feat: prefer supabase jwt in taro api client

scripts/taro-api-auth-mode-test.js

@@ -0,0 +1,87 @@
+import assert from 'node:assert/strict';
+import { pathToFileURL } from 'node:url';
+
+const repoRoot = process.cwd();
+const authModule = await import(pathToFileURL(`${repoRoot}/apps/taro/src/services/api-auth.ts`).href);
+
+authModule.setSupabaseAccessTokenProviderForTest(async () => 'supabase_access_token');
+
+assert.equal(
+  await authModule.resolveApiAuthorization({
+    hasTokenOverride: false,
+    legacyToken: 'tk_legacy_token',
+  }),
+  'supabase_access_token',
+);
+
+assert.equal(
+  await authModule.resolveApiAuthorization({
+    authMode: 'none',
+    hasTokenOverride: false,
+    legacyToken: 'tk_legacy_token',
+  }),
+  null,
+);
+
+assert.equal(
+  await authModule.resolveApiAuthorization({
+    authMode: 'legacy',
+    hasTokenOverride: false,
+    legacyToken: 'tk_legacy_token',
+  }),
+  'tk_legacy_token',
+);
+
+assert.equal(
+  await authModule.resolveApiAuthorization({
+    hasTokenOverride: true,
+    explicitToken: null,
+    legacyToken: 'tk_legacy_token',
+  }),
+  null,
+);
+
+authModule.setSupabaseAccessTokenProviderForTest(async () => null);
+
+assert.equal(
+  await authModule.resolveApiAuthorization({
+    hasTokenOverride: false,
+    legacyToken: 'tk_legacy_token',
+  }),
+  'tk_legacy_token',
+);
+
+assert.equal(
+  await authModule.resolveApiAuthorization({
+    authMode: 'supabase',
+    hasTokenOverride: false,
+    legacyToken: 'tk_legacy_token',
+  }),
+  null,
+);
+
+const authenticatedHeaders = authModule.buildApiHeaders({
+  tenantId: 'tenant-1',
+  token: 'supabase_access_token',
+  extraHeaders: { 'x-client-version': 'test' },
+});
+assert.equal(authenticatedHeaders.authorization, 'Bearer supabase_access_token');
+assert.equal(authenticatedHeaders['x-tenant-id'], 'tenant-1');
+assert.equal(authenticatedHeaders['x-client-version'], 'test');
+
+const publicHeaders = authModule.buildApiHeaders({ tenantId: null, token: null });
+assert.equal(publicHeaders.authorization, undefined);
+assert.equal(publicHeaders['x-tenant-id'], undefined);
+
+assert.throws(
+  () => authModule.buildApiHeaders({ extraHeaders: { Authorization: 'Bearer unsafe' } }),
+  /Reserved API header cannot be overridden/,
+);
+assert.throws(
+  () => authModule.buildApiHeaders({ tenantId: 'tenant-1', extraHeaders: { 'X-Tenant-Id': 'tenant-2' } }),
+  /Reserved API header cannot be overridden/,
+);
+
+authModule.setSupabaseAccessTokenProviderForTest(null);
+
+console.log('[PASS] Taro API auth mode guardrails');