Supabase Auth
- /login and /signup use Supabase SSR cookies via apps/web middleware.
- Supported login flows include email/password and magic link.
- When Cloudflare Turnstile is enabled, the widget appears before the OAuth redirect and must succeed before the GitLab handoff continues.
- BFF routes read session and map to organization membership.
- GET /api/auth/status reports whether auth is configured.
Local dev modes
- Real auth: set Supabase keys; pnpm run dev uses your Supabase user as profileId.
- Local verification mode: PREMORTEM_AUTH_DISABLED=1 with LOCAL_DEV_FIXTURE (verification scripts only).
- Never enable PREMORTEM_AUTH_DISABLED in production.
Local dev
Use http://127.0.0.1:13000 consistently for NEXT_PUBLIC_APP_URL in local GitLab OAuth apps.
PREMORTEM_AUTH_DISABLED=1
PREMORTEM_SMOKE_USE_FIXTURE=1
pnpm run smoke:localGitLab OAuth (integration)
- Distinct from login: authorizes repo read and issue publish scopes.
- Redirect URI: {NEXT_PUBLIC_APP_URL}/api/integrations/callback/gitlab.
- Connect route: GET /api/integrations/connect/gitlab?next=/app.
Warning
Mismatching localhost vs 127.0.0.1 in NEXT_PUBLIC_APP_URL causes OAuth redirect errors and /login loops.
Common auth issues
- ERR_TOO_MANY_REDIRECTS on /login: canonical host redirect; align APP URL and OAuth callback host.
- 401 on /api/workspace: session expired or auth disabled without local verification credentials.
- Callback failure on /login or /signup: Supabase could not exchange the external code for a session, or the callback host did not match NEXT_PUBLIC_APP_URL.
- Captcha-config notice on /login or /signup: Turnstile is enabled but NEXT_PUBLIC_TURNSTILE_SITE_KEY or TURNSTILE_SECRET_KEY is missing in the deployment environment.
- Empty /app after login: workspace exists but no projects registered yet, or the current role only exposes profile, billing, and model settings.
