Here is what your application can actually do.

   3 
   4export async function POST(request: Request) {
   5  const body = await request.json();
   6 
   7  const session = await stripe.checkout.sessions.create({

  12});
  13 
  14await supabase.from('subscriptions').insert({
  15  user_id: body.userId,
  16  status: 'pending',

  14 
  15export async function DELETE(request: Request) {
  16  const body = await request.json();
  17  await supabase.from('api_keys').delete().eq('id', body.id);
  18  return new Response(null, { status: 204 });

  13 
  14export async function deleteWorkspace(workspaceId: string) {
  15  const { user, role } = await requireMember(workspaceId);
  16  if (role !== 'owner') throw new Error('Only the owner can do that');
  17 

  25// left for later, and the name never changed.
  26export async function sendOnboardingEmail(userId: string) {
  27  const { data: user } = await supabase.from('users').select('email').eq('id', userId).single();
  28  await supabase.from('users').update({ onboarded_at: new Date().toISOString() }).eq('id', userId);
  29  return user;

  26export async function sendOnboardingEmail(userId: string) {
  27  const { data: user } = await supabase.from('users').select('email').eq('id', userId).single();
  28  await supabase.from('users').update({ onboarded_at: new Date().toISOString() }).eq('id', userId);
  29  return user;
  30}

  12 
  13export async function DELETE(request: Request, { params }: { params: { id: string } }) {
  14  const body = await request.json();
  15  const { user } = await requireMember(body.workspaceId);
  16  await supabase.from('tasks').delete().eq('id', params.id);

  13export async function DELETE(request: Request, { params }: { params: { id: string } }) {
  14  const body = await request.json();
  15  const { user } = await requireMember(body.workspaceId);
  16  await supabase.from('tasks').delete().eq('id', params.id);
  17  await record('task.delete', user.id, params.id);

   4 
   5export async function POST() {
   6  const user = await requireUser();
   7  const { data } = await supabase
   8    .from('subscriptions')

   5export async function POST() {
   6  const user = await requireUser();
   7  const { data } = await supabase
   8    .from('subscriptions')
   9    .select('customer_id')

   5 
   6export async function POST(request: Request) {
   7  const body = await request.json();
   8  await requireMember(body.workspaceId);
   9 

   8await requireMember(body.workspaceId);
   9 
  10const { data: comments } = await supabase
  11  .from('comments')
  12  .select('body')

  13  .eq('project_id', body.projectId);
  14 
  15const result = streamText({
  16  model: openai(process.env.OPENAI_MODEL ?? 'gpt-4o-mini'),
  17  prompt: `Summarise this discussion:\n${(comments ?? []).map((c) => c.body).join('\n')}`,

   3// Debug switch left in. In development it skips the ownership filter entirely.
   4export async function GET(request: Request) {
   5  const workspaceId = new URL(request.url).searchParams.get('workspace');
   6 
   7  const query = supabase.from('files').select('*');

   5const workspaceId = new URL(request.url).searchParams.get('workspace');
   6 
   7const query = supabase.from('files').select('*');
   8const { data } =
   9  process.env.NODE_ENV === 'development'

   6 
   7const query = supabase.from('files').select('*');
   8const { data } =
   9  process.env.NODE_ENV === 'development'
  10    ? await query

   4 
   5export async function POST(request: Request) {
   6  const body = await request.json();
   7  const { user } = await requireMember(body.workspaceId);
   8 

   5export async function POST(request: Request) {
   6  const body = await request.json();
   7  const { user } = await requireMember(body.workspaceId);
   8 
   9  const { data: invitation } = await supabase

   7const { user } = await requireMember(body.workspaceId);
   8 
   9const { data: invitation } = await supabase
  10  .from('invitations')
  11  .insert({ email: body.email, workspace_id: body.workspaceId, invited_by: user.id })

  13    .single();
  14 
  15  await sendMail(body.email, 'You have been invited', 'Come and join us on Tidepool.');
  16  return Response.json(invitation);
  17}

