[Muawiya-contact]

Why

After the Railway services were removed, the production Supabase API still returns HTTP 404 for /confirmed, /reset-password, and /privacy. The installed mobile app constructs its signup and recovery redirects from the Supabase API base URL, so new email links can land on these missing pages. The mobile About screen also dropped /functions/v1/api when constructing its privacy URL, and the review site's privacy page linked to Railway.

Changes

• Serve public confirmation, password reset, and learner privacy pages from the Supabase api Edge function. Recovery uses the public Supabase key in the browser, clears the URL token fragment, and has no service-role access. The confirmation page forwards a recovery fallback to the reset form.
• Correct the mobile and reviewer-site privacy links to the Supabase API path.
• Replace the Railway Auth redirect runbook and update the codebase map/work log.

Verification

• Edge TypeScript check and handler tests passed.
• Mobile TypeScript check and all 103 Node tests passed. The suite required an unsandboxed local run for its existing subprocess-based config test.
• A local headless browser accepted a mock recovery token, sent a mock password update to a mocked Supabase Auth endpoint, cleared the token fragment, rejected a bare reset URL, and followed the fallback recovery redirect.
• Live production returned HTTP 404 on all three pages before this change. No production deployment or real-account recovery test has been performed by this PR.

Release steps

Add the two exact Supabase Edge redirect URLs to production Auth URL Configuration, deploy this Edge API revision through the protected production release, and test fresh signup and recovery emails with an owner-controlled account. The privacy-link change needs a compatible production mobile OTA; the review-site link needs a new Netlify deploy. There is no database migration in this PR. Keep failed curriculum titles and future refill separate from this auth hotfix.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-25T08:08:25.873318Z We couldn’t complete this review. Comment @codex review to try again.	dbc9748	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.