feat(app): integrate authentication and subscription management

.env.local.example

···
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+
 # Stripe keys
 # https://dashboard.stripe.com/apikeys
 NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_12345
 STRIPE_SECRET_KEY=sk_12345
-STRIPE_PAYMENT_DESCRIPTION='Software development services'
+STRIPE_PAYMENT_DESCRIPTION='Something descriptive'
 # https://stripe.com/docs/webhooks/signatures
 STRIPE_WEBHOOK_SECRET=whsec_1234
+
+# Supabase keys
+NEXT_PUBLIC_SUPABASE_URL=https://randomhash.supabase.co
+NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_random-hash
+NEXT_PUBLIC_SUPABASE_ANON_KEY=anonkey
+SUPABASE_SERVICE_ROLE_KEY=somekey
+
+# https://dashboard.stripe.com/ 
+NEXT_PUBLIC_STRIPE_PRICE_ID=price_randomhash

README.md

···
 
 your data, your space, use it enywhere.
 
-A full-stack TypeScript application using Next.js for processing hosting service purchases.
+A full-stack TypeScript application using Next.js with Supabase Auth and Stripe subscriptions for access-controlled hosting services.
 
 ## Features
 
-- **Checkout** - Custom amount hosting service purchases with hosted checkout
-- **Payment Elements** - Custom payment form with Payment Element
-- **Webhook handling** - Server-side webhook processing for payment events
+- **Authentication** - Email-based authentication with Supabase Auth
+- **Subscriptions** - Stripe subscription checkout and management
+- **Dashboard** - User dashboard showing subscription status
+- **Protected API** - Server endpoints only accessible to subscribed users
+- **Webhook handling** - Server-side webhook processing for subscription events
 
 ## Tech Stack
 
 - **Frontend**: Next.js, React, TypeScript
 - **Backend**: Next.js Server Actions and Route Handlers
+- **Auth**: Supabase Auth
+- **Database**: Supabase PostgreSQL
+- **Payments**: Stripe Subscriptions
 
 ## Getting Started
 
 ### Prerequisites
 
 - Node.js 18+ installed
-- A payment processor account
+- A Supabase account and project
+- A Stripe account
 
 ### Installation
 
···
 pnpm install
 ```
 
-2. Set up environment variables:
+2. Set up Supabase:
+
+- Create a new Supabase project at [supabase.com](https://supabase.com)
+- Run the migration file to create the subscriptions table:
+  - Go to your Supabase project dashboard
+  - Navigate to SQL Editor
+  - Copy and run the contents of `supabase/migrations/001_subscriptions.sql`
+
+3. Set up environment variables:
 
 Create a `.env.local` file in the root directory:
 
 ```bash
+# Supabase
+NEXT_PUBLIC_SUPABASE_URL=your_supabase_project_url
+NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key
+SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key
+
+# Stripe
 NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=your_publishable_key
 STRIPE_SECRET_KEY=your_secret_key
 STRIPE_WEBHOOK_SECRET=your_webhook_secret
+NEXT_PUBLIC_STRIPE_PRICE_ID=your_stripe_price_id
+
+# App URL (for redirects)
+NEXT_PUBLIC_APP_URL=http://localhost:3000
 ```
 
-Get your API keys from your payment processor dashboard.
+Get your Supabase keys from your project settings → API.
+Get your Stripe keys from your Stripe dashboard.
+Create a subscription product and price in Stripe, then use the price ID for `NEXT_PUBLIC_STRIPE_PRICE_ID`.
 
 3. Start the development server:
 
···
 
 #### Local Development
 
-1. Install the payment processor CLI and link your account.
+1. Install the Stripe CLI and link your account:
+
+```bash
+stripe login
+```
 
 2. Start webhook forwarding to your local server:
 
