lovable-cloud-edge-functions

What problem does it solve?

It prevents misconfigured Supabase Edge Functions in Lovable Cloud that could accidentally expose browser-invoked endpoints or weaken defense-in-depth around service-role and webhook access control.

Core Features & Use Cases

• Auth tier guidance for Edge Functions: Enforces a clear mapping between caller type (browser, service role/cron, external webhook, or intentionally public) and the required verify_jwt behavior.
• config.toml security guardrails: Provides strict rules so every edge function has an explicit functions.<name> section and avoids risky bulk changes.
• In-code authentication requirements: Ensures Tier 1 relies on cryptographic user JWT validation (since gateway verification cannot apply) and Tier 2 includes both gateway verification and role-claim validation.
• Webhook signature verification correctness: Reduces HMAC verification failures by requiring raw-body consumption before any other body read.
• Deployment awareness for Lovable: Clarifies that Lovable does not auto-deploy external changes, and instructs how to request deployment for new/modified functions and verify_jwt updates.

Quick Start

Update your Supabase supabase/config.toml and edge function code to match the tier-based verify_jwt and in-code auth requirements described in this skill, then explicitly ask Lovable to deploy the affected edge functions.