Supabase auth, favorites, and security boundaries for DevVerse. Use when changing files under supabase/, auth or favorites UI, or the verify-email and reset-password API routes.
التثبيت
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
Supabase auth, favorites, and security boundaries for DevVerse. Use when changing files under supabase/, auth or favorites UI, or the verify-email and reset-password API routes.
DevVerse Supabase Workflow
Keep anon and service-role responsibilities separate.
Browser-facing auth, favorites, and storage helpers use the anon client. Service-role usage must stay server-only.
Treat verify-email and reset-password routes as security-sensitive.
Those routes are publicly callable and currently enumerate users via listUsers({ perPage: 1000 }).
Do not move service-role code into shared modules imported by client code.
Remember what Supabase is and is not used for here.
Supabase handles auth, favorites, and some profile/storage helpers. It is not the runtime source of article content.
Read the runtime boundaries before changing auth or favorites behavior.
@references/runtime-boundaries.md
After auth route changes, run repo tests and state any real-env validation you could not perform.
