mde-supabase

Use `(SELECT auth.uid())` instead of `auth.uid()` so the value is cached per query rather than per row, and always pair UPDATE policies with SELECT policies since updates silently return zero rows without one. Index every column referenced in the policy.

Write the handler with the built-in `Deno.serve` (not the deprecated std serve import), add a `[functions.<name>]` block to `supabase/config.toml`, then run `supabase functions deploy <name>`. Set `verify_jwt = false` for webhooks and public endpoints.

Use `app_metadata` for authorization because `user_metadata` is editable by the user through the JS client and is unsafe for access decisions. Move authorization claims into `raw_app_meta_data` via a server-side trigger on `auth.users`.

Postgres RLS requires a SELECT policy before an UPDATE can match rows, since the update first selects the row. Without a matching SELECT policy the update silently affects zero rows, so audit `pg_policies` to confirm each mutating policy has a paired SELECT.

Always use broadcast via database triggers for new features because `postgres_changes` is single-threaded and does not scale under load. Combine it with private channels, `realtime.messages` RLS policies, and scoped topic names like `event:123:tickets`.

Do not use it for Auth0, Clerk, or Firebase Auth as the primary auth system, for raw Postgres or Neon without Supabase client, RLS, or Edge Functions in scope, or for Vercel-only environment questions with no Supabase secrets angle.