ts` at line 7, Replace the hard-coded supabaseUrl
assignment with an env-aware lookup by using getRightKey from scripts/utils.mjs:
locate the const supabaseUrl declaration in change_app_owner.ts and call
getRightKey('SUPABASE_URL') (or the appropriate key name used everywhere else)
to obtain the environment-specific URL instead of 'https://sb.capgo.app'; ensure
you import or require getRightKey from scripts/utils.mjs at the top of the file
if not already imported.


const res = await fetch(
'https://xvwzpoazmxkqosrdewyv.supabase.co/functions/v1/triggers/on_organization_create',
'https://sb.capgo.app/functions/v1/triggers/on_organization_create',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Build trigger URL from shared supa_url config, not a hard-coded host.

Line 21 should derive the base host through getRightKey('supa_url') and append the function path.

♻️ Proposed fix
+import { getRightKey } from './utils.mjs'
+
+const supabaseUrl = getRightKey('supa_url')
+const triggerUrl = `${supabaseUrl}/functions/v1/triggers/on_organization_create`
...
-                const res = await fetch(
-                    'https://sb.capgo.app/functions/v1/triggers/on_organization_create',
+                const res = await fetch(
+                    triggerUrl,

As per coding guidelines, scripts/**/*.{js,mjs,ts}: Use getRightKey(keyname) from scripts/utils.mjs to access environment-specific configuration values instead of hard-coding URLs.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/create_missing_customers_for_orgs.ts` at line 21, Replace the
hard-coded trigger URL with one built from the shared supabase config by calling
getRightKey('supa_url') and appending the path
'/functions/v1/triggers/on_organization_create'; import or ensure getRightKey
from scripts/utils.mjs is available in create_missing_customers_for_orgs.ts and
change the string
'https://sb.capgo.app/functions/v1/triggers/on_organization_create' to use the
constructed base from getRightKey('supa_url') + the function path.

import type { Database } from '../supabase/functions/_backend/utils/supabase.types.ts'

const supabaseUrl = 'https://xvwzpoazmxkqosrdewyv.supabase.co'
const supabaseUrl = 'https://sb.capgo.app'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Keep script URL resolution centralized via getRightKey.

Line 5 hard-codes the host; this should be sourced from shared script config utilities.

♻️ Proposed fix
+import { getRightKey } from './utils.mjs'
-const supabaseUrl = 'https://sb.capgo.app'
+const supabaseUrl = getRightKey('supa_url')

As per coding guidelines, scripts/**/*.{js,mjs,ts}: Use getRightKey(keyname) from scripts/utils.mjs to access environment-specific configuration values instead of hard-coding URLs.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const supabaseUrl = 'https://sb.capgo.app'
import { getRightKey } from './utils.mjs'
const supabaseUrl = getRightKey('supa_url')
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/del_replicate.ts` at line 5, Replace the hard-coded const supabaseUrl
definition with a call to the shared config utility: import and use
getRightKey(...) from scripts/utils.mjs and set supabaseUrl =
getRightKey('SUPABASE_URL') (or the appropriate key name used by your config).
Update the top of the file to import getRightKey and remove the literal
'https://sb.capgo.app', ensuring downstream code still references the same const
supabaseUrl.

import { createClient } from '@supabase/supabase-js'

const supabaseUrl = 'https://xvwzpoazmxkqosrdewyv.supabase.co'
const supabaseUrl = 'https://sb.capgo.app'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Switch to getRightKey('supa_url') for script configuration.

Line 4 hard-codes a single endpoint and skips environment-aware config handling.

♻️ Proposed fix
+import { getRightKey } from './utils.mjs'
-const supabaseUrl = 'https://sb.capgo.app'
+const supabaseUrl = getRightKey('supa_url')

As per coding guidelines, scripts/**/*.{js,mjs,ts}: Use getRightKey(keyname) from scripts/utils.mjs to access environment-specific configuration values instead of hard-coding URLs.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const supabaseUrl = 'https://sb.capgo.app'
import { getRightKey } from './utils.mjs'
const supabaseUrl = getRightKey('supa_url')
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/fix_app_stats_day_1.mjs` at line 4, Replace the hard-coded
supabaseUrl constant with an environment-aware lookup: import and call
getRightKey('supa_url') and assign its return to supabaseUrl (replace the
literal "https://sb.capgo.app"); ensure the file imports getRightKey from the
scripts utils module (reference: getRightKey('supa_url') and the supabaseUrl
constant) so the script honors environment-specific configuration.

