From 0b49a7daff5b13aee0241b338980b01c0918dd8c Mon Sep 17 00:00:00 2001
From: Sahil Jagtap <sahil.jagtap45@gmail.com>
Date: Thu, 18 Dec 2025 17:38:20 -0500
Subject: [PATCH] feat(config): support env() references in hook URI fields

This allows users to use environment variable references in auth hook URIs,
enabling dynamic URL configuration for preview branches.

Example:
  [auth.hook.send_email]
  enabled = true
  uri = "env(SUPABASE_PROJECT_URL)/functions/v1/send-email"
  secrets = "env(SEND_EMAIL_HOOK_SECRET)"

When a URI contains env() reference, local validation is skipped with a
warning, allowing the platform to resolve the variable at deploy time.

Fixes: supabase/supabase#41088
---
 pkg/config/config.go      | 7 +++++++
 pkg/config/config_test.go | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/pkg/config/config.go b/pkg/config/config.go
index 6e9ef96bb..02cbcfb88 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -1249,6 +1249,13 @@ func (h *hookConfig) validate(hookType string) (err error) {
 	if h.URI == "" {
 		return errors.Errorf("Missing required field in config: auth.hook.%s.uri", hookType)
 	}
+	// Skip validation if URI contains unresolved env() reference
+	// This allows users to use env(SUPABASE_PROJECT_URL)/functions/v1/...
+	// which will be resolved at deploy time by the platform
+	if strings.Contains(h.URI, "env(") {
+		fmt.Fprintf(os.Stderr, "WARN: auth.hook.%s.uri contains env() reference, skipping local validation\n", hookType)
+		return nil
+	}
 	parsed, err := url.Parse(h.URI)
 	if err != nil {
 		return errors.Errorf("failed to parse template url: %w", err)
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 43a292fc3..c12b78551 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -319,6 +319,13 @@ func TestValidateHookURI(t *testing.T) {
 			},
 			errorMsg: "Invalid hook config: auth.hook.valid pg-functions URI with unsupported secrets.secrets is unsupported for pg-functions URI",
 		},
+		{
+			name: "URI with env() reference skips validation",
+			hookConfig: hookConfig{
+				Enabled: true,
+				URI:     "env(SUPABASE_PROJECT_URL)/functions/v1/send-email",
+			},
+		},
 	}
 
 	for _, tt := range tests {