feat: auth-gate demo chat + budget circuit breaker #67

2026-05-11T04:45:24Z

will.anderson commented

2026-05-11 04:45:24 +00:00

Summary

Gate /api/demo behind Supabase auth: widget shows sign-in pane (Google OAuth or email/password) when unauthenticated; server verifies access_token via supabase_auth_user() and uses the verified UID as the rate-limit key, rejecting all unauthenticated requests
Add budget kill switch: demo_config table in Supabase (demo_enabled key), polled every 60s by /api/demo with fail-open cache; Cloud Function demo-budget-guard disables the demo when GCP spend crosses 90% of the $150/day budget via Pub/Sub
Infrastructure: Pub/Sub topic budget-alerts, Cloud Function deployed to us-central1, billing budget created with 50%/90% threshold alerts
Migration: 20260510000000_demo_config.sql (already applied to production)

Test plan

Open chat widget unauthenticated — auth pane appears (Google + email form)
Sign in via Google OAuth — redirects back, chat input appears
Send a message — server verifies token and responds normally
Send with no/invalid token — server returns auth_required, widget shows auth pane
Set demo_config demo_enabled = false in Supabase — verify disabled response within 60s
Restore demo_enabled = true — verify demo resumes

## Summary - Gate /api/demo behind Supabase auth: widget shows sign-in pane (Google OAuth or email/password) when unauthenticated; server verifies access_token via supabase_auth_user() and uses the verified UID as the rate-limit key, rejecting all unauthenticated requests - Add budget kill switch: demo_config table in Supabase (demo_enabled key), polled every 60s by /api/demo with fail-open cache; Cloud Function demo-budget-guard disables the demo when GCP spend crosses 90% of the $150/day budget via Pub/Sub - Infrastructure: Pub/Sub topic budget-alerts, Cloud Function deployed to us-central1, billing budget created with 50%/90% threshold alerts - Migration: 20260510000000_demo_config.sql (already applied to production) ## Test plan - [ ] Open chat widget unauthenticated — auth pane appears (Google + email form) - [ ] Sign in via Google OAuth — redirects back, chat input appears - [ ] Send a message — server verifies token and responds normally - [ ] Send with no/invalid token — server returns auth_required, widget shows auth pane - [ ] Set demo_config demo_enabled = false in Supabase — verify disabled response within 60s - [ ] Restore demo_enabled = true — verify demo resumes

will.anderson added 1 commit 2026-05-11 04:45:26 +00:00

feat: auth-gate demo chat + budget circuit breaker

Dev — Build & local smoke test / build-smoke (pull_request) Successful in 2m10s

Details

fe418bf3f7

Gate the demo chat behind Supabase auth: the widget now fetches Supabase
config on open, shows a compact sign-in pane (Google OAuth or email/password)
when the user is unauthenticated, and passes the access_token to /api/demo.
The server verifies the token via supabase_auth_user() before any processing
and uses the verified user ID as the rate-limit key.

Add a budget kill switch: a demo_config table in Supabase holds a
demo_enabled flag that /api/demo polls every 60s (cached, fails open).
A Cloud Function (demo-budget-guard) is triggered by a GCP Pub/Sub budget
alert and sets demo_enabled = 'false' when spend crosses 90% of the $150
daily budget. Budget and topic are provisioned; function is live in
us-central1.

will.anderson merged commit bdff0ad153 into dev

2026-05-11 04:45:39 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: neuron-technologies/neuron-web#67