Reading and writing data

Pick the client

Fetch data in server components where you can. With the normal clients, you do not add "is this user allowed?" checks for reads: the policies already filter the rows.

import { getSupabaseServerClient } from '@repo/supabase/server-client';

async function ProjectsList() {
  const client = getSupabaseServerClient();
  const { data } = await client.from('projects').select('*');
  // only the projects of accounts this user belongs to
}

Writes: server actions

Server actions use next-safe-action through @repo/next/safe-action:

'use server';

import * as z from 'zod';

import { authActionClient } from '@repo/next/safe-action';
import { getSupabaseServerClient } from '@repo/supabase/server-client';

const CreateProjectSchema = z.object({
  accountId: z.string().uuid(),
  name: z.string().min(1),
});

export const createProjectAction = authActionClient
  .inputSchema(CreateProjectSchema)
  .action(async ({ parsedInput }) => {
    const client = getSupabaseServerClient();

    // RLS decides whether this user may insert into this account
    await client.from('projects').insert({
      account_id: parsedInput.accountId,
      name: parsedInput.name,
    });
  });

The input schema validates what the browser sent. The insert still goes through row-level security, so a user who sends someone else's accountId is refused by the database.

Route handlers

API routes use enhanceRouteHandler from @repo/next/routes. Options: auth (require a user, default on), schema (a Zod schema for the body) and captcha. The handler receives request, the parsed body, the user and an RLS-bound client.

The agent skills for this

/server-action-builder, /service-builder and /react-form-builder write actions, services and forms in these patterns. /postgres-expert writes the table and its policies.