Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/yudefine/nuxt-supabase-starter/database-accessgit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/database-access)<a href="https://agentmods.dev/rules/yudefine/nuxt-supabase-starter/database-access"><img src="https://agentmods.dev/badge/rules/yudefine/nuxt-supabase-starter/database-access.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01831 |
| Opus 5 | $0.00000 | $0.00915 |
| Sonnet 5 | $0.00000 | $0.00366 |
| Haiku 4.5 | $0.00000 | $0.00183 |
Grade A, and why
database-access scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Database Access Pattern
- Client（預設）: READ only via
useSupabaseClient<Database>()— 僅限 RLS SELECTTO public的表 - Server（預設）: request-scoped 讀寫一律經
/api/v1/*+getSupabaseWithContext(event)
Helper 名依
modules.auth而異：本檔以getSupabaseWithContext(event)為 canonical 名。當 consumer 的.claude/hub.jsonmodules.auth是better-auth或nuxt-auth-utils時，等價 helper 是getAuthedSupabase(event)—— 那些 auth stack 下 Supabase 不簽 JWT，auth.uid()恆 null，helper 只驗 session 不做授權，名字必須說實話。兩者回傳形狀相同（{ client, user }）。見 [[auth-data-path-consistency]] § Server 側：RLS policy 的前提條件。
- Privileged system tasks:
getServerSupabaseClient()僅用於 audit logging、backfill、資料修復、背景工作 - Optional transactional query layer:
server/utils/drizzle.ts僅用於 service 層 / 系統任務；NEVER 讓 Drizzle 接管 migration、RLS、trigger - Client-side writes are architecture exceptions — 只有在 proposal / ADR 明確記錄並同時滿足下列條件時，才可從 client 使用
.insert()/.update()/.delete()/.upsert()：- RLS policy 能完整表達 tenant / user scope 與所有授權規則
- GRANT 只開必要 schema / table / operation，不給寬權限
- 不需要
service_role、server-only secret、跨表 transaction、workflow transition、audit-chain、storage upload 或外部 API - 不涉及角色 / 權限、薪資、簽核、出勤、稽核、批次修復等敏感流程
- 有 focused tests 驗證 allow path、deny path、tenant isolation 與 RLS 失敗時的 UI/錯誤處理
- NEVER client 直讀 RLS
TO authenticated的表 —anon角色會靜默回傳 0 筆（見supabase-rlsskill）
MCP 存取
- Dev 查詢用
dev-supabaseMCP（local Supabase instance） - NEVER 使用 Kong port 8001 — Studio introspection 會觸發 PostgREST pool 重建，導致 REST API 中斷
- NEVER 在上班時間
docker restart任何 Supabase 容器
Seed 資料
seed.sql 使用 INSERT 格式（非 COPY FROM stdin），加 SET session_replication_role = replica; 和 TRUNCATE CASCADE。
本檔是 clade 投影，NEVER 就地編輯。專案特化寫進自家
.cursor/rules/local/；要改本檔請回 clade 源檔並 propagate。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 121 lines · 0 tokens per session scan A 4725b4865dd5
database-access is a cursor rule published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,831 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other cursor rules, from other repositories
sveltekit-spa
You are an expert SvelteKit engineer. Follow these rules ALWAYS when generating or editing code.
supabase
Supabase development guidelines, commands, and database patterns.
cursorrules
You are assisting the Orbital engineering team — 5 backend engineers building a multi-tenant SaaS for logistics operations. TypeScript monorepo using NestJS, PostgreSQL (drizzle-orm), and BullMQ. All engineers use shared conventions.
database-patterns
Prisma та БД — buero.de (PostgreSQL).
aws-rds-best-practices
AWS RDS PostgreSQL best practices - database configuration, connection management, authentication, backup, and performance optimization standards.
neon-toolkit
Use these rules to programmatically create, query, and destroy ephemeral Neon Postgres databases. Ideal for quick prototyping, testing, and temporary workflows.