 ```bash
-# Example command - adjust based on your payment processor
-webhook listen --forward-to localhost:3000/api/webhooks
+stripe listen --forward-to localhost:3000/api/webhooks
 ```
 
-3. Copy the webhook secret from the CLI output and add it to your `.env.local` file.
+3. Copy the webhook signing secret from the CLI output and add it to your `.env.local` file as `STRIPE_WEBHOOK_SECRET`.
 
 #### Production
 
 1. Deploy your application and copy the webhook URL (e.g., `https://your-domain.com/api/webhooks`).
 
-2. Create a webhook endpoint in your payment processor dashboard.
+2. In your Stripe dashboard, go to Developers → Webhooks and add an endpoint:
+   - URL: `https://your-domain.com/api/webhooks`
+   - Events to listen to:
+     - `checkout.session.completed`
+     - `customer.subscription.created`
+     - `customer.subscription.updated`
+     - `customer.subscription.deleted`
+     - `invoice.payment_succeeded`
+     - `invoice.payment_failed`
 
-3. Add the webhook signing secret to your production environment variables.
+3. Copy the webhook signing secret and add it to your production environment variables as `STRIPE_WEBHOOK_SECRET`.
 
 ## Testing
 
···
 ## Project Structure
 
 - `app/` - Next.js app directory with pages and components
-- `app/actions/` - Server actions for payment operations
-- `app/api/webhooks/` - Webhook handler route
-- `lib/` - Payment processor client configuration
-- `components/` - React components for payment forms
+  - `dashboard/` - User dashboard with subscription status and protected actions
+  - `login/` - Login page
+  - `signup/` - Sign up page
+  - `actions/` - Server actions for auth and subscriptions
+  - `api/` - API routes (webhooks, protected server endpoints)
+- `lib/` - Client configurations (Stripe, Supabase)
+- `supabase/migrations/` - Database migrations
+- `components/` - React components
 - `utils/` - Utility functions
+
+## How It Works
+
+1. **Authentication**: Users sign up/login with email via Supabase Auth
+2. **Subscription**: Users can subscribe via Stripe Checkout
+3. **Webhook Sync**: Stripe webhooks update subscription status in Supabase database
+4. **Access Control**: Dashboard shows subscription status and protected API buttons
+5. **Protected Routes**: `/api/server/[endpoint]` routes check for active subscription before allowing access
 
 ## Multi-Remote Git Setup
 

app/actions/auth.ts

···
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { createClient } from "@/lib/supabase/server";
+
+export async function signUp(formData: FormData) {
+  const supabase = await createClient();
+
+  const data = {
+    email: formData.get("email") as string,
+    password: formData.get("password") as string,
+  };
+
+  const { error } = await supabase.auth.signUp({
+    email: data.email,
+    password: data.password,
+    options: {
+      emailRedirectTo: `${process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000"}/auth/callback`,
+    },
+  });
+
+  if (error) {
+    return { error: error.message };
+  }
+
+  revalidatePath("/", "layout");
+  redirect("/dashboard");
+}
+
+export async function signIn(formData: FormData) {
+  const supabase = await createClient();
+
+  const data = {
+    email: formData.get("email") as string,
+    password: formData.get("password") as string,
+  };
+
+  const { error } = await supabase.auth.signInWithPassword({
+    email: data.email,
+    password: data.password,
+  });
+
+  if (error) {
+    return { error: error.message };
+  }
+
+  revalidatePath("/", "layout");
+  redirect("/dashboard");
+}
+
+export async function signOut() {
+  const supabase = await createClient();
+  await supabase.auth.signOut();
+  revalidatePath("/", "layout");
+  redirect("/");
+}

app/actions/subscription.ts

···
+"use server";
+
+import { createClient } from "@/lib/supabase/server";
+import { createAdminClient } from "@/lib/supabase/admin";
+import { stripe } from "@/lib/stripe";
+import { headers } from "next/headers";
+import type { Stripe } from "stripe";
+
+export async function getSubscriptionStatus() {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) {
+    return { subscribed: false, subscription: null };
+  }
+
+  const { data: subscription } = await supabase
+    .from("subscriptions")
+    .select("*")
+    .eq("user_id", user.id)
+    .in("status", ["active", "trialing"])
+    .order("created_at", { ascending: false })
+    .limit(1)
+    .maybeSingle();
+
+  return {
+    subscribed: !!subscription && (subscription.status === "active" || subscription.status === "trialing"),
+    subscription,
+  };
+}
+
+export async function syncSubscriptionFromCheckoutSession(sessionId: string) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) {
+    return { success: false, error: "Not authenticated" };
+  }
+
+  try {
+    // Retrieve the checkout session from Stripe
+    const session = await stripe.checkout.sessions.retrieve(sessionId, {
+      expand: ["subscription"],
+    });
+
+    // SECURITY: Verify the session belongs to this user
+    if (session.metadata?.user_id !== user.id) {
+      console.error(`Session ${sessionId} does not belong to user ${user.id}`);
+      return { success: false, error: "Session does not belong to this user" };
+    }
+
+    // SECURITY: Verify payment was successful
+    if (session.payment_status !== "paid") {
+      return { success: false, error: "Payment not completed" };
+    }
+
+    if (session.mode === "subscription" && session.subscription) {
+      const subscription = typeof session.subscription === "string"
+        ? await stripe.subscriptions.retrieve(session.subscription)
