django-supabase 1.0.0__py3-none-any.whl

django_supabase/__init__.py

@@ -0,0 +1,4 @@
+__version__ = '1.0.0'
+
+default_app_config = 'django_supabase.apps.DjangoSupabaseConfig'
+

django_supabase/apps.py

@@ -0,0 +1,13 @@
+from django.apps import AppConfig
+
+
+class DjangoSupabaseConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'django_supabase'
+    verbose_name = 'Supabase Integration'
+
+    def ready(self):
+        """Initialize Supabase integration on Django startup"""
+        from .conf import supabase_settings
+        # Validate settings on startup
+        supabase_settings.configure()

django_supabase/auth/__init__.py

@@ -0,0 +1 @@
+default_app_config = 'django_supabase.auth.apps.SupabaseAuthConfig'

django_supabase/auth/apps.py

@@ -0,0 +1,8 @@
+from django.apps import AppConfig
+
+
+class SupabaseAuthConfig(AppConfig):
+    name = 'django_supabase.auth'
+    label = 'supabase_auth'
+    verbose_name = 'Supabase User'
+    verbose_name_plural = 'Supabase Users'

django_supabase/auth/backends.py

@@ -0,0 +1,121 @@
+import logging
+
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.contrib.auth.backends import BaseBackend
+from supabase import create_client
+
+from .sync import sync_user_from_claims, sync_user_from_supabase
+from .tokens import (
+    SupabaseTokenError,
+    token_algorithm,
+    verify_token_with_jwks,
+    verify_token_with_secret,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class SupabaseAuthBackend(BaseBackend):
+    """
+    Authenticates against Supabase and syncs with Django User model
+    """
+
+    def __init__(self):
+        self.supabase = create_client(
+            settings.SUPABASE_URL,
+            settings.SUPABASE_KEY
+        )
+
+    def authenticate(self, request, token=None, **credentials):
+        if token:
+            return self._authenticate_token(token)
+
+        # Email/password auth
+        email = credentials.get('email')
+        password = credentials.get('password')
+
+        if not email or not password:
+            return None
+
+        try:
+            response = self.supabase.auth.sign_in_with_password({
+                "email": email,
+                "password": password
+            })
+
+            if response.user:
+                user, created = self._sync_user(response.user)
+                return user
+
+        except Exception as exc:
+            logger.debug('Supabase email/password authentication failed: %s', exc)
+            return None
+
+    def _authenticate_token(self, token):
+        """Validate JWT token from Supabase"""
+        verification_mode = getattr(
+            settings,
+            'SUPABASE_JWT_VERIFICATION',
+            'auth_server',
+        ).lower()
+
+        if verification_mode == 'auth_server':
+            return self._authenticate_token_with_auth_server(token)
+
+        if verification_mode == 'jwks':
+            return self._authenticate_token_with_jwks(token)
+
+        if verification_mode == 'jwt_secret':
+            return self._authenticate_token_with_secret(token)
+
+        logger.error('Unsupported SUPABASE_JWT_VERIFICATION mode: %s', verification_mode)
+        return None
+
+    def _authenticate_token_with_auth_server(self, token):
+        try:
+            response = self.supabase.auth.get_user(token)
+            supabase_user = getattr(response, 'user', None)
+            if not supabase_user:
+                return None
+            user, _ = sync_user_from_supabase(supabase_user)
+            return user
+        except Exception as exc:
+            logger.debug('Supabase Auth server token validation failed: %s', exc)
+            return None
+
+    def _authenticate_token_with_jwks(self, token):
+        try:
+            if token_algorithm(token) == 'HS256':
+                logger.warning(
+                    'Received HS256 token while SUPABASE_JWT_VERIFICATION=jwks'
+                )
+                return None
+            payload = verify_token_with_jwks(token)
+            if getattr(settings, 'SUPABASE_SYNC_USER_FROM_AUTH_ON_TOKEN', False):
+                return self._authenticate_token_with_auth_server(token)
+            user, _ = sync_user_from_claims(payload)
+            return user
+        except SupabaseTokenError as exc:
+            logger.debug('Supabase JWKS token validation failed: %s', exc)
+            return None
+
+    def _authenticate_token_with_secret(self, token):
+        try:
+            payload = verify_token_with_secret(token)
+            user, _ = sync_user_from_claims(payload)
+            return user
+        except SupabaseTokenError as exc:
+            logger.debug('Supabase JWT secret token validation failed: %s', exc)
+            return None
+
+    def _sync_user(self, supabase_user):
+        """Sync Supabase user with Django User model"""
+        return sync_user_from_supabase(supabase_user)
+
+    def get_user(self, user_id):
+        User = get_user_model()
+        try:
+            return User.objects.get(pk=user_id)
+        except User.DoesNotExist:
+            return None

