ENG-1395 Official deployment version cannot access database

[maparent]

https://linear.app/discourse-graphs/issue/ENG-1395/official-deployment-version-cannot-access-database

Access the vercel env values when building from the shell script.

https://www.loom.com/share/08dfa5be8386471d8b3caa4202f05d65

---

[linear]

ENG-1395 Official deployment version cannot access database

[supabase]

This pull request has been ignored for the connected project zytfjzqyijgagqxrzbmz because there are no changes detected in packages/database/supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[devin-ai-integration]

Devin Review found 1 potential issue.

View 4 additional findings in Devin Review.

[maparent]

Devin spotted a route error, and complains I do not return in the throw clause. I think that's a mistake; anyone calling this from a dev environment should fall through. It also will work if the variables are set in the environment otherwise.

[mdroidian]

We need to throw if we don't have the vars. Also, some lint errors.

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 8 additional findings in Devin Review.

[devin-ai-integration]

🟡 Missing CORS headers on GET response while OPTIONS handler has them

The new /api/supabase/env endpoint has inconsistent CORS handling. The OPTIONS handler uses defaultOptionsHandler which applies CORS headers, but the GET handler returns NextResponse.json() directly without applying CORS via the cors() function.

Root Cause

Other API endpoints in the codebase use createApiResponse() which internally calls cors(request, response) to add CORS headers (see apps/website/app/utils/supabase/apiUtils.ts:48). However, this new endpoint bypasses that pattern.

If this endpoint is ever called from a browser context (e.g., from the Roam extension at runtime), the browser would:

1. Send OPTIONS preflight → receives CORS headers (allowed)
2. Send actual GET request → receives response WITHOUT CORS headers
3. Browser rejects the response due to missing Access-Control-Allow-Origin

Currently this doesn't affect the build process since curl is used (packages/database/scripts/createEnv.mts:113), but it makes the API inconsistent and would break any future browser-based usage.

Suggested change

	return NextResponse.json(
	// eslint-disable-next-line @typescript-eslint/naming-convention
	{ SUPABASE_URL, SUPABASE_ANON_KEY },
	{ status: 200 },
	);
	const response = NextResponse.json(
	// eslint-disable-next-line @typescript-eslint/naming-convention
	{ SUPABASE_URL, SUPABASE_ANON_KEY },
	{ status: 200 },
	);
	return cors(request, response) as NextResponse;

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[mdroidian]

@maparent

[mdroidian]

@maparent

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 9 additional findings in Devin Review.

[devin-ai-integration]

🔴 Environment file written to wrong path - .env instead of .env.${variant} format

When ROAM_BUILD_SCRIPT=1 is set, createEnv.mts writes environment variables to packages/database/.env, but dbDotEnv.mjs:envFilePath() only reads files matching .env.${variant} pattern (like .env.local, .env.branch, .env.production).

Root Cause

The flow when ROAM_BUILD_SCRIPT=1:

1. createEnv.mts:115-118 writes to join(projectRoot, ".env") - a plain .env file
2. Later, compile.ts:153 calls envContents() from dbDotEnv.mjs
3. dbDotEnv.mjs:64-68 in envFilePath() looks for .env.${variant} files only:

   const name = join(findRoot(), `.env.${variant}`);
   return existsSync(name) ? name : null;

4. Since there's no .env.${variant} file and process.env doesn't have the variables, envContents() returns an empty object

Impact: The Roam build will not receive the SUPABASE_URL and SUPABASE_ANON_KEY values, causing the database connection to fail in the built extension. The fix should either write to .env.production (matching an existing variant) or add logic to read plain .env files.

Suggested change

	writeFileSync(
	join(projectRoot, ".env"),
	Object.entries(asJson).map(([k,v])=>`${k}=${v}`).join('\n')
	);
	writeFileSync(
	join(projectRoot, ".env.production"),
	Object.entries(asJson).map(([k,v])=>`${k}=${v}`).join('\n')
	);

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[maparent]

the base dotenv reads the content of .env in all cases.