Configuration Supabase

# Installer Supabase CLI
npm install -g supabase

# Login
supabase login

# Lier au projet
supabase link --project-ref xxxxx

# Push toutes les migrations
supabase db push

-- Pour chaque table, vérifier :
SELECT tablename, rowsecurity 
FROM pg_tables 
WHERE schemaname = 'public';

-- Public : lecture seule
CREATE POLICY "Allow public read on tools"
  ON tools FOR SELECT
  TO public
  USING (true);

-- Authenticated : CRUD complet
CREATE POLICY "Allow authenticated insert on tools"
  ON tools FOR INSERT
  TO authenticated
  WITH CHECK (true);

CREATE POLICY "Allow authenticated update on tools"
  ON tools FOR UPDATE
  TO authenticated
  USING (true) WITH CHECK (true);

CREATE POLICY "Allow authenticated delete on tools"
  ON tools FOR DELETE
  TO authenticated
  USING (true);

-- En tant que public (sans auth)
SELECT * FROM tools; -- ✅ Devrait fonctionner

INSERT INTO tools (name, description) 
VALUES ('Test', 'Test'); -- ❌ Devrait échouer

-- En tant qu'authenticated
-- (créez un user via Auth pour tester)

-- Bucket tool_logos : Public read, Authenticated write
CREATE POLICY "Public read tool_logos"
  ON storage.objects FOR SELECT
  USING (bucket_id = 'tool_logos');

CREATE POLICY "Authenticated upload tool_logos"
  ON storage.objects FOR INSERT
  TO authenticated
  WITH CHECK (bucket_id = 'tool_logos');

CREATE POLICY "Authenticated delete tool_logos"
  ON storage.objects FOR DELETE
  TO authenticated
  USING (bucket_id = 'tool_logos');

// Dans votre app (authenticated)
import { toolsApi } from '@/api';

const file = // ... récupéré depuis input file
const publicUrl = await toolsApi.uploadLogo(file);
console.log(publicUrl); // https://xxxxx.supabase.co/storage/v1/object/public/tool_logos/...

-- Lister tous les indexes
SELECT 
  tablename, 
  indexname, 
  indexdef 
FROM pg_indexes 
WHERE schemaname = 'public';

// Au lieu de :
const supabase = createClient(url, anonKey);

// Utilisez :
const supabase = createClient(poolerUrl, anonKey);

status:400
status:500
error

# Via CLI
supabase db dump -f backup.sql

# Ou via pgAdmin connecté à Supabase

// Créer un client non-auth
const publicClient = createClient(supabaseUrl, anonKey);

// Tester lecture (devrait fonctionner)
const { data: tools } = await publicClient.from('tools').select('*');
console.log(tools); // ✅ Liste des outils

// Tester écriture (devrait échouer)
const { error } = await publicClient
  .from('tools')
  .insert({ name: 'Hack' });
console.log(error); // ❌ "new row violates row-level security policy"

// ❌ Mauvais : concaténation de strings
const { data } = await supabase
  .rpc('unsafe_query', { 
    query: `SELECT * FROM tools WHERE name = '${userInput}'` 
  });

// ✅ Bon : utiliser les méthodes Supabase
const { data } = await supabase
  .from('tools')
  .select('*')
  .eq('name', userInput);

-- Queries lentes
SELECT * FROM pg_stat_statements 
ORDER BY total_exec_time DESC 
LIMIT 10;