splitting editor and community

apps/community/lib/supabase/client.ts

@@ -0,0 +1,11 @@
+import { createClient } from '@supabase/supabase-js'
+import type { SupabaseDatabase } from '@pascal-app/db'
+
+const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!
+const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
+
+/**
+ * Supabase client for client-side use with anon key
+ * Uses Row Level Security (RLS) policies
+ */
+export const supabase = createClient<SupabaseDatabase>(supabaseUrl, supabaseAnonKey)

apps/community/lib/supabase/server.ts

@@ -0,0 +1,39 @@
+import { createClient } from '@supabase/supabase-js'
+import type { SupabaseDatabase } from '@pascal-app/db'
+import { env } from '@/env.mjs'
+
+/**
+ * Safety check: warn loudly if a Vercel preview deployment is using
+ * the production Supabase instance. This catches misconfigured branching.
+ */
+if (
+  process.env.VERCEL_ENV === 'preview' &&
+  process.env.SUPABASE_URL &&
+  env.NEXT_PUBLIC_SUPABASE_URL === process.env.SUPABASE_URL
+) {
+  // If the Supabase integration set a branch-specific SUPABASE_URL,
+  // it should differ from NEXT_PUBLIC_SUPABASE_URL (which comes from the
+  // generic env vars pointing at production). When they match, the
+  // integration likely skipped branch creation for this PR.
+  console.warn(
+    '⚠️  [supabase] Preview deployment appears to be using the PRODUCTION ' +
+    'Supabase instance. Supabase branching may not be configured for this PR. ' +
+    'See: https://supabase.com/docs/guides/deployment/branching',
+  )
+}
+
+/**
+ * Supabase client for server-side use with service role key
+ * Bypasses Row Level Security (RLS) - use with caution
+ * Always filter by user_id to enforce permissions
+ */
+export const supabaseAdmin = createClient<SupabaseDatabase>(
+  env.NEXT_PUBLIC_SUPABASE_URL,
+  env.SUPABASE_SERVICE_ROLE_KEY,
+  {
+    auth: {
+      persistSession: false,
+      autoRefreshToken: false,
+    },
+  },
+)