From e54f6d31edf58649520be88e6af63113a69312e2 Mon Sep 17 00:00:00 2001
From: jjbrunton <jamie@jbrunton.co.uk>
Date: Sun, 30 Aug 2026 21:36:37 +0100
Subject: [PATCH] fix(admin): forward local Auth settings

---
 docs/development/local-stack.md |  2 +-
 e2e/specs/admin.spec.ts         |  4 ++++
 scripts/dev-local.sh            | 16 ++++++++++++++--
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/docs/development/local-stack.md b/docs/development/local-stack.md
index 0a161af..b5d25b1 100644
--- a/docs/development/local-stack.md
+++ b/docs/development/local-stack.md
@@ -61,7 +61,7 @@ Create the ignored root `.env.local` with the public Auth settings for the
 designated non-production Supabase project (`itbzhrvlgvdmzbnhzhyx`). Set
 `SUPABASE_AUTH_URL` (or `EXPO_PUBLIC_SUPABASE_URL`) and
 `EXPO_PUBLIC_SUPABASE_ANON_KEY`; the launcher uses the URL for the API and both
-values for Expo. It accepts only this designated hosted project or loopback Auth,
+values for Expo and the Admin login. It accepts only this designated hosted project or loopback Auth,
 and explicitly rejects the production project and every other hosted project.
 Environment variables exported in the shell take precedence over `.env.local`.
 The launcher treats `.env.local` as data, never shell code: use unquoted
diff --git a/e2e/specs/admin.spec.ts b/e2e/specs/admin.spec.ts
index e302bca..f70587c 100644
--- a/e2e/specs/admin.spec.ts
+++ b/e2e/specs/admin.spec.ts
@@ -4,9 +4,13 @@ const admin = process.env.ADMIN_URL;
 if (!admin) throw new Error('Run E2E through npm run verify:e2e');
 
 test('unauthenticated admin access reaches the real login boundary', async ({ page }) => {
+  const pageErrors: string[] = [];
+  page.on('pageerror', (error) => pageErrors.push(error.message));
+
   await page.goto(admin);
   await expect(page).toHaveURL(/\/login$/);
   await expect(page.getByRole('heading', { name: 'Welcome Back' })).toBeVisible();
   await expect(page.getByLabel('Email Address')).toBeVisible();
   await expect(page.getByLabel('Password')).toBeVisible();
+  expect(pageErrors).toEqual([]);
 });
diff --git a/scripts/dev-local.sh b/scripts/dev-local.sh
index c3408e3..ce3f158 100755
--- a/scripts/dev-local.sh
+++ b/scripts/dev-local.sh
@@ -366,6 +366,13 @@ window_environment() {
       )
       WINDOW_FORWARD='SAUCI_ADMIN_API_URL="$SAUCI_ADMIN_API_URL" SAUCI_ADMIN_API_TOKEN="$SAUCI_ADMIN_API_TOKEN" SAUCI_MCP_API_KEY="$SAUCI_MCP_API_KEY"'
       ;;
+    admin)
+      WINDOW_ENV=(
+        "VITE_SUPABASE_URL=$AUTH_URL"
+        "VITE_SUPABASE_ANON_KEY=$AUTH_ANON_KEY"
+      )
+      WINDOW_FORWARD='VITE_SUPABASE_URL="$VITE_SUPABASE_URL" VITE_SUPABASE_ANON_KEY="$VITE_SUPABASE_ANON_KEY"'
+      ;;
     mobile)
       WINDOW_ENV=(
         "EXPO_PUBLIC_API_URL=$MOBILE_API_URL"
@@ -462,6 +469,7 @@ assert_app_ports_available() {
 cmd_up() {
   preflight
   [ -n "$AUTH_URL" ] || die "SUPABASE_AUTH_URL (or EXPO_PUBLIC_SUPABASE_URL) is required for hosted Auth verification."
+  [ -n "$AUTH_ANON_KEY" ] || die "EXPO_PUBLIC_SUPABASE_ANON_KEY is required for hosted Auth verification."
   assert_allowed_auth
   prepare_session
   if ! restart_managed_windows; then
@@ -520,12 +528,16 @@ cmd_restart() {
 
   preflight
   case "$name" in
-    api|mobile)
+    api|admin|mobile)
       [ -n "$AUTH_URL" ] || die "SUPABASE_AUTH_URL (or EXPO_PUBLIC_SUPABASE_URL) is required."
       assert_allowed_auth
       ;;
   esac
-  [ "$name" != "mobile" ] || [ -n "$AUTH_ANON_KEY" ] || die "EXPO_PUBLIC_SUPABASE_ANON_KEY is required for the mobile Auth client."
+  case "$name" in
+    admin|mobile)
+      [ -n "$AUTH_ANON_KEY" ] || die "EXPO_PUBLIC_SUPABASE_ANON_KEY is required for the ${name} Auth client."
+      ;;
+  esac
 
   tmux has-session -t "$SESSION" 2>/dev/null || die "session not running"
   prepare_session