   4 
   5export async function PATCH(request: Request, { params }: { params: { id: string } }) {
   6  const body = await request.json();
   7  const { user } = await requireMember(body.workspaceId);
   8  await supabase.from('tasks').update({ status: body.status }).eq('id', params.id);

   5export async function PATCH(request: Request, { params }: { params: { id: string } }) {
   6  const body = await request.json();
   7  const { user } = await requireMember(body.workspaceId);
   8  await supabase.from('tasks').update({ status: body.status }).eq('id', params.id);
   9  await record('task.update', user.id, params.id);

   6const body = await request.json();
   7const { user } = await requireMember(body.workspaceId);
   8await supabase.from('tasks').update({ status: body.status }).eq('id', params.id);
   9await record('task.update', user.id, params.id);
  10return new Response(null, { status: 204 });

   4export default async function ProjectPage({ params }: { params: { id: string } }) {
   5  await requireMember(params.id);
   6  const { data: tasks } = await supabase.from('tasks').select('*').eq('project_id', params.id);
   7  const { data: comments } = await supabase.from('comments').select('*').eq('project_id', params.id);
   8  return <main><pre>{JSON.stringify({ tasks, comments })}</pre></main>;

   5  await requireMember(params.id);
   6  const { data: tasks } = await supabase.from('tasks').select('*').eq('project_id', params.id);
   7  const { data: comments } = await supabase.from('comments').select('*').eq('project_id', params.id);
   8  return <main><pre>{JSON.stringify({ tasks, comments })}</pre></main>;
   9}

   7 
   8export async function archiveProject(projectId: string, workspaceId: string) {
   9  const { user } = await requireMember(workspaceId);
  10  await supabase.from('projects').update({ archived: true }).eq('id', projectId);
  11  await record('project.archive', user.id, projectId);

   8export async function archiveProject(projectId: string, workspaceId: string) {
   9  const { user } = await requireMember(workspaceId);
  10  await supabase.from('projects').update({ archived: true }).eq('id', projectId);
  11  await record('project.archive', user.id, projectId);
  12}

  31 
  32export async function inviteTeammate(email: string, workspaceId: string) {
  33  const { user } = await requireMember(workspaceId);
  34  await supabase.from('invitations').insert({ email, workspace_id: workspaceId, invited_by: user.id });
  35  await sendMail(email, 'Join the workspace', 'You have been invited to Tidepool.');

  32export async function inviteTeammate(email: string, workspaceId: string) {
  33  const { user } = await requireMember(workspaceId);
  34  await supabase.from('invitations').insert({ email, workspace_id: workspaceId, invited_by: user.id });
  35  await sendMail(email, 'Join the workspace', 'You have been invited to Tidepool.');
  36}

  33  const { user } = await requireMember(workspaceId);
  34  await supabase.from('invitations').insert({ email, workspace_id: workspaceId, invited_by: user.id });
  35  await sendMail(email, 'Join the workspace', 'You have been invited to Tidepool.');
  36}
  37 

   3 
   4export async function POST(request: Request) {
   5  const body = await request.json();
   6  await requireMember(body.workspaceId);
   7  const { data } = await supabase

   5const body = await request.json();
   6await requireMember(body.workspaceId);
   7const { data } = await supabase
   8  .from('files')
   9  .insert({ name: body.name, workspace_id: body.workspaceId })

   3 
   4export async function GET(request: Request, { params }: { params: { id: string } }) {
   5  const body = new URL(request.url).searchParams;
   6  await requireMember(body.get('workspaceId')!);
   7  const { data } = await supabase.from('projects').select('*').eq('id', params.id).single();

   5  const body = new URL(request.url).searchParams;
   6  await requireMember(body.get('workspaceId')!);
   7  const { data } = await supabase.from('projects').select('*').eq('id', params.id).single();
   8  return Response.json(data);
   9}

   3 
   4export default async function Settings() {
   5  const user = await requireUser();
   6  const { data } = await supabase.from('users').select('*').eq('id', user.id).single();
   7  const { data: subscription } = await supabase

