feat: add admin roles - #83
Merged
Merged
Conversation
Add project guidance for Claude Code, a detailed implementation plan for the admin role system, and simplified data flow diagrams. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- requireAuth(), requireRole(), isAdmin() utilities in lib/server/auth.ts - Service-role Supabase client in lib/server/supabaseAdmin.ts (bypasses RLS) - AppRole type includes applicant, admin, withdrawn, inactive Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The PUBLIC_ prefix exposes the service key to the browser in SvelteKit. Renamed to SUPABASE_SERVICE_KEY and moved to secrets in deploy workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Part of Phase 3 — needed for auth helpers to type-check correctly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add both to .gitignore. Files kept locally but not in the repo. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Implement authGuard that resolves user role from profiles table and attaches it to event.locals on every request - Pass userRole through layout server load to page data - Secure /api/get_gdrive_folder and /api/upload with session-based auth checks, replacing browser Supabase singleton with locals.supabase Made-with: Cursor
Sort imports alphabetically, use object destructuring for locals, and fix require-atomic-updates race conditions in authGuard hook. Made-with: Cursor
GitHub Actions doesn't expose secrets to fork PR workflows, so SUPABASE_SERVICE_KEY is empty during build. Deferring client creation to runtime prevents the "supabaseKey is required" crash. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sort imports alphabetically and use separate type import with eslint-disable to satisfy conflicting sort-imports and no-duplicate-imports rules. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR mainly covers the following: