fix: align supabase_service.py env var fallback to SUPABASE_ANON_KEY

supabase_service.py was falling back to SUPABASE_KEY which we just
removed from docker-compose. Updated to fall back to SUPABASE_ANON_KEY
which is now the standardized name across all config.

Closes OPE-13 (startup validation already existed, just needed alignment)

Author: DevanshuNEU

backend/config/startup_checks.py

@@ -0,0 +1,51 @@
+"""
+Startup environment validation.
+Fails fast with clear error messages if required config is missing.
+"""
+import os
+import sys
+from typing import List, Tuple
+
+from services.observability import logger
+
+
+# (env_var_name, description, required)
+REQUIRED_VARS: List[Tuple[str, str]] = [
+    ("SUPABASE_URL", "Supabase project URL"),
+    ("SUPABASE_ANON_KEY", "Supabase anon/public key"),
+    ("SUPABASE_JWT_SECRET", "Supabase JWT secret for token verification"),
+    ("OPENAI_API_KEY", "OpenAI API key for embeddings"),
+    ("PINECONE_API_KEY", "Pinecone API key for vector storage"),
+]
+
+OPTIONAL_VARS: List[Tuple[str, str, str]] = [
+    ("SUPABASE_SERVICE_ROLE_KEY", "Supabase service role key", "Using anon key as fallback"),
+    ("COHERE_API_KEY", "Cohere API key for reranking", "Search reranking disabled"),
+    ("VOYAGE_API_KEY", "Voyage AI key for code embeddings", "Using OpenAI embeddings"),
+    ("SENTRY_DSN", "Sentry DSN for error tracking", "Error tracking disabled"),
+    ("REDIS_HOST", "Redis host for caching", "Using default localhost"),
+]
+
+
+def validate_environment() -> None:
+    """Check required env vars exist. Log warnings for optional ones."""
+    missing: List[str] = []
+
+    for var_name, description in REQUIRED_VARS:
+        value = os.getenv(var_name)
+        if not value:
+            missing.append(f"  {var_name} -- {description}")
+
+    if missing:
+        msg = "Missing required environment variables:\n" + "\n".join(missing)
+        msg += "\n\nSee .env.example for configuration reference."
+        logger.error(msg)
+        print(f"\n[FATAL] {msg}\n", file=sys.stderr)
+        sys.exit(1)
+
+    # warn about optional vars
+    for var_name, description, fallback_msg in OPTIONAL_VARS:
+        if not os.getenv(var_name):
+            logger.warning(f"{var_name} not set ({description}). {fallback_msg}")
+
+    logger.info("Environment validation passed")

backend/main.py

@@ -16,6 +16,7 @@
 
 # Import API config (single source of truth for versioning)
 from config.api import API_PREFIX, API_VERSION
+from config.startup_checks import validate_environment
 
 # Import routers
 from routes.auth import router as auth_router
@@ -36,7 +37,7 @@
 # Lifespan context manager for startup/shutdown
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Startup
+    validate_environment()
     await load_demo_repos()
     yield
     # Shutdown (cleanup if needed)

backend/services/supabase_service.py

@@ -19,11 +19,11 @@ class SupabaseService:
 
     def __init__(self):
         supabase_url = os.getenv("SUPABASE_URL")
-        # Use service role key to bypass RLS for backend operations
-        supabase_key = os.getenv("SUPABASE_SERVICE_ROLE_KEY") or os.getenv("SUPABASE_KEY")
+        # prefer service role key for backend (bypasses RLS), fall back to anon key
+        supabase_key = os.getenv("SUPABASE_SERVICE_ROLE_KEY") or os.getenv("SUPABASE_ANON_KEY")
 
         if not supabase_url or not supabase_key:
-            raise ValueError("SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (or SUPABASE_KEY) must be set")
+            raise ValueError("SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (or SUPABASE_ANON_KEY) must be set")
 
         # Create client with options to avoid auth cleanup issues
         options = ClientOptions(