django_supabase/auth/middleware.py

@@ -0,0 +1,33 @@
+from django.contrib.auth import authenticate
+from django.contrib.auth.middleware import get_user
+from django.utils.functional import SimpleLazyObject
+
+
+class SupabaseAuthMiddleware:
+    """
+    Middleware to authenticate requests using Supabase JWT tokens
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        # Extract token from Authorization header
+        auth_header = request.META.get('HTTP_AUTHORIZATION', '')
+
+        scheme, _, token = auth_header.partition(' ')
+
+        if scheme.lower() == 'bearer' and token:
+            request.user = SimpleLazyObject(
+                lambda: self._authenticate_token(request, token.strip())
+            )
+        else:
+            request.user = SimpleLazyObject(lambda: get_user(request))
+
+        response = self.get_response(request)
+        return response
+
+    def _authenticate_token(self, request, token):
+        """Authenticate using token"""
+        user = authenticate(request, token=token)
+        return user or get_user(request)

django_supabase/auth/migrations/0001_initial.py

@@ -0,0 +1,63 @@
+# Generated by Django 6.0.6 on 2026-06-11 12:57
+
+import django.contrib.auth.models
+import django.contrib.auth.validators
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='SupabaseUser',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('username', models.CharField(error_messages={'unique': 'A user with that username already exists.'}, help_text='Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.', max_length=150, unique=True, validators=[django.contrib.auth.validators.UnicodeUsernameValidator()], verbose_name='username')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
+                ('email', models.EmailField(blank=True, max_length=254, verbose_name='email address')),
+                ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
+                ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
+                ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
+                ('supabase_id', models.UUIDField(blank=True, db_index=True, null=True, unique=True)),
+                ('phone', models.CharField(blank=True, max_length=32)),
+                ('display_name', models.CharField(blank=True, max_length=150)),
+                ('avatar_url', models.URLField(blank=True)),
+                ('aud', models.CharField(blank=True, max_length=64)),
+                ('role', models.CharField(blank=True, max_length=64)),
+                ('provider', models.CharField(blank=True, max_length=64)),
+                ('providers', models.JSONField(blank=True, default=list)),
+                ('app_metadata', models.JSONField(blank=True, default=dict)),
+                ('user_metadata', models.JSONField(blank=True, default=dict)),
+                ('metadata', models.JSONField(blank=True, default=dict)),
+                ('identities', models.JSONField(blank=True, default=list)),
+                ('email_confirmed_at', models.DateTimeField(blank=True, null=True)),
+                ('phone_confirmed_at', models.DateTimeField(blank=True, null=True)),
+                ('last_sign_in_at', models.DateTimeField(blank=True, null=True)),
+                ('supabase_created_at', models.DateTimeField(blank=True, null=True)),
+                ('supabase_updated_at', models.DateTimeField(blank=True, null=True)),
+                ('is_anonymous', models.BooleanField(default=False)),
+                ('is_sso_user', models.BooleanField(default=False)),
+                ('banned_until', models.DateTimeField(blank=True, null=True)),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'db_table': 'auth_user',
+                'swappable': 'AUTH_USER_MODEL',
+            },
+            managers=[
+                ('objects', django.contrib.auth.models.UserManager()),
+            ],
+        ),
+    ]

