feat(platform): replace Supabase Auth with Better Auth

.github/workflows/claude-dependabot.yml

@@ -132,11 +132,7 @@ jobs:
             "rabbitmq:management"
             "clamav/clamav-debian:latest"
             "busybox:latest"
-            "kong:2.8.1"
-            "supabase/gotrue:v2.170.0"
-            "supabase/postgres:15.8.1.049"
-            "supabase/postgres-meta:v0.86.1"
-            "supabase/studio:20250224-d10db0f"
+            "pgvector/pgvector:pg15"
           )
 
           # Check if any cached tar files exist (more reliable than cache-hit)

.github/workflows/claude.yml

@@ -145,11 +145,7 @@ jobs:
             "rabbitmq:management"
             "clamav/clamav-debian:latest"
             "busybox:latest"
-            "kong:2.8.1"
-            "supabase/gotrue:v2.170.0"
-            "supabase/postgres:15.8.1.049"
-            "supabase/postgres-meta:v0.86.1"
-            "supabase/studio:20250224-d10db0f"
+            "pgvector/pgvector:pg15"
           )
 
           # Check if any cached tar files exist (more reliable than cache-hit)

.github/workflows/copilot-setup-steps.yml

@@ -152,11 +152,7 @@ jobs:
             "rabbitmq:management"
             "clamav/clamav-debian:latest"
             "busybox:latest"
-            "kong:2.8.1"
-            "supabase/gotrue:v2.170.0"
-            "supabase/postgres:15.8.1.049"
-            "supabase/postgres-meta:v0.86.1"
-            "supabase/studio:20250224-d10db0f"
+            "pgvector/pgvector:pg15"
           )
           
           # Check if any cached tar files exist (more reliable than cache-hit)

.github/workflows/platform-backend-ci.yml

@@ -64,6 +64,50 @@ jobs:
       CI: true
       PLAIN_OUTPUT: True
 
+  # autogpt_libs is a standalone package with its own env; the backend `test`
+  # job (scoped to autogpt_platform/backend) never collects its tests, so run
+  # them here. Pure unit tests — no database or external services needed.
+  autogpt-libs-test:
+    permissions:
+      contents: read
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: autogpt_platform/autogpt_libs
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Python dependency cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/pypoetry
+          key: poetry-${{ runner.os }}-py3.12-libs-${{ hashFiles('autogpt_platform/autogpt_libs/poetry.lock') }}
+
+      - name: Install Poetry
+        run: |
+          HEAD_POETRY_VERSION=$(python ../../.github/workflows/scripts/get_package_version_from_lockfile.py poetry ../backend/poetry.lock)
+          echo "Using Poetry version ${HEAD_POETRY_VERSION}"
+          curl -sSL https://install.python-poetry.org | POETRY_VERSION=$HEAD_POETRY_VERSION python3 -
+
+      - name: Install Python dependencies
+        run: poetry install
+
+      - name: Run pytest
+        run: poetry run pytest -q
+
+    env:
+      CI: true
+      PLAIN_OUTPUT: True
+
   type-check:
     permissions:
       contents: read
@@ -210,10 +254,9 @@ jobs:
           # picks the right published port per shard.
           #
           # Not reusing docker-compose.platform.yml directly because compose
-          # validates the full file even when only some services are ``up``,
-          # and that file references services (db/kong/...) defined in a
-          # sibling compose file — pulling both in would needlessly couple
-          # CI to the full local-dev stack.
+          # validates the full file even when only some services are ``up``
+          # — pulling it in would needlessly couple CI to the full
+          # local-dev stack.
           docker network create redis-cluster-ci
           for i in 0 1 2; do
             port=$((17000 + i))
@@ -260,11 +303,6 @@ jobs:
           docker exec redis-0 redis-cli -p 17000 cluster info >&2 || true
           exit 1
 
-      - name: Setup Supabase
-        uses: supabase/setup-cli@v1
-        with:
-          version: 1.178.1
-
       - id: get_date
         name: Get date
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
@@ -318,15 +356,28 @@ jobs:
       - name: Generate Prisma Client
         run: poetry run prisma generate && poetry run gen-prisma-stub
 
