fix(api): await createSupabaseServerClient() across all route handlers

createSupabaseServerClient() is async (uses next/headers cookies()).
Every call that lacked await received a Promise instead of the client,
causing supabase.auth.* and supabase.from() calls to throw TypeError
— resulting in 500 Internal Server Error on every authenticated API
endpoint including /api/auth/send-sms and /api/auth/verify-sms.

Fixed 23 route files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ralyodio

src/app/api/auth/debug-sms-config/route.js

@@ -111,7 +111,7 @@ export async function POST(request, { params } = {}) {
 
 		// If configuration is valid, test sending SMS
 		const { createSupabaseServerClient } = await import('@/lib/supabase.js');
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 
 		console.log(`Testing SMS send to: ${testPhoneNumber}`);
 		console.log(`Using Twilio config: Account SID: ${config.TWILIO_ACCOUNT_SID?.substring(0, 8)}***`);

src/app/api/auth/debug-sms/route.js

@@ -18,7 +18,7 @@ function isDevelopment() {
  * Verify the request is authenticated (defense in depth alongside NODE_ENV check)
  */
 async function verifyAuth(event) {
-	const supabase = createSupabaseServerClient();
+	const supabase = await createSupabaseServerClient();
 	const { data: { user }, error } = await supabase.auth.getUser();
 	return !error && !!user;
 }

src/app/api/auth/send-sms/route.js

@@ -72,7 +72,7 @@ export async function POST(request, { params } = {}) {
 		}
 
 		// Create Supabase client
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 
 		logger.info('Attempting to send SMS via Supabase Auth');
 		logger.info('Supabase project URL:', process.env.NEXT_PUBLIC_SUPABASE_URL);

src/app/api/auth/session/route.js

@@ -4,7 +4,7 @@ import { createSupabaseServerClient } from '@/lib/supabase.js';
 
 export async function GET(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 		const { data: { session }, error } = await supabase.auth.getSession();
 
 		if (error) {

src/app/api/auth/user/route.js

@@ -4,7 +4,7 @@ import { createSupabaseServerClient } from '@/lib/supabase.js';
 
 export async function GET(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 		const { data: { user }, error } = await supabase.auth.getUser();
 
 		if (error) {

src/app/api/auth/verify-sms/route.js

@@ -92,7 +92,7 @@ export async function POST(request, { params } = {}) {
 		}
 
 		// Create Supabase client
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 
 		let verifyData;
 		let verifyError;

src/app/api/chat/conversations/[id]/mark-read/route.js

@@ -7,7 +7,7 @@ import { createSupabaseServerClient } from '@/lib/supabase.js';
  */
 export async function POST(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 		const conversationId = params.id;
 
 		// Get user from session

src/app/api/chat/conversations/route.js

@@ -4,7 +4,7 @@ import { createSupabaseServerClient } from '@/lib/supabase.js';
 
 export async function GET(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 
 		// Get user from session
 		const { data: { user }, error: userError } = await supabase.auth.getUser();
@@ -83,7 +83,7 @@ export async function GET(request, { params } = {}) {
 
 export async function POST(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 		const { type, name, participant_ids, group_id } = await request.NextResponse.json();
 
 		// Get user from session
@@ -226,7 +226,7 @@ export async function POST(request, { params } = {}) {
 
 export async function PATCH(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 		const { conversation_id, action } = await request.NextResponse.json();
 
 		// Get user from session

src/app/api/chat/groups/route.js

@@ -4,7 +4,7 @@ import { createSupabaseServerClient } from '@/lib/supabase.js';
 
 export async function GET(request, { params } = {}) {
 	try {
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 
 		// Get user from session
 		const { data: { user }, error: userError } = await supabase.auth.getUser();

src/app/api/events/route.js

@@ -15,7 +15,7 @@ export async function GET(request, { params } = {}) {
 
 	try {
 		// Authenticate the user using getUser() for security
-		const supabase = createSupabaseServerClient();
+		const supabase = await createSupabaseServerClient();
 		const { data: { user }, error: authError } = await supabase.auth.getUser();
 
 		if (authError || !user) {