django_supabase/auth/models.py

@@ -0,0 +1,36 @@
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+
+class SupabaseUser(AbstractUser):
+    """
+    Extended user model to store Supabase-specific data
+    """
+    supabase_id = models.UUIDField(unique=True, null=True, blank=True, db_index=True)
+    phone = models.CharField(max_length=32, blank=True)
+    display_name = models.CharField(max_length=150, blank=True)
+    avatar_url = models.URLField(blank=True)
+    aud = models.CharField(max_length=64, blank=True)
+    role = models.CharField(max_length=64, blank=True)
+    provider = models.CharField(max_length=64, blank=True)
+    providers = models.JSONField(default=list, blank=True)
+    app_metadata = models.JSONField(default=dict, blank=True)
+    user_metadata = models.JSONField(default=dict, blank=True)
+    metadata = models.JSONField(default=dict, blank=True)
+    identities = models.JSONField(default=list, blank=True)
+    email_confirmed_at = models.DateTimeField(null=True, blank=True)
+    phone_confirmed_at = models.DateTimeField(null=True, blank=True)
+    last_sign_in_at = models.DateTimeField(null=True, blank=True)
+    supabase_created_at = models.DateTimeField(null=True, blank=True)
+    supabase_updated_at = models.DateTimeField(null=True, blank=True)
+    is_anonymous = models.BooleanField(default=False)
+    is_sso_user = models.BooleanField(default=False)
+    banned_until = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        db_table = 'auth_user'  # Keep Django's default table name
+        swappable = 'AUTH_USER_MODEL'
+
+    @property
+    def name(self):
+        return self.display_name or self.get_full_name() or self.username
+

django_supabase/auth/sync.py

@@ -0,0 +1,228 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from typing import Any
+
+from django.contrib.auth import get_user_model
+from django.db import transaction
+from django.utils import timezone
+from django.utils.dateparse import parse_datetime
+
+
+def sync_user_from_supabase(supabase_user: Any):
+    """Create or update a Django user from a Supabase Auth user object."""
+    app_metadata = _as_dict(_value(supabase_user, 'app_metadata', {}))
+    user_metadata = _as_dict(_value(supabase_user, 'user_metadata', {}))
+
+    return _sync_user(
+        supabase_id=_value(supabase_user, 'id'),
+        email=_value(supabase_user, 'email') or '',
+        phone=_value(supabase_user, 'phone') or '',
+        aud=_value(supabase_user, 'aud') or '',
+        role=_value(supabase_user, 'role') or '',
+        app_metadata=app_metadata,
+        user_metadata=user_metadata,
+        identities=_jsonable(_value(supabase_user, 'identities', [])) or [],
+        email_confirmed_at=_parse_datetime(_value(supabase_user, 'email_confirmed_at')),
+        phone_confirmed_at=_parse_datetime(_value(supabase_user, 'phone_confirmed_at')),
+        last_sign_in_at=_parse_datetime(_value(supabase_user, 'last_sign_in_at')),
+        supabase_created_at=_parse_datetime(_value(supabase_user, 'created_at')),
+        supabase_updated_at=_parse_datetime(_value(supabase_user, 'updated_at')),
+        is_anonymous=bool(_value(supabase_user, 'is_anonymous', False)),
+        is_sso_user=bool(_value(supabase_user, 'is_sso_user', False)),
+        banned_until=_parse_datetime(_value(supabase_user, 'banned_until')),
+    )
+
+
+def sync_user_from_claims(claims: dict[str, Any]):
+    """Create or update a Django user from verified Supabase JWT claims."""
+    app_metadata = _as_dict(claims.get('app_metadata', {}))
+    user_metadata = _as_dict(claims.get('user_metadata', {}))
+
+    return _sync_user(
+        supabase_id=claims.get('sub'),
+        email=claims.get('email') or '',
+        phone=claims.get('phone') or '',
+        aud=_audience_to_string(claims.get('aud')),
+        role=claims.get('role') or '',
+        app_metadata=app_metadata,
+        user_metadata=user_metadata,
+        identities=[],
+        email_confirmed_at=None,
+        phone_confirmed_at=None,
+        last_sign_in_at=None,
+        supabase_created_at=None,
+        supabase_updated_at=None,
+        is_anonymous=bool(claims.get('is_anonymous', False)),
+        is_sso_user=False,
+        banned_until=None,
+    )
+
+
+@transaction.atomic
+def _sync_user(
+    *,
+    supabase_id: Any,
+    email: str,
+    phone: str,
+    aud: str,
+    role: str,
+    app_metadata: dict[str, Any],
+    user_metadata: dict[str, Any],
+    identities: list[Any],
+    email_confirmed_at: datetime | None,
+    phone_confirmed_at: datetime | None,
+    last_sign_in_at: datetime | None,
+    supabase_created_at: datetime | None,
+    supabase_updated_at: datetime | None,
+    is_anonymous: bool,
+    is_sso_user: bool,
+    banned_until: datetime | None,
+):
+    User = get_user_model()
+    field_names = {field.name for field in User._meta.fields}
+    supabase_id = str(supabase_id) if supabase_id else None
+
+    user = _find_existing_user(User, field_names, supabase_id, email)
+    created = user is None
+
+    if user is None:
+        user = User()
+        if 'password' in field_names:
+            user.set_unusable_password()
+
+    display_name = _display_name(user_metadata)
+    first_name, last_name = _name_parts(user_metadata, display_name)
+    avatar_url = (
+        user_metadata.get('avatar_url')
+        or user_metadata.get('picture')
+        or user_metadata.get('avatar')
+        or ''
+    )
+
+    defaults = {
+        'supabase_id': supabase_id,
+        'email': email,
+        'username': email or (f'supabase_{supabase_id}' if supabase_id else ''),
+        'phone': phone,
+        'display_name': display_name,
+        'first_name': first_name,
+        'last_name': last_name,
+        'avatar_url': avatar_url,
+        'aud': aud,
+        'role': role,
+        'provider': app_metadata.get('provider') or '',
+        'providers': app_metadata.get('providers') or [],
+        'app_metadata': app_metadata,
+        'user_metadata': user_metadata,
+        'metadata': user_metadata,
+        'identities': identities,
+        'email_confirmed_at': email_confirmed_at,
+        'phone_confirmed_at': phone_confirmed_at,
+        'last_sign_in_at': last_sign_in_at,
+        'supabase_created_at': supabase_created_at,
+        'supabase_updated_at': supabase_updated_at,
+        'is_anonymous': is_anonymous,
+        'is_sso_user': is_sso_user,
+        'banned_until': banned_until,
+        'is_active': banned_until is None,
+    }
+
+    for field, value in defaults.items():
+        if field in field_names:
+            setattr(user, field, value)
+
+    user.save()
+    return user, created
+
+
+def _find_existing_user(User, field_names: set[str], supabase_id: str | None, email: str):
+    if supabase_id and 'supabase_id' in field_names:
+        user = User.objects.filter(supabase_id=supabase_id).first()
+        if user:
+            return user
+
+    if email and 'email' in field_names:
+        return User.objects.filter(email__iexact=email).first()
+
+    return None
+
+
+def _value(obj: Any, field: str, default: Any = None):
+    if isinstance(obj, dict):
+        return obj.get(field, default)
+    return getattr(obj, field, default)
+
+
+def _as_dict(value: Any) -> dict[str, Any]:
+    if value is None:
+        return {}
+    if isinstance(value, dict):
+        return value
+    dumped = _jsonable(value)
+    return dumped if isinstance(dumped, dict) else {}
+
+
+def _jsonable(value: Any):
+    if value is None:
+        return None
+    if hasattr(value, 'model_dump'):
+        return value.model_dump(mode='json')
+    if isinstance(value, list):
+        return [_jsonable(item) for item in value]
+    if isinstance(value, tuple):
+        return [_jsonable(item) for item in value]
+    if isinstance(value, dict):
+        return {key: _jsonable(item) for key, item in value.items()}
+    if hasattr(value, '__dict__'):
+        return {
+            key: _jsonable(item)
+            for key, item in vars(value).items()
+            if not key.startswith('_')
+        }
+    return value
+
+
+def _parse_datetime(value: Any) -> datetime | None:
+    if not value:
+        return None
+
+    if isinstance(value, datetime):
+        parsed = value
+    elif isinstance(value, str):
+        parsed = parse_datetime(value)
+    else:
+        return None
+
+    if parsed and timezone.is_naive(parsed):
+        return timezone.make_aware(parsed, timezone=UTC)
+    return parsed
+
+
+def _display_name(user_metadata: dict[str, Any]) -> str:
+    return (
+        user_metadata.get('display_name')
+        or user_metadata.get('full_name')
+        or user_metadata.get('name')
+        or ''
+    )
+
+
+def _name_parts(user_metadata: dict[str, Any], display_name: str) -> tuple[str, str]:
+    first_name = user_metadata.get('first_name') or user_metadata.get('given_name')
+    last_name = user_metadata.get('last_name') or user_metadata.get('family_name')
+
+    if first_name or last_name:
+        return first_name or '', last_name or ''
+
+    if display_name and ' ' in display_name:
+        first_name, last_name = display_name.split(' ', 1)
+        return first_name, last_name
+
+    return display_name, ''
+
+
+def _audience_to_string(audience: Any) -> str:
+    if isinstance(audience, list):
+        return ','.join(str(item) for item in audience)
+    return str(audience or '')

