refactor: remove the Supabase dependency surface from the repo

[AlaskanTuna]

Closes #8. Completes the Phase 12 migration — Supabase is now gone from every tracked file except two deliberate historical notes.

What changed

• Dependency + dead code. @supabase/supabase-js removed from both workspaces; backend/src/config/supabase.ts deleted (it had zero importers — dead since Migrate cached GeoTIFF and imagery storage to Cloudflare R2 #5); supabase/ directory deleted (7 tracked files: config, the profiles migration, and the 4 email templates already ported to backend/src/emails/ in Send verification and password-reset email directly via Resend #7). Lockfile shed 86 lines.
• Env surface. SUPABASE_URL / SUPABASE_SERVICE_ROLE_KEY dropped from the env.ts Zod schema; the dead Supabase and SITE_URL blocks removed from .env.example.
• Docs. README.md, RUNBOOK.md, and docs/trd.md retargeted to Neon / Cloudflare R2 / Better Auth / Resend HTTP. RUNBOOK §6 ("Sync Supabase auth config") deleted and §7–§11 renumbered; every TOC anchor re-verified.

Two fixes beyond the cleanup

A boot-breaking regression from #6. env.ts required BETTER_AUTH_SECRET and BETTER_AUTH_URL, but .env.example never listed them — a fresh clone following the documented setup could not start the backend. CI never catches this because CI never boots from .env.example. Now verified programmatically: every required Zod key is present.

The PDPA privacy policy was legally wrong, not just stale. All three locales named Supabase as a data processor for Auth/Postgres/Storage and omitted Resend entirely — a processor that genuinely receives user email addresses. They also claimed row-level security protects user records; RLS no longer exists, authorization is enforced in the Express layer against the Better Auth session. Session storage was described as browser storage when it is now an HTTP-only cookie. lastUpdated bumped accordingly.

Review found three defects in generated content

Implementation ran as four parallel Codex workers on disjoint scopes. Every mechanical deletion was correct; the one section written from scratch (RUNBOOK §3.2 Neon/R2) carried three defects, all fixed before commit:

1. Heroku config:set omitted connect_timeout=15&pool_timeout=20 — copy-pasting it would have redeployed the exact Neon cold-start 500 fixed earlier the same day.
2. pool_timeout=20 absent from the whole file, despite .env.example documenting it as load-bearing (Prisma's 10 s pool default otherwise defeats the larger connect timeout).
3. R2 provisioning nested inside a Prisma-timeout blockquote, rendering as a skippable sub-note.

Deliberately not done

Heroku config vars untouched. The app holds 4 stale SUPABASE_* vars plus SITE_URL and 2 VITE_SUPABASE_*, and is missing every new required var — it cannot boot either way. Removing the dead ones alone fixes nothing, and setting the new ones presumes Heroku wins the hosting decision #9 exists to make. Deferred to #9 as one atomic cutover.

GitHub Actions needed no change — only HEROKU_API_KEY and HEROKU_APP_NAME were ever set. The issue assumed Supabase secrets that were never there.

Two scope corrections to the issue text

frontend/vite.config.ts never referenced Supabase — the VITE_SUPABASE_* lines live in the gitignored vite.config.js build artifact. And .github/workflows/ci-cd.yml had zero Supabase references.

Verification

• git ls-files -z | xargs -0 grep -il supabase → only backend/src/config/auth.ts and prisma/schema.prisma, both deliberate historical notes
• 216 frontend + 146 backend tests · typecheck 0 · eslint 0 errors / 61 warnings (unchanged) · prettier clean · build clean
• All three privacy.json locales verified to have identical key structure (28 leaves each)
• Rewritten architecture Mermaid diagram validated

https://claude.ai/code/session_01J6uoj2LBZBMeEkfyx3Bvn8

Summary by CodeRabbit

• New Features

  • Authentication and account sessions now use Better Auth.
  • Data storage has transitioned to Neon Postgres and Cloudflare R2.
  • Account emails are delivered through Resend.

• Documentation

  • Updated setup, deployment, architecture, and troubleshooting guidance for the new services.
  • Refreshed privacy policies in English, Malay, and Chinese to describe updated data handling, storage, cookies, and providers.

• Chores

  • Removed legacy Supabase configuration and authentication references.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eedb2bee-ec5e-4995-867d-5d4e83df6d90

📥 Commits

Reviewing files that changed from the base of the PR and between 3ac75a5 and 04b4d47.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (31)

• .env.example
• README.md
• RUNBOOK.md
• backend/package.json
• backend/src/config/env.ts
• backend/src/config/supabase.ts
• backend/src/services/chat/__tests__/client.test.ts
• backend/src/services/chat/__tests__/digest.test.ts
• backend/src/services/chat/__tests__/errors.test.ts
• backend/src/services/chat/__tests__/guardrails.test.ts
• backend/src/services/chat/__tests__/retry.test.ts
• backend/src/services/chat/__tests__/streamChat.test.ts
• backend/src/services/overlayService.ts
• frontend/package.json
• frontend/src/api/locations.ts
• frontend/src/api/projects.ts
• frontend/src/hooks/useLocale.tsx
• frontend/src/lib/buildingInsights.ts
• frontend/src/lib/i18n.ts
• frontend/src/locales/en/privacy.json
• frontend/src/locales/ms/privacy.json
• frontend/src/locales/zh/privacy.json
• graphify-out/GRAPH_REPORT.md
• graphify-out/graph.json
• supabase/.gitignore
• supabase/config.toml
• supabase/migrations/20260416222141_add_profiles_and_tier.sql
• supabase/templates/confirm.html
• supabase/templates/email_change.html
• supabase/templates/invite.html
• supabase/templates/reset.html

🔥 Files not summarized due to errors (1)

• graphify-out/graph.json: Server error: no LLM provider could handle the message

---

📝 Walkthrough

Walkthrough

The repository removes Supabase configuration and SDK references, documents Better Auth with Neon Postgres and Cloudflare R2, updates deployment procedures and privacy policies, and regenerates the dependency graph report.

Changes

Provider migration cleanup

Layer / File(s)	Summary
Runtime configuration and dependency cleanup .env.example, backend/package.json, backend/src/config/*, backend/src/services/chat/__tests__/*, frontend/package.json, frontend/src/api/*, frontend/src/hooks/*, frontend/src/lib/*	Supabase environment validation, SDK dependencies, test fixtures, and provider references were removed or replaced with Better Auth, Neon, and R2 terminology.
Operational provider documentation README.md, RUNBOOK.md	Architecture, setup, deployment, environment variables, troubleshooting, teardown, and CLI guidance were rewritten for the new provider configuration.
Localized privacy policy updates frontend/src/locales/{en,ms,zh}/privacy.json	Privacy-policy dates, authentication, cookies, processors, retention, security, and cross-border transfer descriptions were updated.
Regenerated dependency graph report graphify-out/GRAPH_REPORT.md	Graph metrics, navigation hubs, communities, dependency annotations, knowledge gaps, and suggested questions were regenerated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• Replace Supabase Auth with a self-hosted auth layer (email/password + Google SSO) #6 — Covers the Supabase Auth replacement with Better Auth, Neon, and Cloudflare R2.

Possibly related PRs

• AlaskanTuna/SolarSim#22 — Overlaps in removing Supabase environment wiring and updating Neon/R2 backend configuration.
• AlaskanTuna/SolarSim#24 — Directly connects through Better Auth configuration, middleware, and environment validation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/remove-supabase-surface

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}