remove: Supabase auth provider

[ben-fornefeld]

Summary

• remove Supabase auth provider, callback, OTP, and email/password form flows from dashboard
• make Auth.js/Ory the only dashboard auth path and always use bearer + X-Team-ID API headers
• remove Supabase env/dependencies/contracts and update docs, tests, and generated OpenAPI contracts

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview, Comment	Jun 16, 2026 12:19am

[cursor]

PR Summary

High Risk
Full auth provider swap and removal of in-app credential flows; any misconfigured Ory env or OAuth callback breaks all login. Deployments still on Supabase cannot authenticate until reconfigured.

Overview
Supabase auth is removed end-to-end: dependencies, env vars, OTP/callback routes, email/password forms, server actions, tRPC verifyOtp, and the dual AuthProvider layer. Auth is only Auth.js + Ory via /api/auth/oauth/* (legacy /api/auth/oauth-start paths redirect). getAuthContext, signOut, and profile/update helpers live in ory/session.ts; dashboard and tRPC always wrap requests with Auth.js.

Sign-in, sign-up, and forgot-password pages no longer render local forms—they redirect into the Ory hosted flow. Turnstile/captcha, auth migration flags, ZeroBounce signup validation, and related user messages are dropped. Backend API auth headers no longer branch on provider; they always send Authorization: Bearer and X-Team-ID.

CI/docs/env examples switch from Supabase to required Ory/Auth.js variables; generate:supabase and Supabase packages are removed from package.json.

.env.example still says KV is required for alternate-email warning dedupe, but that signup/KV logic was removed—comment is stale vs README (health check only).

^{Reviewed by Cursor Bugbot for commit d5ff581. Bugbot is set up for automated code reviews on this repo. Configure here.}