fix: stop Supabase client leak causing runtime OOM

getSupabaseAdmin/getSupabaseClient created a new @supabase/supabase-js
client on every call (183+42 call sites, several per request). Each
client starts a GoTrue auth client (autoRefreshToken setInterval) and a
realtime client, so under steady traffic the heap grew until it hit the
--max-old-space-size cap and crashed (~18h to OOM on prod).

- Memoize both clients as module-level singletons; disable
  persistSession/autoRefreshToken (no server session, kills the timer).
- Apply the same memoization to the per-request service-role clients in
  the contact/waitlist/whitepaper routes.
- Bump Dockerfile heap cap 384->512MB for SSR headroom.

Session-mutating auth routes keep their own local clients, so the shared
singleton is safe. Build + 209 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

Dockerfile

@@ -30,7 +30,7 @@ ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV HOSTNAME=0.0.0.0
 ENV PORT=3000
-ENV NODE_OPTIONS=--max-old-space-size=384
+ENV NODE_OPTIONS=--max-old-space-size=512
 
 WORKDIR /app
 

apps/web/src/app/api/contact/route.ts

@@ -1,15 +1,21 @@
 import { NextRequest, NextResponse } from "next/server";
-import { createClient } from "@supabase/supabase-js";
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 import { Resend } from "resend";
 
 const CONTACT_EMAIL = "hello@threatcrush.com";
 const FROM_EMAIL = `ThreatCrush <${CONTACT_EMAIL}>`;
 
+let supabase: SupabaseClient | undefined;
 function getSupabase() {
+  if (supabase) return supabase;
   const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
   const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
   if (!url || !key) throw new Error("Supabase not configured");
-  return createClient(url, key);
+  // Memoized: a new client per request leaks auth/realtime timers → OOM.
+  supabase = createClient(url, key, {
+    auth: { persistSession: false, autoRefreshToken: false },
+  });
+  return supabase;
 }
 
 async function sendNotification(input: {

apps/web/src/app/api/waitlist/route.ts

@@ -1,11 +1,17 @@
 import { NextRequest, NextResponse } from "next/server";
-import { createClient } from "@supabase/supabase-js";
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 
+let supabase: SupabaseClient | undefined;
 function getSupabase() {
+  if (supabase) return supabase;
   const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
   const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
   if (!url || !key) throw new Error("Supabase not configured");
-  return createClient(url, key);
+  // Memoized: a new client per request leaks auth/realtime timers → OOM.
+  supabase = createClient(url, key, {
+    auth: { persistSession: false, autoRefreshToken: false },
+  });
+  return supabase;
 }
 
 const COINPAY_API = "https://coinpayportal.com/api";

apps/web/src/app/api/whitepaper/route.ts

@@ -1,16 +1,22 @@
 import { NextRequest, NextResponse } from "next/server";
-import { createClient } from "@supabase/supabase-js";
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 import { Resend } from "resend";
 
 const FROM_EMAIL = "ThreatCrush <hello@threatcrush.com>";
 const DEFAULT_SLUG = "ctem-guide";
 const PDF_PATH = "/whitepaper/threatcrush-ctem-guide.pdf";
 
+let supabase: SupabaseClient | undefined;
 function getSupabase() {
+  if (supabase) return supabase;
   const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
   const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
   if (!url || !key) throw new Error("Supabase not configured");
-  return createClient(url, key);
+  // Memoized: a new client per request leaks auth/realtime timers → OOM.
+  supabase = createClient(url, key, {
+    auth: { persistSession: false, autoRefreshToken: false },
+  });
+  return supabase;
 }
 
 function appUrl() {

apps/web/src/lib/__tests__/supabase.test.ts

@@ -55,9 +55,16 @@ describe("getSupabaseClient", () => {
     expect(client).toBeDefined();
     expect(createClient).toHaveBeenCalledWith(
       expect.any(String),
-      expect.any(String)
+      expect.any(String),
+      expect.objectContaining({ auth: expect.any(Object) })
     );
   });
+
+  it("memoizes the client across calls", () => {
+    const a = getSupabaseClient();
+    const b = getSupabaseClient();
+    expect(a).toBe(b);
+  });
 });
 
 describe("getSupabaseAdmin", () => {

apps/web/src/lib/supabase.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import { createClient } from "@supabase/supabase-js";
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
@@ -12,18 +12,35 @@ function requireEnv(name: string): string {
   return value;
 }
 
+// Memoized singletons. Creating a Supabase client per call leaks memory: each
+// client spins up a GoTrue auth client (with an autoRefreshToken setInterval)
+// and a realtime client. With hundreds of calls per request across the app,
+// these accumulate until the Node heap OOMs. Reuse one client per role instead.
+let adminClient: SupabaseClient | undefined;
+let anonClient: SupabaseClient | undefined;
+
 /** Browser/client-side Supabase client (anon key) */
-export function getSupabaseClient() {
-  const url = requireEnv("NEXT_PUBLIC_SUPABASE_URL");
-  const anonKey = requireEnv("NEXT_PUBLIC_SUPABASE_ANON_KEY");
-  return createClient(url, anonKey);
+export function getSupabaseClient(): SupabaseClient {
+  if (!anonClient) {
+    const url = requireEnv("NEXT_PUBLIC_SUPABASE_URL");
+    const anonKey = requireEnv("NEXT_PUBLIC_SUPABASE_ANON_KEY");
+    anonClient = createClient(url, anonKey, {
+      auth: { persistSession: false, autoRefreshToken: false },
+    });
+  }
+  return anonClient;
 }
 
 /** Server-side Supabase client (service role key — full access) */
-export function getSupabaseAdmin() {
-  const url = requireEnv("NEXT_PUBLIC_SUPABASE_URL");
-  const serviceKey = requireEnv("SUPABASE_SERVICE_ROLE_KEY");
-  return createClient(url, serviceKey);
+export function getSupabaseAdmin(): SupabaseClient {
+  if (!adminClient) {
+    const url = requireEnv("NEXT_PUBLIC_SUPABASE_URL");
+    const serviceKey = requireEnv("SUPABASE_SERVICE_ROLE_KEY");
+    adminClient = createClient(url, serviceKey, {
+      auth: { persistSession: false, autoRefreshToken: false },
+    });
+  }
+  return adminClient;
 }
 
 /** Helper to slugify a module name */