Context
The final administrator recovery RPC permissions were removed in #201 and production no longer calls setAdminPasswordWithAccessToken.
A follow-up cleanup attempted to remove the dead helper from src/lib/supabase-gateway.ts, but the file also contains the legacy Supabase anon JWT used by active Edge Function calls. The repository connector correctly blocked rewriting credential-bearing source.
Current dependency
The deployed project still has multiple active Edge Functions with verify_jwt=true, including:
gem-auth-gatewaygem-admin-readgem-admin-writegem-e2e-provisiongem-admin-login-smokegem-verify-evidence-gatewaygem-password-recovery
These functions currently require a JWT in Authorization. Supabase publishable keys are not JWTs and cannot be substituted in that header without changing the function authentication model.
Required migration
- Inventory all callers and authorization checks for the affected Edge Functions.
- Move the legacy anon JWT out of source and into managed runtime configuration, or migrate each function to an approved publishable-key/custom-auth model with
verify_jwt=false only where the function body provides equivalent authentication.
- Validate each function independently before deactivating the legacy key.
- Remove
gatewayProjectUrl, setAdminPasswordWithAccessToken, the bcrypt import, and the obsolete RPC client test after the key is no longer embedded in src/lib/supabase-gateway.ts.
- Confirm no production caller references
/rest/v1/rpc/gem_consume_admin_access_token.
Safety
Do not disable JWT verification in bulk. Do not replace the legacy key with a publishable key in the Authorization header. Preserve login, recovery, evidence, and administrator authorization behavior through staged exact-head previews and production verification.
Context
The final administrator recovery RPC permissions were removed in #201 and production no longer calls
setAdminPasswordWithAccessToken.A follow-up cleanup attempted to remove the dead helper from
src/lib/supabase-gateway.ts, but the file also contains the legacy Supabase anon JWT used by active Edge Function calls. The repository connector correctly blocked rewriting credential-bearing source.Current dependency
The deployed project still has multiple active Edge Functions with
verify_jwt=true, including:gem-auth-gatewaygem-admin-readgem-admin-writegem-e2e-provisiongem-admin-login-smokegem-verify-evidence-gatewaygem-password-recoveryThese functions currently require a JWT in
Authorization. Supabase publishable keys are not JWTs and cannot be substituted in that header without changing the function authentication model.Required migration
verify_jwt=falseonly where the function body provides equivalent authentication.gatewayProjectUrl,setAdminPasswordWithAccessToken, the bcrypt import, and the obsolete RPC client test after the key is no longer embedded insrc/lib/supabase-gateway.ts./rest/v1/rpc/gem_consume_admin_access_token.Safety
Do not disable JWT verification in bulk. Do not replace the legacy key with a publishable key in the
Authorizationheader. Preserve login, recovery, evidence, and administrator authorization behavior through staged exact-head previews and production verification.