   4export default async function Settings() {
   5  const user = await requireUser();
   6  const { data } = await supabase.from('users').select('*').eq('id', user.id).single();
   7  const { data: subscription } = await supabase
   8    .from('subscriptions')

   5const user = await requireUser();
   6const { data } = await supabase.from('users').select('*').eq('id', user.id).single();
   7const { data: subscription } = await supabase
   8  .from('subscriptions')
   9  .select('*')

  37 
  38export async function rotateApiKey(keyId: string) {
  39  const user = await requireUser();
  40  await supabase.from('api_keys').update({ secret: crypto.randomUUID() }).eq('id', keyId);
  41  await record('key.rotate', user.id, keyId);

  38export async function rotateApiKey(keyId: string) {
  39  const user = await requireUser();
  40  await supabase.from('api_keys').update({ secret: crypto.randomUUID() }).eq('id', keyId);
  41  await record('key.rotate', user.id, keyId);
  42}

   3 
   4export async function POST(request: Request) {
   5  const user = await requireUser();
   6  const body = await request.json();
   7  const { data } = await supabase

   4export async function POST(request: Request) {
   5  const user = await requireUser();
   6  const body = await request.json();
   7  const { data } = await supabase
   8    .from('api_keys')

   5const user = await requireUser();
   6const body = await request.json();
   7const { data } = await supabase
   8  .from('api_keys')
   9  .insert({ user_id: user.id, label: body.label, scope: body.scope })

   3 
   4export async function GET() {
   5  const user = await requireUser();
   6  const { data } = await supabase.from('projects').select('*').eq('owner_id', user.id);
   7  return Response.json(data);

   4export async function GET() {
   5  const user = await requireUser();
   6  const { data } = await supabase.from('projects').select('*').eq('owner_id', user.id);
   7  return Response.json(data);
   8}

   9 
  10export async function POST(request: Request) {
  11  const user = await requireUser();
  12  const body = await request.json();
  13  const { data } = await supabase

  10export async function POST(request: Request) {
  11  const user = await requireUser();
  12  const body = await request.json();
  13  const { data } = await supabase
  14    .from('projects')

  11const user = await requireUser();
  12const body = await request.json();
  13const { data } = await supabase
  14  .from('projects')
  15  .insert({ name: body.name, owner_id: user.id })

   3 
   4export default async function Dashboard() {
   5  const user = await requireUser();
   6  const { data: projects } = await supabase
   7    .from('projects')

   4export default async function Dashboard() {
   5  const user = await requireUser();
   6  const { data: projects } = await supabase
   7    .from('projects')
   8    .select('*')

   3 
   4export async function POST(request: Request) {
   5  const signature = request.headers.get('stripe-signature');
   6  const raw = await request.text();
   7 

   4export async function POST(request: Request) {
   5  const signature = request.headers.get('stripe-signature');
   6  const raw = await request.text();
   7 
   8  // Verifying the signature IS the authorisation here: it proves the request

   8// Verifying the signature IS the authorisation here: it proves the request
   9// came from Stripe and not from someone who guessed the URL.
  10const event = stripe.webhooks.constructEvent(
  11  raw,
  12  signature!,

  14);
  15 
  16if (event.type === 'checkout.session.completed') {
  17  await supabase.from('subscriptions').upsert({ status: 'active' });
  18  await supabase.from('invoices').insert({ amount: 0 });

   3export default async function AdminPage() {
   4  // Reached only through middleware, which does cover /admin.
   5  const { data: users } = await supabase.from('users').select('*');
   6  const { data: invoices } = await supabase.from('invoices').select('*');
   7  return <main><pre>{JSON.stringify({ users, invoices })}</pre></main>;

   4  // Reached only through middleware, which does cover /admin.
   5  const { data: users } = await supabase.from('users').select('*');
   6  const { data: invoices } = await supabase.from('invoices').select('*');
   7  return <main><pre>{JSON.stringify({ users, invoices })}</pre></main>;
   8}

   3 
   4export function middleware(request: NextRequest) {
   5  const token = request.cookies.get('session');
   6  if (!token) {
   7    return NextResponse.redirect(new URL('/login', request.url));