Skip to content

Fly.io Launch config files#1

Open
fly-io[bot] wants to merge 1 commit intomainfrom
flyio-new-files
Open

Fly.io Launch config files#1
fly-io[bot] wants to merge 1 commit intomainfrom
flyio-new-files

Conversation

@fly-io
Copy link
Copy Markdown

@fly-io fly-io Bot commented May 14, 2025

No description provided.

@vercel
Copy link
Copy Markdown

vercel Bot commented May 14, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
orbit-ai ✅ Ready (Inspect) Visit Preview 💬 Add feedback May 14, 2025 10:17pm

richelgomez99 pushed a commit that referenced this pull request Nov 17, 2025
SECURITY FIX - Addresses SEC-01 CRITICAL vulnerability

Changes:
- Created server-side Supabase client with admin privileges
- Implemented authedProcedure middleware for JWT validation
- Updated Context interface to include authenticated user and userId
- Secured all task router endpoints with authedProcedure
- Secured all mode router endpoints with authedProcedure
- Added ownership verification for update/delete operations
- Updated frontend tRPC client to send JWT in Authorization header
- Removed insecure getDefaultUserId() hack
- Added comprehensive test suite for auth middleware
- Updated .env.example with required Supabase environment variables

Security Features:
- All tRPC mutations now require valid JWT token
- User ID extracted from validated JWT (never trusted from client)
- Authorization checks prevent users from accessing other users' data
- Clear error messages for unauthorized requests
- Server-side token validation with Supabase Admin API

Breaking Changes:
- All tRPC endpoints now require authentication
- Unauthenticated requests will receive 401 UNAUTHORIZED error
- Frontend must have active Supabase session to make API calls

Fixes: SEC-01 (CRITICAL - Unauthenticated tRPC endpoints)
Related: #1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants