# supabase_test

Minimal per-user to-do list.

- **Frontend:** React 19 + TypeScript, built with Vite. Uses `@supabase/supabase-js` only for authentication.
- **Backend:** ASP.NET Core 9 Web API. Validates Supabase-issued JWTs against the project's JWKS (via OpenID discovery), talks to Postgres directly with EF Core + Npgsql.
- **Auth + DB:** Supabase.

See [the design doc](docs/superpowers/specs/2026-08-15-supabase-todo-app-design.md) for the architecture and rationale, and [the implementation plan](docs/superpowers/plans/2026-08-15-supabase-todo-app.md) for how it was built.

## Prerequisites

- .NET SDK 9.0
- Node.js 20+
- A Supabase project (URL, publishable key, Postgres password, and session-pooler hostname)

## One-time setup

1. **Apply the database migration to your Supabase project.** Either:
   - Open the Supabase dashboard → SQL Editor → paste `migrations/001_create_todos.sql` → Run, or
   - `PGPASSWORD='<db-password>' psql "host=aws-<n>-<region>.pooler.supabase.com port=5432 dbname=postgres user=postgres.<project-ref> sslmode=require" -f migrations/001_create_todos.sql`
2. **Disable email confirmation for dev.** Supabase dashboard → Authentication → Providers → Email → toggle **Confirm email** off, so sign-up returns a session immediately.
3. **Backend config:**
   ```bash
   cp backend/appsettings.Development.example.json backend/appsettings.Development.json
   # Fill in: the pooler host/region, your project ref, and the DB password.
   ```
   The connection string uses Supabase's **session pooler** (port 5432, IPv4). The direct host `db.<ref>.supabase.co` is IPv6-only on new projects and won't reach from IPv4-only environments. Grab the exact URL from Supabase dashboard → Project Settings → Database → Connection string → "Session pooler" tab.
4. **Frontend config:**
   ```bash
   cp frontend/.env.example frontend/.env.local
   # Fill in VITE_SUPABASE_URL, VITE_SUPABASE_PUBLISHABLE_KEY, VITE_API_URL.
   ```
5. **Install frontend deps:**
   ```bash
   cd frontend && npm install
   ```

## Run it

Two terminals:

```bash
# Terminal 1 — backend on http://localhost:5057
cd backend && dotnet run

# Terminal 2 — Vite dev server on http://localhost:5173
cd frontend && npm run dev
```

Open <http://localhost:5173>, sign up, add todos.

## Layout

```
backend/       ASP.NET Core Web API
frontend/      Vite + React + TypeScript SPA
migrations/    Plain SQL files applied to Supabase Postgres
docs/          Design and implementation-plan docs
```

## Notes

- Row Level Security is deliberately off on the `todos` table — the .NET API is the only writer and enforces ownership via `WHERE user_id = @currentUser` in every query. If you ever want the browser to talk to PostgREST directly, turn RLS on and write policies first.
- No automated tests in this first pass. `docs/superpowers/plans/…` lists manual verification steps used during construction (curl for backend, browser for frontend).