From supabase-pro
Supabase auth, RLS, realtime, storage, edge functions, database design. Use when building or reviewing Supabase-backed applications.
How this skill is triggered — by the user, by Claude, or both
Slash command
/supabase-pro:supabase-proThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Build production-grade applications on Supabase. Covers auth, Row Level Security, realtime subscriptions, storage policies, Edge Functions, and database design patterns.
Build production-grade applications on Supabase. Covers auth, Row Level Security, realtime subscriptions, storage policies, Edge Functions, and database design patterns.
Use this when:
Use this ESPECIALLY when:
Don't skip when:
-- UUIDs, timestamptz, RLS on every table
CREATE TABLE projects (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
name TEXT NOT NULL,
description TEXT DEFAULT '',
owner_id UUID NOT NULL REFERENCES auth.users(id),
status TEXT NOT NULL DEFAULT 'active'
CHECK (status IN ('active', 'archived', 'deleted')),
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);
-- Enable RLS on every table
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
-- Every policy must be explicit (no public access by default)
-- Users can only see their own projects
CREATE POLICY "Users can view own projects"
ON projects FOR SELECT
USING (owner_id = auth.uid());
-- Users can create their own projects
CREATE POLICY "Users can create projects"
ON projects FOR INSERT
WITH CHECK (owner_id = auth.uid());
-- Users can update their own projects
CREATE POLICY "Users can update own projects"
ON projects FOR UPDATE
USING (owner_id = auth.uid())
WITH CHECK (owner_id = auth.uid());
-- Users can delete their own projects
CREATE POLICY "Users can delete own projects"
ON projects FOR DELETE
USING (owner_id = auth.uid());
-- Admin override (service_role bypasses RLS)
CREATE POLICY "Admins can view all projects"
ON projects FOR SELECT
USING (is_admin(auth.uid()));
// Server-side auth
import { createServerClient } from '@supabase/ssr'
export async function getServerClient() {
const supabase = createServerClient(
process.env.NEXT_PUBLIC_SUPABASE_URL,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
{ cookies: { getAll, setAll } }
)
return supabase
}
// Client-side auth
import { createBrowserClient } from '@supabase/ssr'
const supabase = createBrowserClient(
process.env.NEXT_PUBLIC_SUPABASE_URL,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY
)
// Sign up
const { data, error } = await supabase.auth.signUp({
email: '[email protected]',
password: 'password123',
options: { data: { full_name: 'John Doe' } }
})
// Protected API route
export async function POST(req: Request) {
const supabase = await getServerClient()
const { data: { user } } = await supabase.auth.getUser()
if (!user) return Response.json({ error: 'Unauthorized' }, { status: 401 })
const { data } = await supabase.from('projects').insert({
name: 'New Project',
owner_id: user.id,
})
return Response.json(data)
}
// Subscribe to changes
const channel = supabase
.channel('project-changes')
.on(
'postgres_changes',
{
event: '*',
schema: 'public',
table: 'projects',
filter: `owner_id=eq.${user.id}`,
},
(payload) => {
console.log('Change received!', payload)
// Optimistic UI update
}
)
.subscribe()
-- Bucket: project-files
-- Public bucket for avatars
CREATE POLICY "Public read access"
ON storage.objects FOR SELECT
USING (bucket_id = 'project-files');
-- Authenticated users can upload
CREATE POLICY "Authenticated users can upload"
ON storage.objects FOR INSERT
WITH CHECK (
bucket_id = 'project-files'
AND auth.role() = 'authenticated'
);
-- Users can only delete their own files
CREATE POLICY "Users can delete own files"
ON storage.objects FOR DELETE
USING (
bucket_id = 'project-files'
AND owner_id = auth.uid()
);
// supabase/functions/generate-report/index.ts
import { serve } from 'https://deno.land/std/http/server.ts'
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
serve(async (req) => {
const authHeader = req.headers.get('Authorization')!
const supabase = createClient(
Deno.env.get('SUPABASE_URL')!,
Deno.env.get('SUPABASE_ANON_KEY')!,
{ global: { headers: { Authorization: authHeader } } }
)
const { projectId } = await req.json()
const { data: project } = await supabase
.from('projects')
.select('*')
.eq('id', projectId)
.single()
if (!project) return new Response('Not found', { status: 404 })
return new Response(JSON.stringify({ report: generateReport(project) }), {
headers: { 'Content-Type': 'application/json' },
})
})
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub haj1t/senior-dev-squad-skills --plugin supabase-pro