feat: implement server side auth infra

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ on:
 env:
   PUBLIC_SUPABASE_URL: ${{ vars.PUBLIC_SUPABASE_URL || 'http://dummy' }}
   PUBLIC_SUPABASE_ANON_KEY: ${{ vars.PUBLIC_SUPABASE_ANON_KEY || 'anon-key' }}
-  PUBLIC_SUPABASE_SERVICE_KEY: ${{ vars.PUBLIC_SUPABASE_SERVICE_KEY }}
+  SUPABASE_SERVICE_KEY: ${{ vars.SUPABASE_SERVICE_KEY }}
   PUBLIC_GOOGLE_SERVICE_EMAIL: ${{ vars.PUBLIC_GOOGLE_SERVICE_EMAIL }}
   PUBLIC_GOOGLE_PRIVATE_KEY: ${{ vars.PUBLIC_GOOGLE_PRIVATE_KEY }}
 

.github/workflows/deploy.yml

@@ -12,7 +12,7 @@ env:
   # SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
   PUBLIC_SUPABASE_URL: ${{ vars.PUBLIC_SUPABASE_URL || 'http://dummy' }}
   PUBLIC_SUPABASE_ANON_KEY: ${{ vars.PUBLIC_SUPABASE_ANON_KEY || 'anon-key' }}
-  PUBLIC_SUPABASE_SERVICE_KEY: ${{ vars.PUBLIC_SUPABASE_SERVICE_KEY }}
+  SUPABASE_SERVICE_KEY: ${{ secrets.SUPABASE_SERVICE_KEY }}
   PUBLIC_GOOGLE_SERVICE_EMAIL: ${{ vars.PUBLIC_GOOGLE_SERVICE_EMAIL }}
   PUBLIC_GOOGLE_PRIVATE_KEY: ${{ vars.PUBLIC_GOOGLE_PRIVATE_KEY }}
 
@@ -59,7 +59,7 @@ jobs:
           CONTAINER_PORT=${{ env.CONTAINER_PORT }}
           PUBLIC_SUPABASE_URL=${{ env.PUBLIC_SUPABASE_URL }}
           PUBLIC_SUPABASE_ANON_KEY=${{ env.PUBLIC_SUPABASE_ANON_KEY }}
-          PUBLIC_SUPABASE_SERVICE_KEY=${{ env.PUBLIC_SUPABASE_SERVICE_KEY }}
+          SUPABASE_SERVICE_KEY=${{ env.SUPABASE_SERVICE_KEY }}
           PUBLIC_GOOGLE_SERVICE_EMAIL=${{ env.PUBLIC_GOOGLE_SERVICE_EMAIL }}
           PUBLIC_GOOGLE_PRIVATE_KEY=${{ env.PUBLIC_GOOGLE_PRIVATE_KEY }}
           EOF

.gitignore

@@ -2,3 +2,8 @@
 /.svelte-kit
 node_modules
 .env
+docs/
+CLAUDE.md
+.agents/
+.claude/
+skills-lock.json

src/app.d.ts

@@ -1,4 +1,5 @@
 import type { Session, SupabaseClient, User } from '@supabase/supabase-js';
+import type { AppRole } from '$lib/server/auth';
 import type { Database } from './database.types.ts'; // import generated types
 
 declare global {
@@ -9,9 +10,11 @@ declare global {
             safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
             session: Session | null;
             user: User | null;
+            userRole: AppRole | null;
         }
         interface PageData {
             session: Session | null;
+            userRole: AppRole | null;
         }
         // interface PageState {}
         // interface Platform {}

src/lib/server/auth.ts

@@ -0,0 +1,32 @@
+import { type RequestEvent, error } from '@sveltejs/kit';
+
+export type AppRole = 'applicant' | 'admin' | 'withdrawn' | 'inactive';
+
+/**
+ * Requires authenticated user. Throws 401 if not logged in.
+ */
+export function requireAuth(event: RequestEvent) {
+    const { user, session } = event.locals;
+    if (!session || !user) {
+        throw error(401, 'Authentication required');
+    }
+    return { user, session };
+}
+
+/**
+ * Requires a specific role. Throws 401 if not authenticated, 403 if wrong role.
+ */
+export function requireRole(event: RequestEvent, role: AppRole) {
+    const { user, session } = requireAuth(event);
+    if (event.locals.userRole !== role) {
+        throw error(403, 'Insufficient permissions');
+    }
+    return { user, session };
+}
+
+/**
+ * Check if current user is admin. Does not throw.
+ */
+export function isAdmin(event: RequestEvent): boolean {
+    return event.locals.userRole === 'admin';
+}

src/lib/server/supabaseAdmin.ts

@@ -0,0 +1,9 @@
+import { PUBLIC_SUPABASE_URL } from '$env/static/public';
+import { SUPABASE_SERVICE_KEY } from '$env/static/private';
+import { createClient } from '@supabase/supabase-js';
+
+/**
+ * Service-role Supabase client. Bypasses RLS.
+ * ONLY use in server-side code for admin operations.
+ */
+export const supabaseAdmin = createClient(PUBLIC_SUPABASE_URL, SUPABASE_SERVICE_KEY);