Fix feedback auth for expired users

tests/test_deployment_runtime_config.py

@@ -297,6 +297,36 @@ def test_frontend_proxy_uses_internal_backend_url_not_public_site():
     )
 
 
+def test_frontend_and_web_share_supabase_forwarded_identity_secrets():
+    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
+    script = (ROOT / "deploy.sh").read_text(encoding="utf-8")
+    frontend_block = compose.split("  polyweather_frontend:", 1)[1].split(
+        "\n  polyweather_web:",
+        1,
+    )[0]
+    web_block = compose.split("  polyweather_web:", 1)[1].split(
+        "\n  polyweather_collector:",
+        1,
+    )[0]
+
+    assert (
+        "POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN: ${POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN}"
+        in frontend_block
+    )
+    assert "SUPABASE_URL: ${SUPABASE_URL}" in web_block
+    assert "SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}" in web_block
+    assert "SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}" in web_block
+    assert (
+        "POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN: ${POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN}"
+        in web_block
+    )
+    assert 'export SUPABASE_URL="${SUPABASE_URL:-${NEXT_PUBLIC_SUPABASE_URL:-}}"' in script
+    assert (
+        'export SUPABASE_ANON_KEY="${SUPABASE_ANON_KEY:-${NEXT_PUBLIC_SUPABASE_ANON_KEY:-}}"'
+        in script
+    )
+
+
 def test_web_container_raises_open_file_limit_for_sse_and_proxy_load():
     compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
     web_block = compose.split("  polyweather_web:", 1)[1].split(

tests/test_user_feedback.py

@@ -2,8 +2,10 @@ from types import SimpleNamespace
 
 import pytest
 from fastapi import HTTPException
+from starlette.requests import Request
 
 from src.database.db_manager import DBManager
+import web.core as web_core
 from web.services import feedback_api
 from web.services import ops_api
 
@@ -296,3 +298,42 @@ def test_list_current_user_feedback_requires_identity(tmp_path, monkeypatch):
     with pytest.raises(HTTPException) as exc_info:
         feedback_api.list_current_user_feedback(anonymous_request, limit=20)
     assert exc_info.value.status_code == 401
+
+
+def test_list_current_user_feedback_accepts_forwarded_identity_when_supabase_unconfigured(
+    tmp_path, monkeypatch
+):
+    db = DBManager(str(tmp_path / "polyweather-feedback-forwarded.db"))
+    db.append_user_feedback(
+        category="bug",
+        message="Forwarded identity feedback.",
+        user_id="user-a",
+        user_email="a@example.com",
+    )
+    db.append_user_feedback(
+        category="bug",
+        message="Other user feedback.",
+        user_id="user-b",
+        user_email="b@example.com",
+    )
+    monkeypatch.setattr(feedback_api, "DBManager", lambda: db)
+    monkeypatch.setattr(web_core, "_ENTITLEMENT_TOKEN", "backend-token")
+    monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "supabase_url", "")
+    monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "anon_key", "")
+
+    request = Request(
+        {
+            "type": "http",
+            "headers": [
+                (b"x-polyweather-entitlement", b"backend-token"),
+                (b"x-polyweather-auth-user-id", b"user-a"),
+                (b"x-polyweather-auth-email", b"a@example.com"),
+                (b"authorization", b"Bearer access-token"),
+            ],
+        }
+    )
+
+    payload = feedback_api.list_current_user_feedback(request, limit=20)
+
+    assert payload["total"] == 1
+    assert payload["feedback"][0]["message"] == "Forwarded identity feedback."