supabase_test

Minimal per-user to-do list.

Frontend: React 19 + TypeScript, built with Vite. Uses @supabase/supabase-js only for authentication.
Backend: ASP.NET Core 9 Web API. Validates Supabase-issued JWTs against the project's JWKS (via OpenID discovery), talks to Postgres directly with EF Core + Npgsql.
Auth + DB: Supabase.

See the design doc for the architecture and rationale, and the implementation plan for how it was built.

Prerequisites

.NET SDK 9.0
Node.js 20+
A Supabase project (URL, publishable key, Postgres password, and session-pooler hostname)

One-time setup

Apply the database migration to your Supabase project. Either:
- Open the Supabase dashboard → SQL Editor → paste migrations/001_create_todos.sql → Run, or
- PGPASSWORD='<db-password>' psql "host=aws-<n>-<region>.pooler.supabase.com port=5432 dbname=postgres user=postgres.<project-ref> sslmode=require" -f migrations/001_create_todos.sql
Disable email confirmation for dev. Supabase dashboard → Authentication → Providers → Email → toggle Confirm email off, so sign-up returns a session immediately.
Backend config:
```
cp backend/appsettings.Development.example.json backend/appsettings.Development.json
# Fill in: the pooler host/region, your project ref, and the DB password.
```
The connection string uses Supabase's session pooler (port 5432, IPv4). The direct host db.<ref>.supabase.co is IPv6-only on new projects and won't reach from IPv4-only environments. Grab the exact URL from Supabase dashboard → Project Settings → Database → Connection string → "Session pooler" tab.

Frontend config:

cp frontend/.env.example frontend/.env.local
# Fill in VITE_SUPABASE_URL, VITE_SUPABASE_PUBLISHABLE_KEY, VITE_API_URL.

Install frontend deps:
```
cd frontend && npm install
```

Run it

Two terminals:

# Terminal 1 — backend on http://localhost:5057
cd backend && dotnet run

# Terminal 2 — Vite dev server on http://localhost:5173
cd frontend && npm run dev

Open http://localhost:5173, sign up, add todos.

Layout

backend/       ASP.NET Core Web API
frontend/      Vite + React + TypeScript SPA
migrations/    Plain SQL files applied to Supabase Postgres
docs/          Design and implementation-plan docs

Notes

Row Level Security is deliberately off on the todos table — the .NET API is the only writer and enforces ownership via WHERE user_id = @currentUser in every query. If you ever want the browser to talk to PostgREST directly, turn RLS on and write policies first.
No automated tests in this first pass. docs/superpowers/plans/… lists manual verification steps used during construction (curl for backend, browser for frontend).

2.9 KiB Raw Blame History