clapointe-carbonleo starts rebuilding Mike Legal's front door

The fork restores sign-in and token checks after briefly removing access controls, but its permissions model is still unsafe.

securityworkflow

The team has added Supabase sign-in - a hosted identity service - and server-side checks that verify a user's login token. Shared projects can again be found by email, which repairs a practical collaboration path.

But the crucial permission layer still treats every existing project, document and review as accessible and owned by whoever asks. The sharing repair also makes the backend inspect metadata from projects the user does not own. This is a recovery in progress, not a security pattern to copy.

So what Legal teams considering shared matter workspaces should watch this fork for its authentication direction, but should not trust it with client data until resource-level permissions are restored.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

4 commits from clapointe-carbonleo/mike-legal, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`e6568f87`	feat(mike): ic - remove auth - fix sql - all users 'internal' for now	clapointe-carbonleo	2026-05-06	↗ GitHub
`9e02ae0e`	Fix /projects endpoint: filter shared_with client-side	clapointe-carbonleo	2026-05-06	↗ GitHub
The .contains() method doesn't work for JSONB arrays in Supabase JS client. Changed to fetch all non-owned projects and filter by shared_with email client-side. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
`2217a5df`	Add Supabase email/password authentication	clapointe-carbonleo	2026-05-06	↗ GitHub
commit body - AuthContext now uses real Supabase session (onAuthStateChange) - (pages) layout redirects to /login when not authenticated - Login page with Carbonleo brand styling (dark bg, yellow CTA) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
`fffe4396`	Validate real Supabase JWT in requireAuth middleware	clapointe-carbonleo	2026-05-06	↗ GitHub
commit body Replaces hardcoded 'internal' userId with the actual Supabase user ID extracted from the Bearer token sent by the frontend. Each user now has their own isolated data in the database. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-8.md from inside the repo you want the changes in.

⬇ Download capture-thread-8.md