Add account creation to Vortex #912

ebma · 2025-10-31T10:10:50Z

Closes #882.

This pull request introduces Supabase-based authentication to the API, including OTP (one-time password) flows, token verification, and user session management. It adds new authentication endpoints, middleware for extracting and verifying user identity from requests, and propagates the authenticated userId throughout the business logic and data models. Several routes now optionally or mandatorily require authentication, and the system is prepared for future endpoint protection. Additionally, the codebase is updated to store and utilize the userId in key models and service layers.

Supabase Authentication Integration

Added Supabase configuration variables to .env.example and included @supabase/supabase-js as a dependency in package.json. [1] [2]
Implemented SupabaseAuthService with methods for checking user existence, sending and verifying OTPs, verifying and refreshing tokens, and retrieving user profiles. [1] [2]
Created AuthController with endpoints for checking email registration, requesting OTP, verifying OTP, refreshing tokens, and verifying tokens. [1] [2]
Added /v1/auth routes for authentication endpoints and registered them in the main API router. [1] [2] [3]

Authentication Middleware and Route Protection

Added requireAuth and optionalAuth middleware to extract and verify user identity from Bearer tokens, attaching userId to the request.
Updated BRLA, Quote, and Ramp routes to use optionalAuth middleware, allowing endpoints to access userId if provided. [1] [2] [3] [4] [5] [6] [7]

User Identity Propagation

Modified controllers (brla.controller.ts, quote.controller.ts, ramp.controller.ts) to store userId from the request in database records and service calls. [1] [2] [3] [4] [5] [6]
Updated service and type definitions to support userId as part of the request context and data models. [1] [2]

These changes collectively enable secure, user-specific flows across the API, laying the groundwork for robust authentication and authorization using Supabase.

netlify · 2025-10-31T10:10:56Z

✅ Deploy Preview for vortexfi ready!

Name	Link
🔨 Latest commit	`2fbed83`
🔍 Latest deploy log	https://app.netlify.com/projects/vortexfi/deploys/694a613dbe8ec40008c9ae0f
😎 Deploy Preview	https://deploy-preview-912--vortexfi.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2025-10-31T10:10:57Z

✅ Deploy Preview for vortex-sandbox ready!

Name	Link
🔨 Latest commit	`2fbed83`
🔍 Latest deploy log	https://app.netlify.com/projects/vortex-sandbox/deploys/694a613d268a6a00085508ba
😎 Deploy Preview	https://deploy-preview-912--vortex-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

…ved tracking

… AUTH_SUCCESS handling

…onents

Copilot

Pull request overview

Copilot reviewed 67 out of 68 changed files in this pull request and generated 11 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

apps/api/src/api/middlewares/supabaseAuth.ts

apps/api/src/database/migrations/013-fix-tax-ids-table.ts

supabase/config.toml

apps/frontend/src/services/auth.ts

apps/api/src/api/services/auth/supabase.service.ts

apps/frontend/src/services/auth.ts

apps/frontend/src/hooks/useAuthTokens.ts

apps/frontend/src/components/widget-steps/AuthEmailStep/index.tsx

apps/api/src/database/migrations/022-add-user-id-to-entities.ts

apps/api/src/api/controllers/brla.controller.ts

ebma · 2025-12-15T10:50:06Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2025-12-15T10:50:18Z

@ebma I've opened a new pull request, #969, to work on those changes. Once the pull request is ready, I'll request review from you.

… limits, auth handling Co-authored-by: ebma <6690623+ebma@users.noreply.github.com>

…ent infinite loop Co-authored-by: ebma <6690623+ebma@users.noreply.github.com>

…ssion

…ility and user experience

…r consistency

Address code review comments: security, performance, and bug fixes

gianfra-t · 2025-12-18T16:39:21Z

apps/api/src/api/controllers/auth.controller.ts

+        });
+      }
+
+      await SupabaseAuthService.sendOTP(email);


I believe this operation is stateless on the backend, right? Maybe we could add an entry to the users table, to mark the last OTP timestamp or any other metadata.

In case we loose the state in the UI or we want to keep track.

gianfra-t · 2025-12-18T16:40:45Z

apps/api/src/api/controllers/auth.controller.ts

+      // Sync user to local database (upsert)
+      await User.upsert({
+        email: email,
+        id: result.user_id


Is the upsert only for handling new users? I assume the userId should never change but I may be wrong.

gianfra-t

Very nice and complete feature, thanks @ebma ! The only thing I would like to discuss is what you think about changing the token into the cookies and avoid storing it in the local storage.
I understand there is a tradeoff in terms of security between both methods.

gianfra-t · 2025-12-18T16:46:55Z

apps/frontend/src/machines/ramp.machine.ts

+            }),
+            ({ event, context }) => {
+              // Store tokens in localStorage for session persistence
+              AuthService.storeTokens({


I also wanted to discuss the pros/cons of using localStorage vs cookies (httpOnly) for the tokens.

I believe our application already handles httpOnly cookiens for the SIWE login, so we have an example, which seems to be the preferred way for browser apps.

