Fix: read env vars at runtime not import time for HF Space secrets

backend/config.py

@@ -8,13 +8,18 @@ from dotenv import load_dotenv
 
 load_dotenv(override=False)  # Don't override existing env vars (e.g. HF Space secrets)
 
-# Supabase
-SUPABASE_URL = os.getenv("SUPABASE_URL", "")
-SUPABASE_KEY = os.getenv("SUPABASE_KEY", "")
-SUPABASE_SERVICE_KEY = os.getenv("SUPABASE_SERVICE_KEY", "")
-
-# Database (direct connection for pgvector queries)
-DATABASE_URL = os.getenv("DATABASE_URL", "")
+# Supabase — read lazily at runtime so HF Space secrets are available
+def get_supabase_url(): return os.environ.get("SUPABASE_URL", "")
+def get_supabase_key(): return os.environ.get("SUPABASE_KEY", "")
+def get_supabase_service_key(): return os.environ.get("SUPABASE_SERVICE_KEY", "")
+def get_database_url(): return os.environ.get("DATABASE_URL", "")
+def get_jwt_secret(): return os.environ.get("JWT_SECRET", "change-this-in-production")
+
+# Keep these as constants too for backwards compatibility
+SUPABASE_URL = os.environ.get("SUPABASE_URL", "")
+SUPABASE_KEY = os.environ.get("SUPABASE_KEY", "")
+SUPABASE_SERVICE_KEY = os.environ.get("SUPABASE_SERVICE_KEY", "")
+DATABASE_URL = os.environ.get("DATABASE_URL", "")
 
 # JWT Auth
 JWT_SECRET = os.getenv("JWT_SECRET", "change-this-in-production")

backend/database.py

@@ -4,11 +4,11 @@ Uses psycopg (v3) for direct PostgreSQL/pgvector queries (search),
 and supabase-py for standard CRUD operations.
 """
 
+import os
 import psycopg
 from psycopg.rows import dict_row
 import numpy as np
 from supabase import create_client, Client
-from config import SUPABASE_URL, SUPABASE_KEY, DATABASE_URL
 
 # --- Supabase Client (for CRUD operations) ---
 
@@ -19,7 +19,10 @@ def get_supabase() -> Client:
     """Get or create the Supabase client for standard CRUD operations."""
     global _supabase_client
     if _supabase_client is None:
-        _supabase_client = create_client(SUPABASE_URL, SUPABASE_KEY)
+        _supabase_client = create_client(
+            os.environ["SUPABASE_URL"],
+            os.environ["SUPABASE_KEY"],
+        )
     return _supabase_client
 
 
@@ -27,7 +30,7 @@ def get_supabase() -> Client:
 
 def get_db_connection():
     """Create a new psycopg3 connection for pgvector queries."""
-    conn = psycopg.connect(DATABASE_URL, row_factory=dict_row)
+    conn = psycopg.connect(os.environ["DATABASE_URL"], row_factory=dict_row)
     return conn
 
 

backend/routes/auth.py

@@ -10,8 +10,9 @@ from pydantic import BaseModel
 from datetime import datetime, timedelta, timezone
 import bcrypt
 import jwt
+import os
 from database import get_supabase
-from config import JWT_SECRET, JWT_ALGORITHM, JWT_EXPIRATION_HOURS
+from config import JWT_ALGORITHM, JWT_EXPIRATION_HOURS
 
 router = APIRouter(prefix="/auth", tags=["Authentication"])
 security = HTTPBearer()
@@ -58,13 +59,13 @@ def create_token(user_id: str, email: str, role: str = "buyer") -> str:
         "exp": datetime.now(timezone.utc) + timedelta(hours=JWT_EXPIRATION_HOURS),
         "iat": datetime.now(timezone.utc),
     }
-    return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
+    return jwt.encode(payload, os.environ.get("JWT_SECRET", "change-this-in-production"), algorithm=JWT_ALGORITHM)
 
 
 def verify_token(credentials: HTTPAuthorizationCredentials = Depends(security)) -> dict:
     """Dependency that verifies JWT token and returns the payload."""
     try:
-        payload = jwt.decode(credentials.credentials, JWT_SECRET, algorithms=[JWT_ALGORITHM])
+        payload = jwt.decode(credentials.credentials, os.environ.get("JWT_SECRET", "change-this-in-production"), algorithms=[JWT_ALGORITHM])
         return payload
     except jwt.ExpiredSignatureError:
         raise HTTPException(status_code=401, detail="Token expired")

backend/routes/products.py

@@ -9,10 +9,10 @@ from typing import Optional
 import uuid
 import base64
 
+import os
 from database import get_supabase, store_product_embedding
 from models.bert_service import bert_service
 from routes.auth import get_current_user
-from config import SUPABASE_URL
 
 router = APIRouter(prefix="/products", tags=["Products"])
 
@@ -106,7 +106,7 @@ async def upload_image(
         raise HTTPException(status_code=500, detail=f"Failed to upload image: {str(e)}")
 
     # Get public URL
-    public_url = f"{SUPABASE_URL}/storage/v1/object/public/product-images/{filename}"
+    public_url = f"{os.environ.get('SUPABASE_URL', '')}/storage/v1/object/public/product-images/{filename}"
 
     return {"url": public_url, "filename": filename}