@intentsolutionsio/supabase-pack 1.0.0 → 1.0.3

package/skills/supabase-prod-checklist/references/examples.md

@@ -0,0 +1,153 @@
+## Examples
+
+### Next.js Production Client Setup
+
+```typescript
+// lib/supabase/client.ts — browser client (anon key only)
+import { createClient } from '@supabase/supabase-js';
+import type { Database } from '@/types/supabase';
+
+export const supabase = createClient<Database>(
+  process.env.NEXT_PUBLIC_SUPABASE_URL!,
+  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
+);
+```
+
+```typescript
+// lib/supabase/server.ts — server-side admin client
+import { createClient } from '@supabase/supabase-js';
+import type { Database } from '@/types/supabase';
+
+export const supabaseAdmin = createClient<Database>(
+  process.env.SUPABASE_URL!,
+  process.env.SUPABASE_SERVICE_ROLE_KEY!,
+  { auth: { autoRefreshToken: false, persistSession: false } }
+);
+```
+
+### Health Check Endpoint
+
+```typescript
+// app/api/health/route.ts
+import { createClient } from '@supabase/supabase-js';
+
+const supabase = createClient(
+  process.env.SUPABASE_URL!,
+  process.env.SUPABASE_ANON_KEY!
+);
+
+export async function GET() {
+  const start = Date.now();
+  const { data, error } = await supabase
+    .from('_health_check')
+    .select('id')
+    .limit(1);
+
+  const latency = Date.now() - start;
+
+  return Response.json({
+    status: error ? 'unhealthy' : 'healthy',
+    latency_ms: latency,
+    timestamp: new Date().toISOString(),
+    supabase_reachable: !error,
+  }, { status: error ? 503 : 200 });
+}
+```
+
+### Complete RLS Policy Set
+
+```sql
+-- Enable RLS on the posts table
+ALTER TABLE public.posts ENABLE ROW LEVEL SECURITY;
+
+-- Public read for published posts
+CREATE POLICY "Public read published" ON public.posts
+  FOR SELECT USING (status = 'published');
+
+-- Authors read own drafts
+CREATE POLICY "Authors read own drafts" ON public.posts
+  FOR SELECT USING (auth.uid() = author_id AND status = 'draft');
+
+-- Authors create posts
+CREATE POLICY "Authors create posts" ON public.posts
+  FOR INSERT WITH CHECK (auth.uid() = author_id);
+
+-- Authors update own posts
+CREATE POLICY "Authors update own posts" ON public.posts
+  FOR UPDATE USING (auth.uid() = author_id)
+  WITH CHECK (auth.uid() = author_id);
+
+-- Authors delete own drafts only
+CREATE POLICY "Authors delete own drafts" ON public.posts
+  FOR DELETE USING (auth.uid() = author_id AND status = 'draft');
+```
+
+### Storage Bucket Policy
+
+```sql
+-- Allow authenticated users to upload to their own folder in avatars bucket
+CREATE POLICY "Users upload own avatars"
+  ON storage.objects
+  FOR INSERT
+  WITH CHECK (
+    bucket_id = 'avatars'
+    AND auth.uid()::text = (storage.foldername(name))[1]
+  );
+
+-- Allow public read access to the public-assets bucket
+CREATE POLICY "Public read assets"
+  ON storage.objects
+  FOR SELECT
+  USING (bucket_id = 'public-assets');
+```
+
+### Edge Function with Secrets
+
+```typescript
+// supabase/functions/process-webhook/index.ts
+import { createClient } from '@supabase/supabase-js';
+
+Deno.serve(async (req) => {
+  const supabase = createClient(
+    Deno.env.get('SUPABASE_URL')!,
+    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
+  );
+
+  const body = await req.json();
+
+  const { error } = await supabase
+    .from('webhook_events')
+    .insert({ payload: body, received_at: new Date().toISOString() });
+
+  if (error) {
+    return new Response(JSON.stringify({ error: error.message }), {
+      status: 500,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+
+  return new Response(JSON.stringify({ received: true }), {
+    headers: { 'Content-Type': 'application/json' },
+  });
+});
+```
+
+### Rollback Procedure
+
+```bash
+# 1. Create a rollback migration for a bad schema change
+npx supabase migration new rollback_bad_change
+# Edit the generated SQL file with reversal statements
+npx supabase db push
+
+# 2. For data issues — use Point-in-Time Recovery
+# Dashboard > Database > Backups > PITR
+# Select timestamp before the incident
+
+# 3. For application deployment issues
+# Vercel:  vercel rollback
+# Netlify: netlify deploy --prod --dir=previous-build
+```
+
+---
+*[Tons of Skills](https://tonsofskills.com) by [Intent Solutions](https://intentsolutions.io) | [jeremylongshore.com](https://jeremylongshore.com)*