Do you see this solution better in terms of security, for our case?

gianfra-t · 2025-12-18T16:47:50Z

apps/api/src/api/controllers/brla.controller.ts

    if (!taxIdRecord) {
+      // Validate that user is authenticated since userId is required in the schema
+      if (!req.userId) {
+        res.status(httpStatus.UNAUTHORIZED).json({ 


Can we use the required validator here? instead of the optional, and then throwing.

gianfra-t · 2025-12-18T17:27:35Z

apps/frontend/src/services/api/api-client.ts

 apiClient.interceptors.request.use(
  config => {
-    // Add any common headers here
+    // Add Authorization header if user is authenticated


Do you know, if the header refreshes after the user gets authenticated?
What I mean is, if the apiClient initially starts with an authenticated state, do the headers get added after the Auth state changes?

gianfra-t · 2025-12-18T17:28:41Z

apps/frontend/src/machines/ramp.machine.ts

+    },
+    EnterOTP: {
+      on: {
+        CHANGE_EMAIL: {


What do we want to allow changing the email at this stage? I assume Supabase already created the user.

gianfra-t · 2025-12-18T17:29:45Z

apps/api/src/api/services/auth/supabase.service.ts

+
+      if (error) {
+        // If error is "PGRST116" (no rows returned), user doesn't exist
+        if (error.code === "PGRST116") {


I don't know if it's possible, but this code seems confusing for an empty query return. Is this what the sdk recommends?

gianfra-t · 2025-12-18T17:37:21Z

apps/api/src/models/kycLevel2.model.ts

@@ -0,0 +1,110 @@
+import {DataTypes, Model, Optional} from "sequelize";


We are we adding this new table?

gianfra-t · 2025-12-18T17:46:23Z

apps/api/src/database/migrations/022-add-user-id-to-entities.ts

+    type: DataTypes.UUID
+  });
+
+  await queryInterface.sequelize.query(`


Can we keep the userId relation for this one (and any that allows for null) empty instead of using the dummy? Or do you think there is a benefit of using the dummy user here?

ebma added 6 commits October 31, 2025 10:39

Create architecture docs for supabase auth implementation

5bcb1be

Implement Supabase authentication routes and user ID tracking in models

707d11d

Add user model and establish associations with other entities

91fbb4a

Add initial configuration files and scripts for project setup

d649c08

Implement authentication flow with email verification and OTP handling

531564f

Add email and OTP authentication steps to the user flow

82e1cd8

ebma added 22 commits December 3, 2025 16:14

Merge branch 'staging' into 882-account-creation-on-vortex

693cff7

Update @supabase/supabase-js dependency to use catalog version

eee8f73

Add userId to registerRamp functionality for enhanced user tracking

f88ea27

Fix tax_ids migration to safely rename column and add enum value

b30a9a8

Add userId extraction and handling in quote and ramp routes for impro…

f8a1670

…ved tracking

Refactor useAuthTokens to accept actorRef and update ramp machine for…

de2e6bf

… AUTH_SUCCESS handling

Fix quote not generated if user not logged in

063ac40

Fix email change button not working

7cc19e9

Fix session refresh not working

b7ed019

Rename authTokens to userSessionTokens

5c2443e

Move auth before details page

8b1af39

Fix initial auth state

267cdca

Change stepper

b0cf245

Adjust styling of auth cards

e328411

Add logout feature to details page

8bf845b

Fix email not stored

a1c28f5

Adjust magic link template

5a912d4

Adjust magic link template again

06f7958

Make quote summary always expand over card content itself

a52726d

Make quote summary also overlap on other cards

b005ecb

Adjust spacing of card content

54aa972

Refactor layout and improve z-index for QuoteSummary in multiple comp…

260935f

…onents

ebma added 7 commits December 15, 2025 09:47

Adjust the spacing below the actions button

e24ed22

Fix stepper phases

15b845c

Remove automatic scroll on quote summary

ffb2a70

Fix issue with quote not set on ramp state when starting on email flow

eaae3e5

Fix action button alignment in AveniaLivenessStep

c8e91a1

Rename 'users' table to 'profiles' to adhere to Supabase best practice

daa2475

Merge architecture documents for auth feature

5197de3

ebma requested a review from Copilot December 15, 2025 10:27

ebma marked this pull request as ready for review December 15, 2025 10:27

Copilot started reviewing on behalf of ebma December 15, 2025 10:29 View session

Copilot AI reviewed Dec 15, 2025

View reviewed changes

Initial plan

7211e32

Copilot AI mentioned this pull request Dec 15, 2025

Address code review comments: security, performance, and bug fixes #969

Merged

Copilot AI and others added 8 commits December 15, 2025 10:57

Address code review comments: logging, PostgreSQL compatibility, rate…

5f979be

… limits, auth handling Co-authored-by: ebma <6690623+ebma@users.noreply.github.com>

Fix code review issues: truncate auth header in logs, use ref to prev…

b8125dd

…ent infinite loop Co-authored-by: ebma <6690623+ebma@users.noreply.github.com>

Refactor URL token handling in authentication flow to set Supabase se…

8a8169c

…ssion

Refactor email input form structure and styling for improved accessib…

20d0c5f

…ility and user experience

Replace console log with logger

ed92096

Refactor authentication token handling to use camelCase properties fo…

22671a6

…r consistency

Configure supabase signup template in config

ca868ef

Merge pull request #969 from pendulum-chain/copilot/sub-pr-912

70568bd

Address code review comments: security, performance, and bug fixes

ebma requested a review from a team December 16, 2025 08:06

gianfra-t reviewed Dec 18, 2025

View reviewed changes

gianfra-t requested changes Dec 18, 2025

View reviewed changes

gianfra-t reviewed Dec 18, 2025

View reviewed changes

Add doc for supabase auth

2fbed83

		@@ -0,0 +1,110 @@
		import {DataTypes, Model, Optional} from "sequelize";

Add account creation to Vortex #912

Are you sure you want to change the base?

Add account creation to Vortex #912

Uh oh!

Conversation

ebma commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vortexfi ready!

Uh oh!

netlify bot commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vortex-sandbox ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ebma commented Dec 15, 2025

Uh oh!

Copilot AI commented Dec 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gianfra-t left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ebma commented Oct 31, 2025 •

edited

Loading

netlify bot commented Oct 31, 2025 •

edited

Loading

netlify bot commented Oct 31, 2025 •

edited

Loading