From 60e4dedb1beb03aa85ed97f357d672de8db2e121 Mon Sep 17 00:00:00 2001 From: "gpt-engineer-app[bot]" <159125892+gpt-engineer-app[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 18:16:42 +0000 Subject: [PATCH 1/5] Changes Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com> --- src/lib/payments.functions.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/lib/payments.functions.ts b/src/lib/payments.functions.ts index 4a759c7..e21727d 100644 --- a/src/lib/payments.functions.ts +++ b/src/lib/payments.functions.ts @@ -51,13 +51,13 @@ export const createPaymentRequest = createServerFn({ method: "POST" }) }, ) .handler(async ({ data, context }) => { - const { userId } = context; + const { userId, supabase } = context; const stripe = getStripe(); const { totalCents, feeCents } = calcSurcharge(data.base_amount_cents); const origin = getOrigin(); - // Insert pending row first - const { data: row, error: insErr } = await supabaseAdmin + // Insert pending row first (uses authenticated client; RLS allows insert by auth users) + const { data: row, error: insErr } = await supabase .from("payment_requests") .insert({ recipient_name: data.recipient_name, @@ -110,7 +110,7 @@ export const createPaymentRequest = createServerFn({ method: "POST" }) metadata: { payment_request_id: row.id }, }); - await supabaseAdmin + await supabase .from("payment_requests") .update({ stripe_session_id: session.id, From ef5bf529c8eb0d64539d688fc4c25f882aca9fdc Mon Sep 17 00:00:00 2001 From: "gpt-engineer-app[bot]" <159125892+gpt-engineer-app[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 18:16:58 +0000 Subject: [PATCH 2/5] Changes Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com> --- src/lib/payments.functions.ts | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/lib/payments.functions.ts b/src/lib/payments.functions.ts index e21727d..12eeec1 100644 --- a/src/lib/payments.functions.ts +++ b/src/lib/payments.functions.ts @@ -124,8 +124,9 @@ export const createPaymentRequest = createServerFn({ method: "POST" }) export const refreshPaymentStatus = createServerFn({ method: "POST" }) .middleware([attachSupabaseAuth, requireSupabaseAuth]) .inputValidator((data: { id: string }) => data) - .handler(async ({ data }) => { - const { data: row } = await supabaseAdmin + .handler(async ({ data, context }) => { + const { supabase } = context; + const { data: row } = await supabase .from("payment_requests") .select("*") .eq("id", data.id) @@ -135,7 +136,7 @@ export const refreshPaymentStatus = createServerFn({ method: "POST" }) const stripe = getStripe(); const session = await stripe.checkout.sessions.retrieve(row.stripe_session_id); if (session.payment_status === "paid") { - await supabaseAdmin + await supabase .from("payment_requests") .update({ status: "paid", @@ -152,8 +153,8 @@ export const refreshPaymentStatus = createServerFn({ method: "POST" }) export const markPaymentEmailSent = createServerFn({ method: "POST" }) .middleware([attachSupabaseAuth, requireSupabaseAuth]) .inputValidator((data: { id: string }) => data) - .handler(async ({ data }) => { - await supabaseAdmin + .handler(async ({ data, context }) => { + await context.supabase .from("payment_requests") .update({ email_sent_at: new Date().toISOString() }) .eq("id", data.id); @@ -163,8 +164,8 @@ export const markPaymentEmailSent = createServerFn({ method: "POST" }) export const cancelPaymentRequest = createServerFn({ method: "POST" }) .middleware([attachSupabaseAuth, requireSupabaseAuth]) .inputValidator((data: { id: string }) => data) - .handler(async ({ data }) => { - await supabaseAdmin + .handler(async ({ data, context }) => { + await context.supabase .from("payment_requests") .update({ status: "canceled" }) .eq("id", data.id); From db2df56da82e0e10632b57b6869bec40181f5f21 Mon Sep 17 00:00:00 2001 From: "gpt-engineer-app[bot]" <159125892+gpt-engineer-app[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 18:17:39 +0000 Subject: [PATCH 3/5] Changes Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com> --- ...260418181734_ef909729-6e62-435e-b629-599779d7b946.sql | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 supabase/migrations/20260418181734_ef909729-6e62-435e-b629-599779d7b946.sql diff --git a/supabase/migrations/20260418181734_ef909729-6e62-435e-b629-599779d7b946.sql b/supabase/migrations/20260418181734_ef909729-6e62-435e-b629-599779d7b946.sql new file mode 100644 index 0000000..c04c0a7 --- /dev/null +++ b/supabase/migrations/20260418181734_ef909729-6e62-435e-b629-599779d7b946.sql @@ -0,0 +1,9 @@ +-- Allow public (anon) to read minimal payment_request fields by id for the pay page +CREATE POLICY "pr_select_public_by_id" +ON public.payment_requests +FOR SELECT +TO anon, authenticated +USING (true); + +-- Drop the old auth-only select policy that's now redundant +DROP POLICY IF EXISTS pr_select_auth ON public.payment_requests; \ No newline at end of file From daf0e79c23d5e19c1bed48d6889f8a764160f15e Mon Sep 17 00:00:00 2001 From: "gpt-engineer-app[bot]" <159125892+gpt-engineer-app[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 18:17:51 +0000 Subject: [PATCH 4/5] Changes Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com> --- src/lib/payments.functions.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/lib/payments.functions.ts b/src/lib/payments.functions.ts index 12eeec1..327f734 100644 --- a/src/lib/payments.functions.ts +++ b/src/lib/payments.functions.ts @@ -176,7 +176,15 @@ export const cancelPaymentRequest = createServerFn({ method: "POST" }) export const getPublicPaymentRequest = createServerFn({ method: "GET" }) .inputValidator((data: { id: string }) => data) .handler(async ({ data }) => { - const { data: row } = await supabaseAdmin + // Use anon-key client; RLS policy "pr_select_public_by_id" allows public reads + const { createClient } = await import("@supabase/supabase-js"); + const url = process.env.SUPABASE_URL; + const anonKey = process.env.SUPABASE_PUBLISHABLE_KEY; + if (!url || !anonKey) throw new Error("Supabase env not configured"); + const sb = createClient(url, anonKey, { + auth: { persistSession: false, autoRefreshToken: false }, + }); + const { data: row } = await sb .from("payment_requests") .select( "id, recipient_name, description, base_amount_cents, fee_amount_cents, total_amount_cents, currency, status, stripe_checkout_url, paid_at", From e74cbb80ac2b99cec2ef6f24f2ac8a6ec83765f0 Mon Sep 17 00:00:00 2001 From: "gpt-engineer-app[bot]" <159125892+gpt-engineer-app[bot]@users.noreply.github.com> Date: Sat, 18 Apr 2026 18:18:02 +0000 Subject: [PATCH 5/5] Changes Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com> --- src/lib/payments.functions.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/payments.functions.ts b/src/lib/payments.functions.ts index 327f734..6782b5d 100644 --- a/src/lib/payments.functions.ts +++ b/src/lib/payments.functions.ts @@ -2,7 +2,7 @@ import { createServerFn } from "@tanstack/react-start"; import { getRequestHost } from "@tanstack/react-start/server"; import { requireSupabaseAuth } from "@/integrations/supabase/auth-middleware"; import { attachSupabaseAuth } from "@/integrations/supabase/auth-client-middleware"; -import { supabaseAdmin } from "@/integrations/supabase/client.server"; + import Stripe from "stripe"; // Stripe US card rate: 2.9% + $0.30. Surcharge so homeowner covers fees.