Next.js + Supabase: query with supabase-js or use Drizzle directly?

The thing nobody mentions up front: Drizzle connects as the postgres role, which bypasses RLS. Your policies do nothing for queries that go through Drizzle. Every query has to filter by user in code, and one missed where leaks notes.

If RLS is your safety net, use supabase-js (with @supabase/ssr on the server) for anything user-scoped. Use Drizzle for the schema, migrations and admin jobs, where bypassing RLS is what you want.

Counterpoint, there's a middle way: Drizzle can run queries inside a transaction that sets role authenticated and the JWT claims, so RLS applies. There are helpers for this in the Drizzle docs. It's more setup though, and easy for an AI agent to skip. For a first project I'd go with Rafa's split.

Whichever you pick, add a test that logs in as user B and tries to read user A's note. That test catches the leak regardless of the library.