H

app/core/auth.py

@@ -10,22 +10,27 @@ from typing import Optional
 
 from fastapi import Request, HTTPException, status
 
-from app.core.config import SUPABASE_ANON_KEY
+from app.core.config import SUPABASE_ANON_KEY, SUPABASE_JWT_SECRET
 
 log = logging.getLogger("auth")
 
 
 def _validate_jwt(token: str) -> Optional[dict]:
     """Validate JWT and return payload if valid."""
+    if not SUPABASE_JWT_SECRET:
+        log.warning("SUPABASE_JWT_SECRET is not configured - token verification will be insecure")
+        return None
+    
     try:
         payload = jwt.decode(
             token,
-            options={"verify_signature": False},
-            algorithms=["HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"],
+            SUPABASE_JWT_SECRET,
+            algorithms=["HS256"],
+            options={"verify_aud": False},
         )
         return payload
     except jwt.ExpiredSignatureError:
-        log.warning("JWT expired")
+        log.warning("JWT expired - user may need to refresh or re-authenticate")
         return None
     except jwt.InvalidTokenError as exc:
         log.warning("JWT decode failed: %s", exc)

app/core/config.py

@@ -19,6 +19,7 @@ SUPABASE_URL = os.environ.get(
     "https://yevtnyokixocpihpdwqu.supabase.co",
 )
 SUPABASE_ANON_KEY = os.environ.get("SUPABASE_ANON_KEY", "")
+SUPABASE_JWT_SECRET = os.environ.get("SUPABASE_JWT_SECRET", "")
 
 
 # --------------------------------------------------------------------------- #