Claude Code checked user_metadata.role — clients can set admin
- Tried
- Ask Claude Code to set up Supabase auth with admin roles
- Broke
- Generated if (user.user_metadata.role === 'admin') — user_metadata is client-writable via /auth/v1/user; also put SERVICE_ROLE in components
- Fix
- Authorize with app_metadata (server-only); never put service_role in client bundles; re-audit role gates