Fix Hardcoded Supabase Service Key Bypass

[ArshVermaGit]

Description

This PR addresses a critical security vulnerability where the FastAPI backend was connecting to the Supabase database using the Service Role Key instead of the Anon Key.
Changes Made:

• Modified backend/main.py to initialize the Supabase client using SUPABASE_ANON_KEY.
• Updated logging errors and warnings to reflect the key change.
• Updated backend/.env.example to require SUPABASE_ANON_KEY instead of SUPABASE_SERVICE_KEY.
  By swapping to the Anon Key, the global Supabase client no longer bypasses Row-Level Security (RLS). Any data operations performed will be subjected to the RLS policies defined in the database, preventing unauthorized mass data modification or deletion.

Resolved Issue

Resolves #2036

Summary by CodeRabbit

• Chores
  • Updated backend authentication configuration to use anonymous key credentials instead of service key credentials, improving security alignment with row-level access control policies.

[vercel]

@ArshVermaGit is attempting to deploy a commit to the ritesh Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

📝 Walkthrough

Walkthrough

Backend Supabase client initialization switches from service-role key to anon key to enforce Row-Level Security. The environment template example and startup configuration are updated to reflect the change from SUPABASE_SERVICE_KEY to SUPABASE_ANON_KEY.

Changes

Supabase Client Authentication via Anon Key

Layer / File(s)	Summary
Anon key environment template and client initialization backend/.env.example, backend/main.py	Environment example updated from SUPABASE_SERVICE_KEY to SUPABASE_ANON_KEY; Supabase client initialization reads SUPABASE_ANON_KEY instead of the service-role key, and startup validation error references the anon key requirement.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• ritesh-1918/HELPDESK.AI#1792: Both PRs touch backend/.env.example to add/document SUPABASE_ANON_KEY, aligning Supabase client configuration around the anon key.
• ritesh-1918/HELPDESK.AI#956: Both PRs adjust Supabase client configuration to rely on the anon key supplied via environment variables (backend backend/main.py uses SUPABASE_ANON_KEY instead of service-key style bypass, while MobileApp src/lib/supabase.js reads EXPO_PUBLIC_SUPABASE_ANON_KEY).

Suggested labels

type:security, level:critical, quality:clean

Poem

🐰 A key swap makes the database sing,
No service bypass brings the spring,
RLS now stands tall and true,
Security through and through! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: fixing the security vulnerability of replacing SUPABASE_SERVICE_KEY with SUPABASE_ANON_KEY to prevent RLS bypass.
Linked Issues check	✅ Passed	The pull request fully addresses all acceptance criteria from issue #2036: stopped using SUPABASE_SERVICE_KEY, switched to SUPABASE_ANON_KEY, and updated environment templates.
Out of Scope Changes check	✅ Passed	All changes directly address the security vulnerability scope: Supabase client initialization updates in main.py and environment example template modifications align with issue #2036 objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ArshVermaGit]

Hi @ritesh-1918 ! The issue has been resolved. Please review the PR and merge it under GSSoC. Thanks!

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/main.py`:
- Around line 38-44: Multiple backend modules are instantiating privileged
Supabase service-role clients (create_client(url, key) with SUPABASE_SERVICE_KEY
/ SUPABASE_SERVICE_ROLE_KEY) which can bypass RLS; centralize and lock down
service-role usage by introducing a single admin-only factory (e.g., an explicit
get_admin_supabase_client function) located in a secure module and replace
direct create_client calls in rag_service.py, notification_routing.py,
auto_close_service.py and seed_company_settings.py with either the safe anon
client or the guarded admin factory; enforce an allowlist/justification check in
that factory (throw/deny if called from tenant/request-facing paths) and
document/limit its use to admin-only scripts or endpoints only.
- Around line 42-47: The current code creates a single global Supabase client
with create_client(url, key) and never attaches the request JWT from
extract_token(), causing RLS checks to run as anon; change to create or
configure a request-scoped Supabase client (or set the session/auth on the
client) inside each incoming request handler before any RLS-protected calls
(e.g., before get_system_settings, get_ticket_by_id, ticket/ticket_messages
reads/writes and profile lookups), by using the bearer/cookie token returned
from extract_token() so get_current_user() and subsequent supabase.table(...)
queries execute with the correct user context rather than the global anon
client.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3d427bd4-cbed-42dd-8ab4-6b0480995099

📥 Commits

Reviewing files that changed from the base of the PR and between da8faf2 and fb4320c.

📒 Files selected for processing (2)

• backend/.env.example
• backend/main.py

[riteshbonthalakoti]

Hi @ArshVermaGit! Thanks for the contribution. I have triaged your PR and set it to merge into the gssoc branch.

⚠️ MANDATORY GSSOC ONBOARDING STEPS:
Before your PR points are finalized on the leaderboard, you MUST complete these required steps:

1. ⭐ Star this repository: https://github.com/ritesh-1918/HELPDESK.AI (Mandatory)
2. 👤 Follow the Project Admin: https://github.com/ritesh-1918 (Mandatory)
3. 💼 Connect on LinkedIn: https://www.linkedin.com/in/ritesh1908/ (Mandatory)

Welcome to the HELPDESK.AI developer family! 🚀💻