-      - id: supabase
-        name: Start Supabase
-        working-directory: .
+      - name: Start Postgres
+        working-directory: autogpt_platform
         run: |
-          supabase init
-          supabase start --exclude postgres-meta,realtime,storage-api,imgproxy,inbucket,studio,edge-runtime,logflare,vector,supavisor
-          supabase status -o env | sed 's/="/=/; s/"$//' >> $GITHUB_OUTPUT
-        # outputs:
-        # DB_URL, API_URL, GRAPHQL_URL, ANON_KEY, SERVICE_ROLE_KEY, JWT_SECRET
+          # Plain pgvector Postgres; the init script creates the legacy
+          # `auth` schema shim that historical migrations reference.
+          docker run -d --name postgres-test \
+            -e POSTGRES_USER=postgres \
+            -e POSTGRES_PASSWORD=postgres \
+            -e POSTGRES_DB=postgres \
+            -p 5432:5432 \
+            -v "$(pwd)/db/init/00-init.sql:/docker-entrypoint-initdb.d/00-init.sql:ro" \
+            pgvector/pgvector:pg15
+          for _ in $(seq 1 30); do
+            if docker exec postgres-test pg_isready -U postgres >/dev/null 2>&1; then
+              echo "Postgres ready"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "Postgres failed to start" >&2
+          docker logs postgres-test >&2
+          exit 1
 
       - name: Wait for ClamAV to be ready
         run: |
@@ -360,8 +411,8 @@ jobs:
       - name: Run Database Migrations
         run: poetry run prisma migrate deploy
         env:
-          DATABASE_URL: ${{ steps.supabase.outputs.DB_URL }}
-          DIRECT_URL: ${{ steps.supabase.outputs.DB_URL }}
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+          DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
 
       - name: Run pytest with coverage
         run: |
@@ -374,11 +425,9 @@ jobs:
           fi
         env:
           LOG_LEVEL: ${{ runner.debug && 'DEBUG' || 'INFO' }}
-          DATABASE_URL: ${{ steps.supabase.outputs.DB_URL }}
-          DIRECT_URL: ${{ steps.supabase.outputs.DB_URL }}
-          SUPABASE_URL: ${{ steps.supabase.outputs.API_URL }}
-          SUPABASE_SERVICE_ROLE_KEY: ${{ steps.supabase.outputs.SERVICE_ROLE_KEY }}
-          JWT_VERIFY_KEY: ${{ steps.supabase.outputs.JWT_SECRET }}
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+          DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
+          JWT_VERIFY_KEY: "ci-only-jwt-verify-key-with-at-least-32-characters" # DO NOT USE IN PRODUCTION!!
           REDIS_HOST: "localhost"
           REDIS_PORT: "17000"
           ENCRYPTION_KEY: "dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=" # DO NOT USE IN PRODUCTION!!

.github/workflows/platform-fullstack-ci.yml

@@ -156,7 +156,7 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Set up Platform - Copy default supabase .env
+      - name: Set up Platform - Copy default platform .env
         run: |
           cp ../.env.default ../.env
 
@@ -214,15 +214,13 @@ jobs:
         uses: actions/cache@v5
         with:
           path: /tmp/e2e_test_data.sql
-          key: e2e-test-data-${{ hashFiles('autogpt_platform/backend/test/e2e_test_data.py', 'autogpt_platform/backend/migrations/**', '.github/workflows/platform-fullstack-ci.yml') }}
+          key: e2e-test-data-${{ hashFiles('autogpt_platform/backend/test/e2e_test_data.py', 'autogpt_platform/backend/backend/data/user.py', 'autogpt_platform/backend/migrations/**', '.github/workflows/platform-fullstack-ci.yml') }}
 
-      - name: Set up Platform - Start Supabase DB + Auth
+      - name: Set up Platform - Start database
         run: |
-          docker compose -f ../docker-compose.resolved.yml up -d db auth --no-build
+          docker compose -f ../docker-compose.resolved.yml up -d db --no-build
           echo "Waiting for database to be ready..."
           timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db pg_isready -U postgres 2>/dev/null; do sleep 2; done'
-          echo "Waiting for auth service to be ready..."
-          timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db psql -U postgres -d postgres -c "SELECT 1 FROM auth.users LIMIT 1" 2>/dev/null; do sleep 2; done' || echo "Auth schema check timeout, continuing..."
 