@riderx riderx force-pushed the riderx/sb-capgo-domain branch from 2edc0fe to 75ce45d Compare March 7, 2026 16:21
@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 7, 2026

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
scripts/change_app_owner.ts (1)

43-44: ⚠️ Potential issue | 🟡 Minor

Pre-existing bug: Wrong error variable thrown.

Line 44 throws error1 instead of error2. While not introduced by this PR, it's worth fixing.

Proposed fix
   if (error2)
-    throw error1
+    throw error2
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/change_app_owner.ts` around lines 43 - 44, The code currently throws
the wrong error variable: when checking "if (error2)" the handler throws
"error1" instead of "error2"; update the throw to "throw error2" (or rethrow the
checked error variable) in the same conditional so the actual detected error is
propagated; locate the conditional that references error1/error2 and replace the
thrown variable accordingly.
♻️ Duplicate comments (1)
supabase/functions/_backend/private/config.ts (1)

8-24: ⚠️ Potential issue | 🟡 Minor

Normalize fallback host to strip port before legacy mapping.

The fallback parsing at Line 17 doesn't strip the port (e.g., sb.capgo.app:443), so the legacy mapping check at Line 20 would fail for URLs with explicit ports. This was flagged in a previous review but remains unaddressed.

Proposed fix
 function getSupabaseProjectId(supabaseUrl: string | null): string | undefined {
   if (!supabaseUrl)
     return undefined

   let host = ''
   try {
     host = new URL(supabaseUrl).hostname
   }
   catch {
-    host = supabaseUrl.replace(/^https?:\/\//, '').split('/')[0]
+    host = supabaseUrl.replace(/^https?:\/\//, '').split('/')[0].split(':')[0]
   }

   if (host === 'sb.capgo.app')
     return legacySupabaseProjectRef

   return host.split('.')[0] || undefined
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@supabase/functions/_backend/private/config.ts` around lines 8 - 24, The
fallback parsing in getSupabaseProjectId doesn't strip an explicit port (so
hosts like "sb.capgo.app:443" won't match the legacy mapping); update the catch
block in getSupabaseProjectId to remove any trailing ":port" from the parsed
host (for example strip /:\d+$ or split on ':' and take the first segment) so
that host is normalized before the legacySupabaseProjectRef check; ensure the
normalized host is used for both the legacy mapping comparison and the final
host.split('.')[0] extraction.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@supabase/functions/_backend/private/config.ts`:
- Around line 30-38: The conditional selection of SUPABASE_REPLICATE_URL is
unsafe and undocumented; update the handler (app.get('/', (c) => { ... })) to
always read getEnv(c, 'SUPABASE_URL') for supaHost and for computing
getSupabaseProjectId, removing any reference to SUPABASE_REPLICATE_URL and the
existInEnv(...) branch. Ensure supaKey and stripeEnabled remain unchanged and
that no replica URL logic remains in this function so the frontend always
receives a proper HTTPS Supabase API URL.

---

Outside diff comments:
In `@scripts/change_app_owner.ts`:
- Around line 43-44: The code currently throws the wrong error variable: when
checking "if (error2)" the handler throws "error1" instead of "error2"; update
the throw to "throw error2" (or rethrow the checked error variable) in the same
conditional so the actual detected error is propagated; locate the conditional
that references error1/error2 and replace the thrown variable accordingly.

---

Duplicate comments:
In `@supabase/functions/_backend/private/config.ts`:
- Around line 8-24: The fallback parsing in getSupabaseProjectId doesn't strip
an explicit port (so hosts like "sb.capgo.app:443" won't match the legacy
mapping); update the catch block in getSupabaseProjectId to remove any trailing
":port" from the parsed host (for example strip /:\d+$ or split on ':' and take
the first segment) so that host is normalized before the
legacySupabaseProjectRef check; ensure the normalized host is used for both the
legacy mapping comparison and the final host.split('.')[0] extraction.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c13ef299-e1cc-49a5-b1cf-188e09660707

📥 Commits

Reviewing files that changed from the base of the PR and between 2edc0fe and 75ce45d.