django_supabase/auth/tokens.py

@@ -0,0 +1,93 @@
+from __future__ import annotations
+
+from functools import lru_cache
+from typing import Any
+
+import jwt
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+from jwt import PyJWKClient
+
+
+class SupabaseTokenError(Exception):
+    """Raised when a Supabase access token cannot be verified."""
+
+
+def verify_token_with_jwks(token: str) -> dict[str, Any]:
+    """Verify a Supabase JWT using the project's JWKS endpoint."""
+    try:
+        signing_key = _jwks_client().get_signing_key_from_jwt(token)
+        return jwt.decode(
+            token,
+            signing_key.key,
+            algorithms=_jwt_algorithms(),
+            audience=_jwt_audience(),
+            issuer=_jwt_issuer(),
+        )
+    except jwt.PyJWTError as exc:
+        raise SupabaseTokenError(str(exc)) from exc
+
+
+def verify_token_with_secret(token: str) -> dict[str, Any]:
+    """Verify a Supabase JWT using the legacy shared JWT secret."""
+    secret = getattr(settings, 'SUPABASE_JWT_SECRET', None)
+    if not secret:
+        raise ImproperlyConfigured(
+            'SUPABASE_JWT_SECRET is required when '
+            "SUPABASE_JWT_VERIFICATION='jwt_secret'"
+        )
+
+    try:
+        return jwt.decode(
+            token,
+            secret,
+            algorithms=['HS256'],
+            audience=_jwt_audience(),
+            issuer=_jwt_issuer(),
+        )
+    except jwt.PyJWTError as exc:
+        raise SupabaseTokenError(str(exc)) from exc
+
+
+def token_algorithm(token: str) -> str:
+    """Return the token header algorithm without trusting the payload."""
+    try:
+        return jwt.get_unverified_header(token).get('alg', '')
+    except jwt.PyJWTError as exc:
+        raise SupabaseTokenError(str(exc)) from exc
+
+
+@lru_cache(maxsize=1)
+def _jwks_client() -> PyJWKClient:
+    return PyJWKClient(
+        _jwks_url(),
+        cache_keys=True,
+        cache_jwk_set=True,
+        lifespan=600,
+        timeout=getattr(settings, 'SUPABASE_TIMEOUT', 30),
+    )
+
+
+def _jwt_issuer() -> str:
+    configured = getattr(settings, 'SUPABASE_JWT_ISSUER', None)
+    if configured:
+        return configured
+    return f"{settings.SUPABASE_URL.rstrip('/')}/auth/v1"
+
+
+def _jwks_url() -> str:
+    configured = getattr(settings, 'SUPABASE_JWKS_URL', None)
+    if configured:
+        return configured
+    return f"{_jwt_issuer().rstrip('/')}/.well-known/jwks.json"
+
+
+def _jwt_audience() -> str:
+    return getattr(settings, 'SUPABASE_JWT_AUDIENCE', 'authenticated')
+
+
+def _jwt_algorithms() -> list[str]:
+    algorithms = getattr(settings, 'SUPABASE_JWT_ALGORITHMS', ['RS256', 'ES256'])
+    if isinstance(algorithms, str):
+        return [item.strip() for item in algorithms.split(',') if item.strip()]
+    return list(algorithms)

