Next.js + Supabase Security

-- Enable RLS and add policies
ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;

CREATE POLICY "Users can view their own profile"
ON profiles FOR SELECT
TO authenticated
USING ((SELECT auth.uid()) = user_id);

CREATE POLICY "Users can update their own profile"
ON profiles FOR UPDATE
TO authenticated
USING ((SELECT auth.uid()) = user_id)
WITH CHECK ((SELECT auth.uid()) = user_id);

-- Separate policies with proper ownership checks
CREATE POLICY "Users view own profile"
ON profiles FOR SELECT
TO authenticated
USING ((SELECT auth.uid()) = user_id);

CREATE POLICY "Users insert own profile"
ON profiles FOR INSERT
TO authenticated
WITH CHECK ((SELECT auth.uid()) = user_id);

CREATE POLICY "Users update own profile"
ON profiles FOR UPDATE
TO authenticated
USING ((SELECT auth.uid()) = user_id)
WITH CHECK ((SELECT auth.uid()) = user_id);

CREATE POLICY "Users delete own profile"
ON profiles FOR DELETE
TO authenticated
USING ((SELECT auth.uid()) = user_id);

// lib/supabase/client.ts (for client components)
import { createClient } from '@supabase/supabase-js'

export const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY! // Safe with RLS
)

// lib/supabase/server.ts (for server only)
import { createClient } from '@supabase/supabase-js'
import 'server-only' // Prevents accidental client import

export const supabaseAdmin = createClient(
  process.env.SUPABASE_URL!, // No NEXT_PUBLIC_ prefix
  process.env.SUPABASE_SERVICE_KEY! // Never exposed
)

// SECURE: Always verify auth in Server Actions
'use server'

import { createServerClient } from '@supabase/ssr'
import { cookies } from 'next/headers'

export async function deletePost(postId: string) {
  const cookieStore = cookies()
  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    { cookies: { get: (name) => cookieStore.get(name)?.value } }
  )

  // Verify user is authenticated
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) throw new Error('Not authenticated')

  // Verify user owns this post (defense in depth)
  const { data: post } = await supabase
    .from('posts')
    .select('user_id')
    .eq('id', postId)
    .single()

  if (post?.user_id !== user.id) throw new Error('Not authorized')

  await supabase.from('posts').delete().eq('id', postId)
}

// SECURE: Fetch data on server, pass only public data
// app/page.tsx (Server Component)
import ClientDashboard from './ClientDashboard'
import { getPublicDashboardData } from '@/lib/data'

export default async function Page() {
  // Fetch data on server using secrets
  const dashboardData = await getPublicDashboardData()
  // Only pass sanitized, public data to client
  return <ClientDashboard data={dashboardData} />
}

// lib/data.ts
import 'server-only'

export async function getPublicDashboardData() {
  // Use secrets here, return only public data
  const response = await fetch(process.env.ANALYTICS_API_URL!, {
    headers: { 'Authorization': `Bearer ${process.env.ANALYTICS_KEY}` }
  })
  const data = await response.json()
  return { visitCount: data.visits, pageViews: data.pageViews }
}