📒 Files selected for processing (11)
  • README.md
  • configs.json
  • scripts/add_replicate.ts
  • scripts/change_app_owner.ts
  • scripts/create_missing_customers_for_orgs.ts
  • scripts/del_replicate.ts
  • scripts/fix_app_stats_day_1.mjs
  • src/services/supabase.ts
  • supabase/functions/_backend/private/config.ts
  • supabase/functions/_backend/utils/stripe.ts
  • supabase/functions/_backend/utils/supaMetric.ts
✅ Files skipped from review due to trivial changes (1)
  • scripts/add_replicate.ts
🚧 Files skipped from review as they are similar to previous changes (6)
  • supabase/functions/_backend/utils/stripe.ts
  • supabase/functions/_backend/utils/supaMetric.ts
  • README.md
  • scripts/del_replicate.ts
  • configs.json
  • scripts/create_missing_customers_for_orgs.ts

Comment on lines 30 to 38
app.get('/', (c) => {
const supabaseUrl = existInEnv(c, 'SUPABASE_REPLICATE_URL') ? getEnv(c, 'SUPABASE_REPLICATE_URL') : getEnv(c, 'SUPABASE_URL')

return c.json({
supaHost: existInEnv(c, 'SUPABASE_REPLICATE_URL') ? getEnv(c, 'SUPABASE_REPLICATE_URL') : getEnv(c, 'SUPABASE_URL'),
supbaseId: getEnv(c, 'SUPABASE_URL')?.split('//')[1].split('.')[0].split(':')[0],
supaHost: supabaseUrl,
supbaseId: getSupabaseProjectId(supabaseUrl),
supaKey: getEnv(c, 'SUPABASE_ANON_KEY'),
stripeEnabled: isStripeConfigured(c),
})
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for SUPABASE_REPLICATE_URL usage patterns to understand its expected format
rg -n "SUPABASE_REPLICATE_URL" --type-add 'config:*.{env,json,toml,yaml,yml}' -g '!node_modules'

# Check if there's documentation or env examples showing the expected format
fd -e md -e env.example -e env.local | xargs grep -l "REPLICATE" 2>/dev/null | head -5 | xargs cat 2>/dev/null

Repository: Cap-go/capgo

Length of output: 232


🏁 Script executed:

# Check how SUPABASE_REPLICATE_URL is used - is it queried elsewhere?
rg -n "SUPABASE_REPLICATE_URL" 

# Check if supabaseUrl/supaHost is used in frontend and how
rg -n "supaHost" 

# Look for any comments around the SUPABASE_REPLICATE_URL line
sed -n '25,40p' supabase/functions/_backend/private/config.ts

Repository: Cap-go/capgo

Length of output: 3287


🏁 Script executed:

# Check how createClient is called in frontend to understand expected format
rg -n "createClient.*supaHost|config\.supaHost" --type ts --type js

# Look for environment setup/documentation files
fd -e md | xargs grep -l "SUPABASE.*URL" 2>/dev/null | head -5

Repository: Cap-go/capgo

Length of output: 1578


🏁 Script executed:

# Check the relevant documentation files
cat AGENTS.md | head -50

# Check read_replicate/README.md for details
cat read_replicate/README.md

Repository: Cap-go/capgo

Length of output: 6197


🏁 Script executed:

# Also check the actual createClient implementation to understand what format it expects
rg -A 5 "export function createClient" src/services/supabase.ts

Repository: Cap-go/capgo

Length of output: 38


🏁 Script executed:

# Check the imports and actual createClient implementation
head -20 src/services/supabase.ts

# Also check if there's any type definition for the first parameter of createClient
rg -A 2 "createClient.*config.supaHost" src/services/supabase.ts

Repository: Cap-go/capgo

Length of output: 778


🏁 Script executed:

# Search for environment documentation showing SUPABASE_REPLICATE_URL format
fd -e 'env.example' -o -e '.env.template' | xargs grep -l "SUPABASE" 2>/dev/null | head -3 | xargs cat

