feat: clipboard sync at /clip with supabase auth + realtime

[kaiiiichen]

Summary

• Adds Clipboard Sync at /clip (and clip.kaichen.dev via subdomain rewrite): Google sign-in (Supabase Auth + cookie session via @supabase/ssr), per-room access controlled through Supabase RLS, and live updates via Supabase Realtime postgres_changes on clipboard_entries.
• Adds /clip/admin (gated by ADMIN_EMAILS): list signed-up users, create/delete rooms, manage read / write membership through service-role server actions.
• Adds Next.js 16 proxy.ts (the new name for middleware.ts) that refreshes the Supabase auth cookie on every request and rewrites clip.kaichen.dev/* → /clip/* so a single Vercel project serves both hosts.
• Documents the feature, new env vars (NEXT_PUBLIC_SUPABASE_ANON_KEY, ADMIN_EMAILS), redirect URLs, and Vercel domain setup in README.md + .env.example.

Files of note

• app/clip/page.tsx — sign-in landing + room list (RLS-scoped query)
• app/clip/board/[id]/page.tsx + board-realtime.tsx — server data + client realtime UI
• app/clip/admin/{page,admin-panel,admin-actions}.tsx — admin-only management
• app/auth/{callback,sign-out}/route.ts — Supabase OAuth flow
• lib/supabase/{client,server,admin}.ts — three explicit Supabase client variants
• lib/clip/{admin,types}.ts — admin-email helper + shared types
• proxy.ts — session refresh + subdomain rewrite

Required env vars (already present in production except the new ones)

• NEXT_PUBLIC_SUPABASE_URL (existing)
• NEXT_PUBLIC_SUPABASE_ANON_KEY (new — public anon key for cookie auth)
• SUPABASE_SERVICE_ROLE_KEY (existing)
• ADMIN_EMAILS (new — comma-separated, e.g. kaichen26@berkeley.edu)

Supabase setup (outside this PR)

• Schema (clipboards, clipboard_members, clipboard_entries) already created.
• Add redirect URLs https://kaichen.dev/auth/callback, https://clip.kaichen.dev/auth/callback, and http://localhost:3000/auth/callback. Enable the Google provider.
• Enable Realtime on clipboard_entries and ensure RLS policies expose only rows the user is a member of (the browser relies on RLS for SELECT/INSERT).

Vercel setup

• Add clip.kaichen.dev as a domain on this project. The proxy.ts rewrite handles routing — no separate project needed.
• Set the new env vars in Production + Preview.

Test plan

• npm run lint && npm run typecheck && npm run test && npm run build all clean (no new warnings introduced).
• In a deploy preview with env vars set: visit /clip, sign in with Google, get redirected back, see room list (likely empty for a non-admin).
• As an ADMIN_EMAILS user, open /clip/admin, create a room, add yourself with write, open the room, post an entry, and verify it appears in another browser/incognito session for a different member in real time.
• Confirm a non-admin cannot reach /clip/admin (403-style fallback).
• Hit https://clip.kaichen.dev/ after deploy and confirm it serves the /clip page (rewrite works) and the /auth/callback redirect URL works against that host.

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kaichen.dev	Ready	Preview, Comment	Apr 26, 2026 9:37am