+        : session.subscription;
+
+      // SECURITY: Verify subscription customer matches session customer
+      if (subscription.customer !== session.customer) {
+        return { success: false, error: "Subscription customer mismatch" };
+      }
+
+      // Use admin client to bypass RLS (this is a validated update from Stripe)
+      // If admin client not available, we can't update (security: prevents user manipulation)
+      let supabaseClient;
+      try {
+        supabaseClient = createAdminClient();
+      } catch (error) {
+        console.error("Admin client required for subscription sync:", error);
+        return { 
+          success: false, 
+          error: "Server configuration error. Please contact support." 
+        };
+      }
+      
+      const { error: dbError } = await supabaseClient.from("subscriptions").upsert({
+        user_id: user.id,
+        stripe_customer_id: subscription.customer as string,
+        stripe_subscription_id: subscription.id,
+        stripe_price_id: subscription.items.data[0]?.price.id,
+        status: subscription.status,
+        current_period_start: new Date(subscription.current_period_start * 1000).toISOString(),
+        current_period_end: new Date(subscription.current_period_end * 1000).toISOString(),
+        cancel_at_period_end: subscription.cancel_at_period_end,
+      });
+
+      if (dbError) {
+        console.error("Database error:", dbError);
+        return { success: false, error: "Failed to sync subscription" };
+      }
+
+      return { success: true };
+    }
+
+    return { success: false, error: "Not a subscription session" };
+  } catch (error) {
+    console.error("Error syncing subscription:", error);
+    return { success: false, error: error instanceof Error ? error.message : "Unknown error" };
+  }
+}
+
+export async function createSubscriptionCheckout(priceId: string) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) {
+    throw new Error("User must be authenticated");
+  }
+
+  // Get or create Stripe customer
+  let customerId: string;
+  const { data: existingSubscription } = await supabase
+    .from("subscriptions")
+    .select("stripe_customer_id")
+    .eq("user_id", user.id)
+    .maybeSingle();
+
+  if (existingSubscription?.stripe_customer_id) {
+    customerId = existingSubscription.stripe_customer_id;
+  } else {
+    const customer = await stripe.customers.create({
+      email: user.email!,
+      metadata: {
+        supabase_user_id: user.id,
+      },
+    });
+    customerId = customer.id;
+
+    // Store customer ID in database (users can now insert their own records)
+    await supabase.from("subscriptions").upsert({
+      user_id: user.id,
+      stripe_customer_id: customerId,
+      status: "incomplete",
+    });
+  }
+
+  const headersList = await headers();
+  const originHeader = headersList.get("origin");
+  const hostHeader = headersList.get("host");
+  const origin = originHeader || `https://${hostHeader}` || process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000";
+
+  const checkoutSession = await stripe.checkout.sessions.create({
+    customer: customerId,
+    mode: "subscription",
+    payment_method_types: ["card"],
+    line_items: [
+      {
+        price: priceId,
+        quantity: 1,
+      },
+    ],
+    success_url: `${origin}/dashboard?session_id={CHECKOUT_SESSION_ID}`,
+    cancel_url: `${origin}/dashboard`,
+    metadata: {
+      user_id: user.id,
+    },
+  });
+
+  return { url: checkoutSession.url };
+}

app/api/server/[endpoint]/route.ts

···
+import { NextResponse } from "next/server";
+import { createClient } from "@/lib/supabase/server";
+import { getSubscriptionStatus } from "@/actions/subscription";
+
+export async function POST(
+  req: Request,
+  { params }: { params: Promise<{ endpoint: string }> }
+) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) {
+    return NextResponse.json(
+      { message: "Unauthorized" },
+      { status: 401 }
+    );
+  }
+
+  const { subscribed } = await getSubscriptionStatus();
+
+  if (!subscribed) {
+    return NextResponse.json(
+      { message: "Subscription required" },
+      { status: 403 }
+    );
+  }
+
+  const { endpoint } = await params;
+
+  // Here you would make the actual call to your other server
+  // For now, this is a placeholder that you can customize
+  try {
+    // Example: Make a call to your external server
+    // const externalServerUrl = process.env.EXTERNAL_SERVER_URL;
+    // const response = await fetch(`${externalServerUrl}/${endpoint}`, {
+    //   method: "POST",
+    //   headers: {
+    //     "Authorization": `Bearer ${userToken}`,
+    //     "Content-Type": "application/json",
+    //   },
+    //   body: JSON.stringify({ userId: user.id }),
+    // });
+    // const data = await response.json();
+
+    // Placeholder response
+    return NextResponse.json({
+      success: true,
+      endpoint,
+      message: `Server call to ${endpoint} successful`,
+      userId: user.id,
+      timestamp: new Date().toISOString(),
+    });
+  } catch (error) {
+    console.error("Error making server call:", error);
+    return NextResponse.json(
+      { message: "Failed to make server call", error: error instanceof Error ? error.message : "Unknown error" },
+      { status: 500 }
+    );
+  }
+}

app/api/webhooks/route.ts

···
 import { NextResponse } from "next/server";
 
 import { stripe } from "@/lib/stripe";
+import { createAdminClient } from "@/lib/supabase/admin";
 
 export async function POST(req: Request) {
   let event: Stripe.Event;
···
   // Successfully constructed event.
   console.log("✅ Success:", event.id);
 
