supabase-clientslisted

# Supabase Clients Three distinct client types — mixing them up leaks privileged access to the browser or breaks SSR sessions. ## The three clients 1. **Browser client** (anon key) — auth state only in Client Components. Never queries privileged tables. 2. **Server client** (anon key, cookie-bound) — reads current session in Server Components/Route Handlers. Still anon-scoped, not the privileged path. 3. **Service-role client** — server-only, privileged, lives in data-access layer. Never in browser bundle; never `NEXT_PUBLIC_*`. ## Rules - Only server handlers and data-access layer import service-role client - Cookie handling follows SSR middleware pattern — refresh in middleware, propagate Set-Cookie - Use shared factory functions — don't construct clients ad hoc per file - Service role key: server-only env var, never logged ## Checklist - [ ] Correct client type for context - [ ] No service-role client reachable from client-bundled code - [ ] Session cookie refresh wired in middleware Cursor equivalent: `.cursor/rules/supabase-clients.mdc`