DebateOwl/supabase/config.toml at main · Programcode/DebateOwl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# This file configures Supabase Edge Function behavior per function.
# See: https://supabase.com/docs/guides/functions/function-configuration

# Disable gateway-level JWT verification for export-gdoc since we handle
# authentication manually in the function code. This allows us to see
# application logs and handle errors properly.
[functions.export-gdoc]
verify_jwt = false

# These functions validate Bearer tokens in-function via supabase.auth.getUser.
# Disabling gateway JWT verification avoids false 401s before function logic runs.
[functions.ai]
verify_jwt = false

[functions.ai-stream]
verify_jwt = false

[functions.admin]
verify_jwt = false

[functions.announcements]
verify_jwt = false

[functions.create-checkout]
verify_jwt = false

[functions.create-portal]
verify_jwt = false

[functions.redeem-promo]
verify_jwt = false

[functions.import-source]
verify_jwt = false

[functions.voice]
verify_jwt = false

[functions.workspace-invites]
verify_jwt = false

[functions.account]
verify_jwt = false

# Stripe webhook calls come from Stripe (no Supabase JWT), so gateway JWT
# verification must be disabled for this endpoint.
[functions.stripe-webhook]
verify_jwt = false

# Demo code sign-in happens before the caller has a Supabase session, so
# there is no JWT yet to verify at the gateway.
[functions.demo-code-login]
verify_jwt = false

# The /ai-debate mini round runs with no account, so no JWT. The function
# checks the origin, a Turnstile token and its own rate limits instead.
[functions.demo-rebuttal]
verify_jwt = false

[auth.email]
otp_length = 6
max_frequency = "1s"

[auth.email.template.magic_link]
subject = "Your DebateOwl sign-in code"
content_path = "./supabase/templates/magic_link.html"

# A first email sign-in creates the account, so Auth sends this template
# instead of magic_link. Same subject and code-only body: the code never goes
# in the subject, and there is no link to open in the wrong browser.
[auth.email.template.confirmation]
subject = "Your DebateOwl sign-in code"
content_path = "./supabase/templates/confirmation.html"