# Also search for any comments or documentation about this URL in the codebase
rg -B 3 -A 3 "SUPABASE_REPLICATE_URL" 

# Check git history or README for setup instructions
fd README | head -5 | xargs grep -A 5 "SUPABASE.*URL" 2>/dev/null

Repository: Cap-go/capgo

Length of output: 732


🏁 Script executed:

# Search for environment files more carefully
find . -type f \( -name "*.env*" -o -name "*env*.example*" -o -name "*env*.sample*" \) 2>/dev/null | grep -v node_modules

# Check if there's any documentation in the supabase directory
find supabase -name "*.md" | xargs cat 2>/dev/null | grep -i "REPLICATE\|SUPABASE_URL" -A 2 -B 2

Repository: Cap-go/capgo

Length of output: 318


🏁 Script executed:

# Check if SUPABASE_REPLICATE_URL is used elsewhere in backend functions
rg "SUPABASE.*URL" supabase/functions/_backend/ -A 1 -B 1

Repository: Cap-go/capgo

Length of output: 7367


🏁 Script executed:

# Check the .env.example file to see documented format
cat supabase/functions/.env.example

Repository: Cap-go/capgo

Length of output: 1611


🏁 Script executed:

# Check the .env file for actual runtime values
cat supabase/functions/.env

# Search for any deployment or environment setup documentation
fd -e md | xargs grep -l "REPLICATE_URL\|REPLICATE" 2>/dev/null | head -3 | xargs cat

Repository: Cap-go/capgo

Length of output: 1610


🏁 Script executed:

# Search for any actual uses of SUPABASE_REPLICATE_URL being set
rg "SUPABASE_REPLICATE_URL\s*=" --type-add 'config:*.{env,json,toml,yaml,yml,sh}'

# Check if it's referenced in deployment/CI configs
find . -path ./node_modules -prune -o -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.sh" \) -print | xargs grep -l "REPLICATE_URL" 2>/dev/null

# Look at how createSupabaseClient is actually used in backend to see the expected URL format
rg -B 5 -A 10 "function createSupabaseClient|export.*createClient" supabase/functions/_backend/utils/supabase.ts

Repository: Cap-go/capgo

Length of output: 38


🏁 Script executed:

# Check if SUPABASE_REPLICATE_URL is actually used anywhere else in the entire codebase
rg "SUPABASE_REPLICATE_URL" --type-add 'all:*'

# Check the actual createSupabaseClient implementation to understand the expected format
sed -n '80,120p' supabase/functions/_backend/utils/supabase.ts

Repository: Cap-go/capgo

Length of output: 1392


🏁 Script executed:

# Check if SUPABASE_REPLICATE_URL is ever set or configured anywhere
rg "REPLICATE" --type sh --type ts --type js

# Look at the context around the config endpoint to understand its purpose
sed -n '20,50p' supabase/functions/_backend/private/config.ts

Repository: Cap-go/capgo

Length of output: 760


Clarify the purpose and format of SUPABASE_REPLICATE_URL; if unused, remove the conditional logic.

The supaHost returned to the frontend is passed directly to createClient(), which expects an HTTPS Supabase API URL. SUPABASE_REPLICATE_URL is undocumented, never set in any environment configuration, and its intended format is unclear. If this variable were set to a PostgreSQL replica connection string (matching the pattern in read_replicate/README.md), all frontend Auth/REST API calls would fail. Either document the required format explicitly and add validation, or remove this conditional logic entirely and always use SUPABASE_URL.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@supabase/functions/_backend/private/config.ts` around lines 30 - 38, The
conditional selection of SUPABASE_REPLICATE_URL is unsafe and undocumented;
update the handler (app.get('/', (c) => { ... })) to always read getEnv(c,
'SUPABASE_URL') for supaHost and for computing getSupabaseProjectId, removing
any reference to SUPABASE_REPLICATE_URL and the existInEnv(...) branch. Ensure
supaKey and stripeEnabled remain unchanged and that no replica URL logic remains
in this function so the frontend always receives a proper HTTPS Supabase API
URL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant