{"release_id":"01a1998d-9802-0000-b0f7-33a23307f4ed","chunk_id":"01a1998d-9931-7222-b6f6-2ffb4ef579f9","file":"DRF4_33_.mjs","mappings":"2XAUA,IAAIA,EAEG,SAASC,GAA8B,CAC7C,OAAID,IACJA,EAASE,EAAoBC,EAAI,oBAAsBA,EAAI,yBAA2B,CAkBrF,cAAe,CACd,KAAM,IACN,SAAU,MACV,OAAQ,OAAO,SAAa,KAAe,SAAS,WAAa,QAAA,CAClE,CACA,EACMH,EACR","names":["cached","createSupabaseBrowserClient","createBrowserClient","env"],"sources":["../../../../../../src/lib/supabase.ts"],"sourcesContent":["import { createBrowserClient } from '@supabase/ssr';\nimport { env } from '$env/dynamic/public';\n\n// RAT-135: cache one browser client per tab. Without the cache every\n// component that calls this (NotificationBell, rater dashboard, /r/[nick],\n// /rate/session, etc.) spins up a fresh client + websocket on mount, and\n// rapid back/forward navigation accumulates dangling sockets faster than\n// the browser closes them — eventually navigations stall waiting for the\n// websocket pool to free up. One shared client keeps a single auth-aware\n// connection alive for the whole tab.\nlet cached: ReturnType<typeof createBrowserClient> | undefined;\n\nexport function createSupabaseBrowserClient() {\n\tif (cached) return cached;\n\tcached = createBrowserClient(env.PUBLIC_SUPABASE_URL!, env.PUBLIC_SUPABASE_ANON_KEY!, {\n\t\t// RAT: pin the cookie attributes the client writes instead of inheriting\n\t\t// @supabase/ssr's implicit defaults. The Google OAuth handshake stashes a\n\t\t// PKCE code-verifier cookie right before bouncing to the provider and reads\n\t\t// it back on the return leg; on iOS Safari that cookie was going missing\n\t\t// across the cross-site round trip, so GoTrue couldn't match the flow_state\n\t\t// and bounced everyone back with error_code=bad_oauth_state. `secure` +\n\t\t// `sameSite: 'lax'` is the combination Safari keeps across a top-level\n\t\t// redirect return — Lax cookies ride top-level GET navigations, and Secure\n\t\t// is required for them to survive ITP's cross-site handling on HTTPS. We\n\t\t// leave maxAge unset so the persisted session cookie keeps the library's\n\t\t// long-lived default; only the transport attributes are pinned here.\n\t\t//\n\t\t// `secure` is conditional on purpose. Chrome treats http://localhost as a\n\t\t// trustworthy origin and keeps Secure cookies there; Safari does not, and\n\t\t// drops them — so hardcoding `true` makes local sign-in silently fail in\n\t\t// the one browser this whole fix exists for, and half our users are on.\n\t\t// Production is HTTPS, so it is on where it matters.\n\t\tcookieOptions: {\n\t\t\tpath: '/',\n\t\t\tsameSite: 'lax',\n\t\t\tsecure: typeof location === 'undefined' || location.protocol === 'https:'\n\t\t}\n\t});\n\treturn cached;\n}\n"],"version":3}