0.1.0

wolai-backend/app/deps.py

@@ -23,22 +23,28 @@ class AuthContext:
 
 async def get_current_user(
     authorization: Annotated[Optional[str], Header(convert_underscores=False)] = None,
+    x_supabase_access_token: Annotated[
+        Optional[str], Header(convert_underscores=False, alias="x-supabase-access-token")
+    ] = None,
 ) -> AuthContext:
     """
     验证 Supabase JWT，stage0 直接依赖 service_role 解析 token。
     生产环境应通过 API Gateway 注入 user。
     """
-    if not authorization or not authorization.startswith("Bearer "):
+    header_token = authorization or (f"Bearer {x_supabase_access_token}" if x_supabase_access_token else None)
+    if not header_token or not header_token.startswith("Bearer "):
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing bearer token")
 
-    token = authorization.replace("Bearer ", "", 1).strip()
+    token = header_token.replace("Bearer ", "", 1).strip()
     if not token:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Empty token")
+    print(f"[auth] Validating Supabase token prefix={token[:8]}")
 
     auth_url = f"{settings.supabase_url.rstrip('/')}/auth/v1/user"
+    apikey = settings.supabase_anon_key or settings.supabase_service_role_key
     headers = {
         "Authorization": f"Bearer {token}",
-        "apikey": settings.supabase_service_role_key,
+        "apikey": apikey,
     }
     async with httpx.AsyncClient(timeout=10.0) as client:
         try: