From dcdf50593d411c09d7761ce3fd21a44247df57dd Mon Sep 17 00:00:00 2001
From: Christian Vidal Wolf <christianvidalwolf@gmail.com>
Date: Fri, 10 Apr 2026 19:56:42 +0200
Subject: [PATCH] Comprehensive audit: Replace backend JWT dependency
 universally with anon key and strict cache rules

---
 api/dropbox-proxy.js | 3 +++
 src/lib/supabase.ts  | 8 ++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/api/dropbox-proxy.js b/api/dropbox-proxy.js
index b3e383b..6a09d94 100644
--- a/api/dropbox-proxy.js
+++ b/api/dropbox-proxy.js
@@ -40,6 +40,9 @@ export default async function handler(req, res) {
         body: JSON.stringify({ path: '/CRAZE GmbH/Sales Reports/Data Matrix.xlsx' })
       });
       const data = await fileInfo.json();
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+      res.setHeader('Pragma', 'no-cache');
+      res.setHeader('Expires', '0');
       return res.json({ rev: data.rev, size: data.size, server_modified: data.server_modified });
     } catch (err) {
       return res.status(500).json({ error: err.message });
diff --git a/src/lib/supabase.ts b/src/lib/supabase.ts
index 601eebe..b2b303a 100644
--- a/src/lib/supabase.ts
+++ b/src/lib/supabase.ts
@@ -47,7 +47,7 @@ export async function saveRowToSupabase(articleNo: string, rowData: ExcelRow, to
         headers: {
           'Content-Type': 'application/json',
           'apikey': SUPABASE_KEY,
-          'Authorization': `Bearer ${token || SUPABASE_KEY}`,
+          'Authorization': `Bearer ${SUPABASE_KEY}`,
           'Prefer': 'resolution=merge-duplicates'
         },
         body: JSON.stringify({
@@ -100,7 +100,7 @@ export async function saveHistoryEntry(
         headers: {
           'Content-Type': 'application/json',
           'apikey': SUPABASE_KEY,
-          'Authorization': `Bearer ${token || SUPABASE_KEY}`,
+          'Authorization': `Bearer ${SUPABASE_KEY}`,
           'Prefer': 'return=minimal'
         },
         body: JSON.stringify({
@@ -178,7 +178,7 @@ export async function deleteHistoryEntry(id: string, token?: string): Promise<bo
         method: 'DELETE',
         headers: {
           'apikey': SUPABASE_KEY,
-          'Authorization': `Bearer ${token || SUPABASE_KEY}`
+          'Authorization': `Bearer ${SUPABASE_KEY}`
         }
       }
     );
@@ -199,7 +199,7 @@ export async function resetAllPendingRows(token?: string): Promise<boolean> {
         headers: {
           'Content-Type': 'application/json',
           'apikey': SUPABASE_KEY,
-          'Authorization': `Bearer ${token || SUPABASE_KEY}`,
+          'Authorization': `Bearer ${SUPABASE_KEY}`,
           'Prefer': 'return=minimal'
         },
         body: JSON.stringify({ status: 'synced' })