       - name: Set up Platform - Run migrations
         run: |
@@ -251,7 +249,11 @@ jobs:
         run: |
           docker compose -f ../docker-compose.resolved.yml up -d --no-build
           echo "Waiting for rest_server to be ready..."
-          timeout 60 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || echo "Rest server health check timeout, continuing..."
+          timeout 180 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || {
+            echo "❌ rest_server did not become healthy in 180s"
+            docker compose -f ../docker-compose.resolved.yml logs --tail=100 rest_server
+            exit 1
+          }
         env:
           NEXT_PUBLIC_PW_TEST: true
 
@@ -266,20 +268,16 @@ jobs:
             exit 1
           }
 
-          # Dump auth.users + platform schema for cache (two separate dumps)
+          # Dump the platform schema for cache (includes the Better Auth
+          # user/session/account tables seeded by e2e_test_data.py)
           echo "Dumping database for cache..."
-          {
-            docker compose -f ../docker-compose.resolved.yml exec -T db \
-              pg_dump -U postgres --data-only --column-inserts \
-              --table='auth.users' postgres
-            docker compose -f ../docker-compose.resolved.yml exec -T db \
-              pg_dump -U postgres --data-only --column-inserts \
-              --schema=platform \
-              --exclude-table='platform._prisma_migrations' \
-              --exclude-table='platform.apscheduler_jobs' \
-              --exclude-table='platform.apscheduler_jobs_batched_notifications' \
-              postgres
-          } > /tmp/e2e_test_data.sql
+          docker compose -f ../docker-compose.resolved.yml exec -T db \
+            pg_dump -U postgres --data-only --column-inserts \
+            --schema=platform \
+            --exclude-table='platform._prisma_migrations' \
+            --exclude-table='platform.apscheduler_jobs' \
+            --exclude-table='platform.apscheduler_jobs_batched_notifications' \
+            postgres > /tmp/e2e_test_data.sql
 
           echo "✅ Database dump created for caching ($(wc -l < /tmp/e2e_test_data.sql) lines)"
 

.github/workflows/platform-supabase-auth-sweep.yml

@@ -0,0 +1,53 @@
+name: AutoGPT Platform - Supabase Auth Sweep
+
+# Re-runs the GoTrue -> Better Auth user copy as an idempotent sweep. The
+# bulk copy happens in Prisma migration
+# 20260716120000_copy_supabase_users_to_better_auth during the normal deploy;
+# run this once AFTER the frontend has switched to Better Auth to catch users
+# who signed up via GoTrue in between.
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Environment to sweep"
+        type: choice
+        required: true
+        options:
+          - develop
+          - production
+
+permissions:
+  contents: "read"
+
+jobs:
+  sweep:
+    environment: ${{ github.event.inputs.environment }}
+    name: Sweep GoTrue users into Better Auth
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: autogpt_platform/frontend/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24.18.0"
+          cache: "pnpm"
+          cache-dependency-path: autogpt_platform/frontend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: ./autogpt_platform/frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Run sweep
+        working-directory: ./autogpt_platform/frontend
+        run: npx tsx scripts/migrate-supabase-auth.ts
+        env:
+          DATABASE_URL: ${{ secrets.BACKEND_DATABASE_URL }}

.gitignore

@@ -212,3 +212,6 @@ test-screenshots/
 .ign*
 **/.ign*
 .claude/scheduled_tasks.lock
+
+# Supabase CLI machine-local state (linked project ref, etc.)
+supabase/.temp/

SECURITY.md

@@ -6,6 +6,8 @@ We take the security of our project seriously. If you believe you have found a s
 
 > **Important Note**: Any code within the `classic/` folder is considered legacy, unsupported, and out of scope for security reports. We will not address security vulnerabilities in this deprecated code.
 
+> **Important Note**: The JWKS transport check (the startup warning when `JWT_JWKS_URL` is fetched over cleartext `http://` from a non-local host) is best-effort operator guidance, not a security boundary. It is a warning only, it never blocks startup, and it cannot tell a trusted private network from a hostile one. Securing the network path between the backend and the JWKS endpoint is the operator's responsibility — see the self-hosting security note in `docs/platform/getting-started.md`. Reports that the warning can be missed, silenced, or evaded are not eligible for a CVE.
+
 Instead, please report them via:
 - [GitHub Security Advisory](https://github.com/Significant-Gravitas/AutoGPT/security/advisories/new)
 <!--- [Huntr.dev](https://huntr.com/repos/significant-gravitas/autogpt) - where you may be eligible for a bounty-->