Maintenance Mode

Toggle the MAINTENANCE_MODE secret on a Supabase project's edge functions. When enabled, the login edge function returns HTTP 503 before any rate-limiting or DB work, blocking all new sign-ins.

Parameters

/maintenance <env> <on|off> — both arguments required. If either is missing, ask.

• dev → env file: .env.cloud.dev
• prod → env file: .env.cloud

Steps

1. Confirm intent for prod on

If the user is turning maintenance on for prod, briefly state what will happen (all new logins blocked) and ask the user to confirm before running the command. For prod off or any dev action, proceed without confirmation.

2. Source the env file and extract the project ref

The project ref is the subdomain of SUPABASE_URL in the env file:

set -a && source <env-file> && set +a
PROJECT_REF=$(echo "$SUPABASE_URL" | sed -E 's|https?://([^.]+)\..*|\1|')

3. Run the toggle

on:

npx supabase --workdir deployment secrets set MAINTENANCE_MODE=1 --project-ref "$PROJECT_REF"

off:

npx supabase --workdir deployment secrets unset MAINTENANCE_MODE --project-ref "$PROJECT_REF"

Secrets are read at runtime via Deno.env.get() in login/index.ts — no redeploy needed.

4. Verify

npx supabase --workdir deployment secrets list --project-ref "$PROJECT_REF" | grep MAINTENANCE_MODE

Report the final state to the user (on/off).

Optional message

If the user supplies a custom message (e.g. /maintenance prod on "back in 10 min"), also set:

npx supabase --workdir deployment secrets set MAINTENANCE_MESSAGE="<message>" --project-ref "$PROJECT_REF"

When turning off, also unset MAINTENANCE_MESSAGE only if it's currently set (unsetting a non-existent secret errors):

npx supabase --workdir deployment secrets list --project-ref "$PROJECT_REF" | grep -q MAINTENANCE_MESSAGE && npx supabase --workdir deployment secrets unset MAINTENANCE_MESSAGE --project-ref "$PROJECT_REF"

Notes

• Always pass --project-ref explicitly; never rely on a linked project.
• This only controls the server-side login killswitch. The client-side VITE_MAINTENANCE_MODE flag in Vercel is separate, requires a rebuild to take effect, and hides the entire app (not just login). Don't touch it from this skill.