65-stack-supabase

Supabase Stack Rules

Row-Level Security (RLS)

Mandatory Practices

• Enable RLS on ALL tables (no exceptions)
• Use (SELECT auth.uid()) pattern for performance (17x faster)
• Index all columns used in RLS policies
• Always guard against null auth state

Performance Patterns

Function Caching (CRITICAL)

-- ❌ BAD: O(N × f(C)) — function per row
auth.uid() = user_id

-- ✅ GOOD: O(N + f(C)) — function once
(SELECT auth.uid()) = user_id

Join Optimization

-- ❌ BAD: Subquery per row
user_id IN (SELECT id FROM team_members WHERE team_id = ...)

-- ✅ GOOD: Array comparison
user_id = ANY(ARRAY(SELECT id FROM team_members WHERE team_id = ...))

Null Guards

-- ✅ Always include
auth.uid() IS NOT NULL AND (SELECT auth.uid()) = user_id

Policy Types

• Use permissive policies by default
• Use restrictive only for complex multi-condition scenarios
• Combine policies with OR logic (permissive) or AND logic (restrictive)

---

Authentication

Client-Side

• Never trust client-side auth state for sensitive operations
• Always verify session server-side before mutations
• Use supabase.auth.getUser() NOT getSession() for security

Server-Side

// ✅ Secure: Validates JWT with Supabase
const { data: { user }, error } = await supabase.auth.getUser();

// ❌ Insecure: Can be spoofed
const { data: { session } } = await supabase.auth.getSession();

Token Handling

• Never log full tokens
• Use short-lived access tokens
• Implement token refresh logic

---

Edge Functions

Structure

import { serve } from 'https://deno.land/[email protected]/http/server.ts';

serve(async (req) => {
  // CORS handling
  if (req.method === 'OPTIONS') {
    return new Response('ok', { headers: corsHeaders });
  }

  try {
    // Function logic
    return new Response(JSON.stringify({ data }), {
      headers: { ...corsHeaders, 'Content-Type': 'application/json' },
      status: 200,
    });
  } catch (error) {
    return new Response(JSON.stringify({ error: error.message }), {
      headers: { ...corsHeaders, 'Content-Type': 'application/json' },
      status: 400,
    });
  }
});