From 35d92d217628fa3191617529e7bd92ecaab4998a Mon Sep 17 00:00:00 2001 From: Krao Hasanee Date: Sun, 31 May 2026 11:19:43 -0400 Subject: [PATCH] fix: allow service role auth on migrate-old-books endpoint --- api/migrate-old-books.js | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/api/migrate-old-books.js b/api/migrate-old-books.js index 48d88ea..ceaf5e4 100644 --- a/api/migrate-old-books.js +++ b/api/migrate-old-books.js @@ -88,16 +88,21 @@ export default async function handler(req, res) { if (req.method !== 'POST') return res.status(405).json({ error: 'POST only' }); const authHeader = req.headers.authorization || ''; + const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY || ''; const supabaseUrl = process.env.VITE_SUPABASE_URL || process.env.SUPABASE_URL; const supabaseKey = process.env.VITE_SUPABASE_ANON_KEY || process.env.SUPABASE_ANON_KEY; - const sb = createClient(supabaseUrl, supabaseKey, { - auth: { persistSession: false }, - global: { headers: { Authorization: authHeader } }, - }); - const { data: { user } } = await sb.auth.getUser(); - if (!user) return res.status(401).json({ error: 'Unauthorized' }); - const { data: profile } = await sb.from('profiles').select('role').eq('id', user.id).single(); - if (profile?.role !== 'team') return res.status(403).json({ error: 'Team only' }); + const isServiceRole = serviceKey && authHeader === `Bearer ${serviceKey}`; + if (!isServiceRole) { + const sb = createClient(supabaseUrl, supabaseKey, { + auth: { persistSession: false }, + global: { headers: { Authorization: authHeader } }, + }); + const { data: { user } } = await sb.auth.getUser(); + if (!user) return res.status(401).json({ error: 'Unauthorized' }); + const { data: profile } = await sb.from('profiles').select('role').eq('id', user.id).single(); + if (profile?.role !== 'team') return res.status(403).json({ error: 'Team only' }); + } + const sb = createClient(supabaseUrl, serviceKey || supabaseKey, { auth: { persistSession: false } }); const config = getConfig(); if (!config.configured) return res.status(500).json({ error: 'FileBrowser not configured' });