DevVerse Supabase Workflow
Keep anon and service-role responsibilities separate. Browser-facing auth, favorites, and storage helpers use the anon client. Service-role usage must stay server-only.
Treat verify-email and reset-password routes as security-sensitive. Those routes are publicly callable and currently enumerate users via
listUsers({ perPage: 1000 }).Do not move service-role code into shared modules imported by client code.
Remember what Supabase is and is not used for here. Supabase handles auth, favorites, and some profile/storage helpers. It is not the runtime source of article content.
Read the runtime boundaries before changing auth or favorites behavior. @references/runtime-boundaries.md
After auth route changes, run repo tests and state any real-env validation you could not perform.