package/skills/supabase-prod-checklist/references/implementation.md

@@ -0,0 +1,113 @@
+# Implementation Guide
+
+## Pre-Deployment Configuration
+
+### Step 1: Environment Variable Setup
+
+```bash
+# Required environment variables for production
+NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ...   # Safe for client-side
+SUPABASE_URL=https://your-project.supabase.co
+SUPABASE_SERVICE_ROLE_KEY=eyJ...        # Server-side ONLY
+DATABASE_URL=postgresql://postgres.[REF]:[PASSWORD]@aws-0-us-east-1.pooler.supabase.com:6543/postgres  # Pooled
+```
+
+- [ ] Production API keys stored in deployment platform secrets (Vercel, Netlify, etc.)
+- [ ] Environment variables set in deployment platform (not in `.env` files committed to git)
+- [ ] API key scopes are minimal (least privilege)
+- [ ] `.env` and `.env.local` in `.gitignore`
+
+### Step 2: Code Quality Verification
+
+```bash
+# Verify no hardcoded credentials
+grep -r "eyJ" src/ --include="*.ts" --include="*.tsx" --include="*.js"
+# Should return zero results
+
+# Verify service_role key not in client bundle
+grep -r "service_role\|SERVICE_ROLE" src/ --include="*.ts" --include="*.tsx"
+# Should only appear in server-side files (app/api/, lib/supabase/server.ts)
+
+# Run test suite
+npm test
+npm run typecheck
+npm run lint
+```
+
+- [ ] All tests passing
+- [ ] No hardcoded credentials in source code
+- [ ] Error handling covers Supabase error types (see errors.md)
+- [ ] Retry logic with exponential backoff for transient failures
+- [ ] Logging is production-appropriate (no PII, no secrets)
+
+### Step 3: Database Configuration
+
+```sql
+-- Set statement timeout for authenticated role (prevent runaway queries)
+ALTER ROLE authenticated SET statement_timeout = '10s';
+
+-- Enable required extensions
+CREATE EXTENSION IF NOT EXISTS pg_stat_statements;  -- Query monitoring
+CREATE EXTENSION IF NOT EXISTS pgcrypto;             -- Encryption functions
+CREATE EXTENSION IF NOT EXISTS pg_trgm;              -- Text search (if needed)
+
+-- Verify RLS on all public tables (must return zero rows)
+SELECT schemaname, tablename, rowsecurity
+FROM pg_tables
+WHERE schemaname = 'public' AND rowsecurity = false;
+```
+
+### Step 4: Infrastructure Setup
+
+- [ ] Health check endpoint deployed (see examples.md)
+- [ ] Monitoring/alerting configured (error rates, latency, pool usage)
+- [ ] Custom domain configured and DNS verified
+- [ ] Network restrictions applied (IP allowlist)
+- [ ] SSL enforcement enabled
+
+### Step 5: Migration Verification
+
+```bash
+# Verify migrations are clean
+npx supabase db reset           # Reset local DB and replay all migrations
+npx supabase migration list     # Compare local vs remote migration history
+npx supabase db diff --use-migra # Check for schema drift
+
+# Apply to production
+npx supabase db push
+```
+
+- [ ] All schema changes captured in `supabase/migrations/`
+- [ ] Migrations replay cleanly on a fresh database
+- [ ] No schema drift between local and remote
+- [ ] Rollback migration prepared for risky changes
+
+### Step 6: Deploy with Verification
+
+```bash
+# Pre-flight checks
+curl -sf https://status.supabase.com/api/v2/status.json | jq '.status'
+npx supabase db ping --linked
+
+# Deploy application
+# (Platform-specific: Vercel, Netlify, etc.)
+
+# Post-deploy verification
+curl -sf https://your-app.com/api/health | jq '.'
+# Expected: { "status": "healthy", "latency_ms": <50, ... }
+```
+
+### Step 7: Post-Launch Monitoring (First 24 Hours)
+
+| Check | Frequency | Where |
+|-------|-----------|-------|
+| Health check response | Every 5 min | Uptime monitor (UptimeRobot, Better Stack) |
+| API error rate | Hourly | Dashboard > Logs > API |
+| Query performance | Every 4 hours | Dashboard > Database > Performance |
+| Connection pool usage | Every 2 hours | Dashboard > Database > Connections |
+| Auth success rate | Every 4 hours | Dashboard > Auth > Logs |
+| Storage bandwidth | Daily | Dashboard > Storage |
+
+---
+*[Tons of Skills](https://tonsofskills.com) by [Intent Solutions](https://intentsolutions.io) | [jeremylongshore.com](https://jeremylongshore.com)*