CB Embedded Flows — Complete (Supabase-hosted SPA)

This repo contains a backend API and a frontend static SPA intended to be hosted on Supabase Storage.

Prereqs

• Node.js 18+
• PostgreSQL
• Redis
• Supabase project (for storage)

Setup

1. Copy .env.example to .env and fill values (esp. SUPABASE_*).
2. Start Postgres + Redis (locally or via docker-compose):

docker-compose up -d

3. Setup DB:

cd backend
npm install
npm run migrate
npm run seed

4. Start backend:

npm run dev

5. Build frontend and upload to Supabase Storage:

cd ../frontend
npm install
npm run build
# using supabase CLI or UI, upload contents of dist/ to bucket cb-embed (public)
supabase storage upload cb-embed dist --recursive --public

6. Create an intent (example):

curl -X POST http://localhost:4000/api/intents -H 'x-partner-id: 11111111-1111-1111-1111-111111111111' -H 'Content-Type: application/json' -d '{"type":"account_link","customerId":"cust-1"}'

Response contains redirect_url pointing to Supabase-hosted SPA with sessionToken.

Run worker

In backend folder:

npm run worker

Notes

• This is a reference implementation. In production use mTLS or OAuth2 client auth, one-time session redemption, signed S3 PUT URLs for asset uploads, stricter CSP, and secure webhook secret management.