Home · Sample deliverable

Sample diagnosis report

This is the format of the written report delivered with the Fix. The project below is an illustrative example built for this page, not a client case.

1. Context

App generated with Lovable, React + Vite, Supabase (auth + Postgres), hosted on Netlify. Reported problem: "Checkout works for me, real customers get an error and no order is saved."

2. Reproduction

Reproduced on a copy with a test Supabase project: sign in as a new user, reload the checkout page, submit. The insert fails on the first submit after a reload, succeeds when the page was reached by in-app navigation.

3. Root cause

src/pages/Checkout.tsx, line 48: the insert runs in a useEffect on mount. After a full reload the Supabase client has not yet restored the session from storage, so the request is sent as anon, auth.uid() is null, and the policy with check (user_id = auth.uid()) rejects the row. In-app navigation hides the bug because the session is already in memory.

4. Fix

// src/pages/Checkout.tsx
- useEffect(() => { createOrder(cart) }, [])
+ useEffect(() => {
+   const { data: sub } = supabase.auth.onAuthStateChange((event, session) => {
+     if (session) createOrder(cart)
+   })
+   return () => sub.subscription.unsubscribe()
+ }, [])

-- migration: let the database set the owner
alter table orders alter column user_id set default auth.uid();

5. Security findings

• Table coupons has RLS disabled: readable and writable with the public anon key. Enable RLS, add a read-only policy for authenticated users.
• Policy "public read" on profiles using (true) exposes every email address. Restrict to user_id = auth.uid().

6. Verification

After the fix on the copy: order saved as user A after a hard reload; user B reads 0 rows of A; curl with the anon key on coupons and profiles returns []. Steps given so you can repeat them on your project.