One file that holds the admin client, and an import that makes the build fail if a client component ever reaches for it. The grep at the bottom is worth running after any session where the agent touched data access.
Snippet
Copied 12 times
// lib/supabase/admin.ts
import "server-only";
import { createClient } from "@supabase/supabase-js";
// This client bypasses RLS. Never import it from a Client Component.
export const supabaseAdmin = createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.SUPABASE_SERVICE_ROLE_KEY!,
{ auth: { persistSession: false, autoRefreshToken: false } }
);
// Check nothing else touches the key:
// grep -rn "SERVICE_ROLE" app components | grep -v "lib/supabase/admin"
AskVibe