django_supabase/conf.py

@@ -0,0 +1,70 @@
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+
+
+class SupabaseSettings:
+    """
+    Centralized settings management for Supabase integration
+    """
+
+    REQUIRED_SETTINGS = [
+        'SUPABASE_URL',
+        'SUPABASE_KEY',
+    ]
+
+    DEFAULTS = {
+        'SUPABASE_JWT_SECRET': None,
+        'SUPABASE_JWT_VERIFICATION': 'auth_server',
+        'SUPABASE_JWT_AUDIENCE': 'authenticated',
+        'SUPABASE_JWT_ALGORITHMS': ['RS256', 'ES256'],
+        'SUPABASE_JWT_ISSUER': None,
+        'SUPABASE_JWKS_URL': None,
+        'SUPABASE_SECRET_KEY': None,
+        'SUPABASE_SERVICE_KEY': None,
+        'SUPABASE_STORAGE_BUCKET': 'media',
+        'SUPABASE_MEDIA_BUCKET': 'media',
+        'SUPABASE_STATIC_BUCKET': 'static',
+        'SUPABASE_MEDIA_FOLDER': 'uploads',
+        'SUPABASE_STATIC_FOLDER': 'static',
+        'SUPABASE_STORAGE_PUBLIC': True,
+        'SUPABASE_STORAGE_AUTO_CREATE_BUCKETS': False,
+        'SUPABASE_AUTH_REQUIRED': False,
+        'SUPABASE_SYNC_USER_ON_LOGIN': True,
+        'SUPABASE_SYNC_USER_FROM_AUTH_ON_TOKEN': False,
+        'SUPABASE_CONNECTION_POOL_SIZE': 20,
+        'SUPABASE_TIMEOUT': 30,
+    }
+
+    def __init__(self):
+        self._configured = False
+
+    def configure(self):
+        """Validate required settings and apply defaults once Django is ready."""
+        if self._configured:
+            return
+        self._validate_settings()
+        self._set_defaults()
+        self._configured = True
+
+    def _validate_settings(self):
+        """Validate required settings are present"""
+        for setting in self.REQUIRED_SETTINGS:
+            if not getattr(settings, setting, None):
+                raise ImproperlyConfigured(
+                    f"Setting {setting} is required for Supabase integration"
+                )
+
+    def _set_defaults(self):
+        """Set default values for optional settings"""
+        for key, value in self.DEFAULTS.items():
+            if not hasattr(settings, key):
+                setattr(settings, key, value)
+
+    @classmethod
+    def get(cls, key, default=None):
+        """Get a setting value"""
+        return getattr(settings, key, default)
+
+
+# Initialize settings
+supabase_settings = SupabaseSettings()