Resolve backend Supabase env during deploy

deploy.sh

@@ -127,10 +127,54 @@ compose_up_retry() {
     return 1
 }
 
+read_env_file_value() {
+    local key="$1"
+    if [ ! -f ".env" ]; then
+        return 0
+    fi
+    awk -F= -v key="$key" '
+        $0 ~ "^[[:space:]]*" key "[[:space:]]*=" {
+            value=$0
+            sub("^[^=]*=", "", value)
+            gsub("^[[:space:]]+|[[:space:]]+$", "", value)
+            gsub(/^["'"'"']|["'"'"']$/, "", value)
+            print value
+        }
+    ' .env | tail -n 1
+}
+
+resolve_env_value() {
+    local primary_key="$1"
+    local fallback_key="${2:-}"
+    local value="${!primary_key:-}"
+
+    if [ -z "$value" ]; then
+        value="$(read_env_file_value "$primary_key")"
+    fi
+    if [ -z "$value" ] && [ -n "$fallback_key" ]; then
+        value="${!fallback_key:-}"
+        if [ -z "$value" ]; then
+            value="$(read_env_file_value "$fallback_key")"
+        fi
+    fi
+
+    printf '%s' "$value"
+}
+
 export IMAGE_TAG="$NEW_TAG"
 export POLYWEATHER_API_BASE_URL="${POLYWEATHER_FRONTEND_INTERNAL_API_BASE_URL:-http://polyweather_web:8000}"
-export SUPABASE_URL="${SUPABASE_URL:-${NEXT_PUBLIC_SUPABASE_URL:-}}"
+resolved_supabase_url="$(resolve_env_value "SUPABASE_URL" "NEXT_PUBLIC_SUPABASE_URL")"
-export SUPABASE_ANON_KEY="${SUPABASE_ANON_KEY:-${NEXT_PUBLIC_SUPABASE_ANON_KEY:-}}"
+resolved_supabase_anon_key="$(resolve_env_value "SUPABASE_ANON_KEY" "NEXT_PUBLIC_SUPABASE_ANON_KEY")"
+if [ -n "$resolved_supabase_url" ]; then
+    export SUPABASE_URL="$resolved_supabase_url"
+else
+    unset SUPABASE_URL
+fi
+if [ -n "$resolved_supabase_anon_key" ]; then
+    export SUPABASE_ANON_KEY="$resolved_supabase_anon_key"
+else
+    unset SUPABASE_ANON_KEY
+fi
 pull_ok=0
 for pull_attempt in $(seq 1 6); do
     docker compose pull && pull_ok=1 && break
@@ -248,22 +292,6 @@ wait_for_scan_terminal_snapshot() {
     return 1
 }
 
-read_env_file_value() {
-    local key="$1"
-    if [ ! -f ".env" ]; then
-        return 0
-    fi
-    awk -F= -v key="$key" '
-        $0 ~ "^[[:space:]]*" key "[[:space:]]*=" {
-            value=$0
-            sub("^[^=]*=", "", value)
-            gsub("^[[:space:]]+|[[:space:]]+$", "", value)
-            gsub(/^["'"'"']|["'"'"']$/, "", value)
-            print value
-        }
-    ' .env | tail -n 1
-}
-
 validate_frontend_api_base_url() {
     local api_base="${POLYWEATHER_API_BASE_URL:-}"
     if [ -z "$api_base" ]; then

tests/test_deployment_runtime_config.py

@@ -192,6 +192,21 @@ def test_deploy_script_retries_image_pull_for_registry_propagation():
     assert "docker compose pull && pull_ok=1 && break" in script
 
 
+def test_deploy_script_exports_backend_supabase_env_from_env_file():
+    script = (ROOT / "deploy.sh").read_text(encoding="utf-8")
+
+    assert "read_env_file_value()" in script
+    assert "resolve_env_value()" in script
+    assert 'resolve_env_value "SUPABASE_URL" "NEXT_PUBLIC_SUPABASE_URL"' in script
+    assert 'resolve_env_value "SUPABASE_ANON_KEY" "NEXT_PUBLIC_SUPABASE_ANON_KEY"' in script
+    assert 'export SUPABASE_URL="$resolved_supabase_url"' in script
+    assert 'export SUPABASE_ANON_KEY="$resolved_supabase_anon_key"' in script
+    assert "unset SUPABASE_URL" in script
+    assert "unset SUPABASE_ANON_KEY" in script
+    assert script.index("read_env_file_value()") < script.index('export IMAGE_TAG="$NEW_TAG"')
+    assert script.index('resolve_env_value "SUPABASE_URL"') < script.index("pull_ok=0")
+
+
 def test_deploy_script_syncs_city_thread_ids_into_runtime_volume():
     script = (ROOT / "deploy.sh").read_text(encoding="utf-8")
 
@@ -321,11 +336,13 @@ def test_frontend_and_web_share_supabase_forwarded_identity_secrets():
         "POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN: ${POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN}"
         in web_block
     )
-    assert 'export SUPABASE_URL="${SUPABASE_URL:-${NEXT_PUBLIC_SUPABASE_URL:-}}"' in script
+    assert 'resolve_env_value "SUPABASE_URL" "NEXT_PUBLIC_SUPABASE_URL"' in script
+    assert 'export SUPABASE_URL="$resolved_supabase_url"' in script
     assert (
-        'export SUPABASE_ANON_KEY="${SUPABASE_ANON_KEY:-${NEXT_PUBLIC_SUPABASE_ANON_KEY:-}}"'
+        'resolve_env_value "SUPABASE_ANON_KEY" "NEXT_PUBLIC_SUPABASE_ANON_KEY"'
         in script
     )
+    assert 'export SUPABASE_ANON_KEY="$resolved_supabase_anon_key"' in script
 
 
 def test_web_container_raises_open_file_limit_for_sse_and_proxy_load():