will.anderson
fe418bf3f7
Dev — Build & local smoke test / build-smoke (pull_request) Successful in 2m10s
Gate the demo chat behind Supabase auth: the widget now fetches Supabase config on open, shows a compact sign-in pane (Google OAuth or email/password) when the user is unauthenticated, and passes the access_token to /api/demo. The server verifies the token via supabase_auth_user() before any processing and uses the verified user ID as the rate-limit key. Add a budget kill switch: a demo_config table in Supabase holds a demo_enabled flag that /api/demo polls every 60s (cached, fails open). A Cloud Function (demo-budget-guard) is triggered by a GCP Pub/Sub budget alert and sets demo_enabled = 'false' when spend crosses 90% of the $150 daily budget. Budget and topic are provisioned; function is live in us-central1.
23 lines
867 B
SQL
23 lines
867 B
SQL
-- 20260510000000_demo_config.sql
|
|
--
|
|
-- Kill switch for the demo chat endpoint. Backs the budget-alert Cloud Function
|
|
-- that flips demo_enabled to 'false' when GCP spend crosses 90% of the daily
|
|
-- budget threshold. The web tier polls this table with a 60s TTL cache so the
|
|
-- demo is disabled within one minute of a budget alert firing.
|
|
--
|
|
-- Service-role bypasses RLS. Public anon has no access (policy USING (false)).
|
|
|
|
CREATE TABLE IF NOT EXISTS public.demo_config (
|
|
key text PRIMARY KEY,
|
|
value text NOT NULL,
|
|
updated_at timestamptz DEFAULT now()
|
|
);
|
|
|
|
ALTER TABLE public.demo_config ENABLE ROW LEVEL SECURITY;
|
|
|
|
CREATE POLICY "service only" ON public.demo_config USING (false);
|
|
|
|
-- Seed the kill switch as enabled
|
|
INSERT INTO public.demo_config (key, value) VALUES ('demo_enabled', 'true')
|
|
ON CONFLICT (key) DO NOTHING;
|