From daf0e79c23d5e19c1bed48d6889f8a764160f15e Mon Sep 17 00:00:00 2001
From: "gpt-engineer-app[bot]"
 <159125892+gpt-engineer-app[bot]@users.noreply.github.com>
Date: Sat, 18 Apr 2026 18:17:51 +0000
Subject: [PATCH] Changes

Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com>
---
 src/lib/payments.functions.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/lib/payments.functions.ts b/src/lib/payments.functions.ts
index 12eeec1..327f734 100644
--- a/src/lib/payments.functions.ts
+++ b/src/lib/payments.functions.ts
@@ -176,7 +176,15 @@ export const cancelPaymentRequest = createServerFn({ method: "POST" })
 export const getPublicPaymentRequest = createServerFn({ method: "GET" })
   .inputValidator((data: { id: string }) => data)
   .handler(async ({ data }) => {
-    const { data: row } = await supabaseAdmin
+    // Use anon-key client; RLS policy "pr_select_public_by_id" allows public reads
+    const { createClient } = await import("@supabase/supabase-js");
+    const url = process.env.SUPABASE_URL;
+    const anonKey = process.env.SUPABASE_PUBLISHABLE_KEY;
+    if (!url || !anonKey) throw new Error("Supabase env not configured");
+    const sb = createClient(url, anonKey, {
+      auth: { persistSession: false, autoRefreshToken: false },
+    });
+    const { data: row } = await sb
       .from("payment_requests")
       .select(
         "id, recipient_name, description, base_amount_cents, fee_amount_cents, total_amount_cents, currency, status, stripe_checkout_url, paid_at",