Multiple Supabase client instances with debug code logging sessions in production

Open
#60 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Quiet
Tech stack
next.js, supabase, typescript
Domain
authentication, full-stack, security

Research direction

Start by reading src/lib/supabase.ts, src/lib/supabase-admin.ts, src/utils/supabase/server.ts, src/utils/supabase/client.ts, and src/utils/supabase/authActions.ts. Trace which modules import each client and how browser, server, and service-role usage are separated. Done means the debug session logging is gone, the service-role client cannot reach browser code, and the remaining client usage follows one consistent pattern.

Written by the indexing model from the issue text.

Description

bug help wanted

Issue

The project has at least 3 separate Supabase client configurations with inconsistent usage:

  1. src/lib/supabase.ts - createBrowserClient (shared, with debug code)
  2. src/lib/supabase-admin.ts - createClient with service role key
  3. src/utils/supabase/server.ts - createServerClient
  4. src/utils/supabase/client.ts - Another browser client
  5. src/utils/supabase/authActions.ts - Auth-specific client

Why this matters

  1. Debug code left in production - supabase.ts:16-19:

    supabase.auth.getSession().then(res => {
  console.log("📦 [supabase.ts] Initial session:", res);
}).catch(err => {
  console.error("❌ [supabase.ts] Session fetch error:", err);
});

    This runs every time the module is imported - on every page load, logging session data to the console.

  2. Potential for service role key leaks - If supabase-admin.ts is ever imported on the client side (even accidentally), the SUPABASE_SERVICE_ROLE_KEY would be exposed to the browser, giving full database admin access.

  3. Inconsistent session handling - Different parts of the app use different client instances, which may have different cookie/session states.

Fix

  1. Remove the debug getSession() code from supabase.ts
  2. Ensure supabase-admin.ts is only imported in server-side code (use if (typeof window === 'undefined') guard or move to a server-only directory)
  3. Consolidate to a single client factory pattern
Dominant language
TypeScript
Stars
0
Forks
26
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenLake/RateMyCourse

All issues in OpenLake/RateMyCourse

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.