Supabase + Next.js App Router Bundle
For Developers building with Supabase and Next.js App Router
A 1,017-line CLAUDE.md rules file that corrects the patterns AI models get wrong when building Supabase apps with Next.js App Router — covering auth, RLS, storage, realtime, and Edge Functions.
Description
Supabase has a large API surface that AI assistants consistently misuse with Next.js App Router: wrong client package, getSession() where getUser() is required, missing middleware that silently breaks sessions, RLS enabled with no policies, file uploads with original filenames as paths, and Realtime subscriptions without cleanup. This 1,017-line rules file encodes 15 production rules with exact before/after examples for the 10 most common mistakes, a complete 18-item pre-ship checklist, and patterns for the full Supabase stack: auth flows (email, OAuth, magic link), Row Level Security, Storage signed URLs, Realtime postgres_changes subscriptions, Edge Functions on Deno, and Server Actions with Zod validation.
What's included
- CLAUDE.md — 1,017-line rules file (15 rules, 10 common mistakes, 18-item checklist)
- README.md — installation guide for Claude Code, Cursor, Windsurf, and GitHub Copilot
Sample content
getUser() not getSession() in server contexts
`getSession()` reads from the cookie without server-side validation. Use `getUser()` for auth checks in Server Components, API routes, and middleware. This is the #1 Supabase security mistake.
Middleware must call supabase.auth.getUser()
Without calling `getUser()` in middleware, the session cookie doesn't refresh and users get silently logged out. The middleware pattern is not optional.
RLS enabled ≠ RLS configured
Enabling RLS with no policies blocks ALL access including your own queries. Always create at least one policy when enabling RLS. Test with a non-service-role key.
3 of 1 included items previewed above.
Delivery
Instant download after Stripe checkout. File: nightforge-supabase-nextjs-bundle.zip