tyler/route-commerce
1
0
Fork 1
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

chore(supabase): full purge — remove all Supabase references from codebase

Browse Source 
- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.
This commit is contained in:
Nora
2026-06-25 17:48:32 -06:00
parent 68a749f7af
commit 49b8e27219
171 changed files with 136 additions and 28594 deletions
Download Patch File Download Diff File Expand all files Collapse all files
supabase/migrations/.archived/109_enable_rls_critical.sql
-160
View File
@@ -1,160 +0,0 @@
-- 109_enable_rls_critical.sql (v2)
-- Supabase flagged 3 tables with RLS disabled. This replaces earlier policies
-- that may have been created by Supabase's built-in RLS assistant.
--
-- Confirmed existing (legacy) policies dropped:
-- "Platform admins manage admin_users" — no active=true check
-- "admin_users self read" — only self (user_id=auth.uid()), skips brand scope
--
-- Replacement policies:
-- admin_users_platform_admin_all — platform_admin with active=true only
-- admin_users_brand_scoped — brand scoped ALL (brand_admin/staff)
-- harvest_lots_platform_admin_all— platform_admin with active=true only
-- harvest_lots_brand_scoped — brand scoped ALL
-- harvest_lot_events_platform_admin_all — platform_admin with active=true only
-- harvest_lot_events_brand_scoped — events scoped via lot → harvest_lots
BEGIN;
-- ── admin_users ────────────────────────────────────────────────────────────────
ALTER TABLE public.admin_users ENABLE ROW LEVEL SECURITY;
-- Drop legacy policies installed by Supabase assistant
DROP POLICY IF EXISTS "Platform admins manage admin_users" ON public.admin_users;
DROP POLICY IF EXISTS "admin_users self read" ON public.admin_users;
DROP POLICY IF EXISTS "admin_users_platform_admin_all" ON public.admin_users;
DROP POLICY IF EXISTS "admin_users_brand_scoped" ON public.admin_users;
-- Platform admins: full access (active=true required)
CREATE POLICY "admin_users_platform_admin_all" ON public.admin_users
FOR ALL TO authenticated
USING (
EXISTS (
SELECT 1 FROM public.admin_users au
WHERE au.user_id = auth.uid()
AND au.role = 'platform_admin'
AND au.active = true
)
)
WITH CHECK (
EXISTS (
SELECT 1 FROM public.admin_users au
WHERE au.user_id = auth.uid()
AND au.role = 'platform_admin'
AND au.active = true
)
);
-- Brand admins / staff: access only rows matching their brand
CREATE POLICY "admin_users_brand_scoped" ON public.admin_users
FOR ALL TO authenticated
USING (
brand_id = (
SELECT brand_id FROM public.admin_users
WHERE user_id = auth.uid() AND active = true
LIMIT 1
)
)
WITH CHECK (
brand_id = (
SELECT brand_id FROM public.admin_users
WHERE user_id = auth.uid() AND active = true
LIMIT 1
)
);
-- ── harvest_lots ───────────────────────────────────────────────────────────────
ALTER TABLE public.harvest_lots ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS "harvest_lots_platform_admin_all" ON public.harvest_lots;
DROP POLICY IF EXISTS "harvest_lots_brand_scoped" ON public.harvest_lots;
CREATE POLICY "harvest_lots_platform_admin_all" ON public.harvest_lots
FOR ALL TO authenticated
USING (
EXISTS (
SELECT 1 FROM public.admin_users au
WHERE au.user_id = auth.uid()
AND au.role = 'platform_admin'
AND au.active = true
)
)
WITH CHECK (
EXISTS (
SELECT 1 FROM public.admin_users au
WHERE au.user_id = auth.uid()
AND au.role = 'platform_admin'
AND au.active = true
)
);
CREATE POLICY "harvest_lots_brand_scoped" ON public.harvest_lots
FOR ALL TO authenticated
USING (
brand_id = (
SELECT brand_id FROM public.admin_users
WHERE user_id = auth.uid() AND active = true
LIMIT 1
)
)
WITH CHECK (
brand_id = (
SELECT brand_id FROM public.admin_users
WHERE user_id = auth.uid() AND active = true
LIMIT 1
)
);
-- ── harvest_lot_events ────────────────────────────────────────────────────────
ALTER TABLE public.harvest_lot_events ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS "harvest_lot_events_platform_admin_all" ON public.harvest_lot_events;
DROP POLICY IF EXISTS "harvest_lot_events_brand_scoped" ON public.harvest_lot_events;
CREATE POLICY "harvest_lot_events_platform_admin_all" ON public.harvest_lot_events
FOR ALL TO authenticated
USING (
EXISTS (
SELECT 1 FROM public.admin_users au
WHERE au.user_id = auth.uid()
AND au.role = 'platform_admin'
AND au.active = true
)
)
WITH CHECK (
EXISTS (
SELECT 1 FROM public.admin_users au
WHERE au.user_id = auth.uid()
AND au.role = 'platform_admin'
AND au.active = true
)
);
-- Events are scoped to the lot via lot_id, so we check the lot's brand_id
CREATE POLICY "harvest_lot_events_brand_scoped" ON public.harvest_lot_events
FOR ALL TO authenticated
USING (
lot_id IN (
SELECT hl.id FROM public.harvest_lots hl
WHERE hl.brand_id = (
SELECT brand_id FROM public.admin_users
WHERE user_id = auth.uid() AND active = true
LIMIT 1
)
)
)
WITH CHECK (
lot_id IN (
SELECT hl.id FROM public.harvest_lots hl
WHERE hl.brand_id = (
SELECT brand_id FROM public.admin_users
WHERE user_id = auth.uid() AND active = true
LIMIT 1
)
)
);
COMMIT;