---
description: Supabase conventions
globs: ["supabase/**", "**/*.{ts,tsx,sql}"]
---

# Supabase

## Security (non-negotiable)
- Every table in `public` has Row Level Security enabled with explicit policies. Write policies in the same migration that creates the table.
- The `service_role` key is server-only. Never put it in client code or `NEXT_PUBLIC_*`/`EXPO_PUBLIC_*` variables.
- Use `auth.uid()` in policies; wrap in `(select auth.uid())` for performance.

## Schema
- All schema changes via migrations: `supabase migration new <name>`, test locally with `supabase db reset`. Never change production schema in the dashboard.
- Add indexes for columns used in policies and foreign keys.

## Client
- Generate types: `supabase gen types typescript --local > types/database.ts`; create clients with `createClient<Database>()`.
- Use `@supabase/ssr` for server-side auth in SSR frameworks.
- Always check `{ data, error }` and handle `error`.

## Edge Functions
- Deno, in `supabase/functions/<name>/index.ts`; validate input and verify the JWT unless the function is intentionally public.