+  const supabase = createAdminClient();
+
   const permittedEvents: string[] = [
     "checkout.session.completed",
-    "payment_intent.succeeded",
-    "payment_intent.payment_failed",
+    "customer.subscription.created",
+    "customer.subscription.updated",
+    "customer.subscription.deleted",
+    "invoice.payment_succeeded",
+    "invoice.payment_failed",
   ];
 
   if (permittedEvents.includes(event.type)) {
-    let data;
-
     try {
       switch (event.type) {
-        case "checkout.session.completed":
-          data = event.data.object as Stripe.Checkout.Session;
-          console.log(`💰 CheckoutSession status: ${data.payment_status}`);
+        case "checkout.session.completed": {
+          const session = event.data.object as Stripe.Checkout.Session;
+          console.log(`💰 CheckoutSession completed: ${session.id}`);
+
+          if (session.mode === "subscription" && session.subscription) {
+            const subscription = await stripe.subscriptions.retrieve(
+              session.subscription as string,
+              { expand: ["items.data.price.product"] }
+            );
+
+            const userId = session.metadata?.user_id;
+            if (userId) {
+              const { error } = await supabase.from("subscriptions").upsert({
+                user_id: userId,
+                stripe_customer_id: subscription.customer as string,
+                stripe_subscription_id: subscription.id,
+                stripe_price_id: subscription.items.data[0]?.price.id,
+                status: subscription.status,
+                current_period_start: new Date(subscription.current_period_start * 1000).toISOString(),
+                current_period_end: new Date(subscription.current_period_end * 1000).toISOString(),
+                cancel_at_period_end: subscription.cancel_at_period_end,
+              });
+              
+              if (error) {
+                console.error("Error upserting subscription:", error);
+              } else {
+                console.log(`✅ Subscription synced for user ${userId}`);
+              }
+            } else {
+              console.warn("No user_id in checkout session metadata");
+            }
+          }
           break;
-        case "payment_intent.payment_failed":
-          data = event.data.object as Stripe.PaymentIntent;
-          console.log(`❌ Payment failed: ${data.last_payment_error?.message}`);
+        }
+
+        case "customer.subscription.created":
+        case "customer.subscription.updated": {
+          const subscription = event.data.object as Stripe.Subscription;
+          console.log(`📦 Subscription ${event.type}: ${subscription.id}`);
+
+          // Find user by customer ID
+          const { data: existing } = await supabase
+            .from("subscriptions")
+            .select("user_id")
+            .eq("stripe_customer_id", subscription.customer as string)
+            .single();
+
+          if (existing?.user_id) {
+            const { error } = await supabase.from("subscriptions").upsert({
+              user_id: existing.user_id,
+              stripe_customer_id: subscription.customer as string,
+              stripe_subscription_id: subscription.id,
+              stripe_price_id: subscription.items.data[0]?.price.id,
+              status: subscription.status,
+              current_period_start: new Date(subscription.current_period_start * 1000).toISOString(),
+              current_period_end: new Date(subscription.current_period_end * 1000).toISOString(),
+              cancel_at_period_end: subscription.cancel_at_period_end,
+            });
+            
+            if (error) {
+              console.error("Error upserting subscription:", error);
+            }
+          } else {
+            // Try to find user by customer metadata
+            const customer = await stripe.customers.retrieve(subscription.customer as string);
+            if (customer && !customer.deleted && customer.metadata?.supabase_user_id) {
+              const { error } = await supabase.from("subscriptions").upsert({
+                user_id: customer.metadata.supabase_user_id,
+                stripe_customer_id: subscription.customer as string,
+                stripe_subscription_id: subscription.id,
+                stripe_price_id: subscription.items.data[0]?.price.id,
+                status: subscription.status,
+                current_period_start: new Date(subscription.current_period_start * 1000).toISOString(),
+                current_period_end: new Date(subscription.current_period_end * 1000).toISOString(),
+                cancel_at_period_end: subscription.cancel_at_period_end,
+              });
+              
+              if (error) {
+                console.error("Error upserting subscription:", error);
+              }
+            }
+          }
           break;
-        case "payment_intent.succeeded":
-          data = event.data.object as Stripe.PaymentIntent;
-          console.log(`💰 PaymentIntent status: ${data.status}`);
+        }
+
+        case "customer.subscription.deleted": {
+          const subscription = event.data.object as Stripe.Subscription;
+          console.log(`🗑️ Subscription deleted: ${subscription.id}`);
+
+          await supabase
+            .from("subscriptions")
+            .update({ status: "canceled" })
+            .eq("stripe_subscription_id", subscription.id);
+          break;
+        }
+
+        case "invoice.payment_succeeded": {
+          const invoice = event.data.object as Stripe.Invoice;
+          console.log(`💳 Invoice payment succeeded: ${invoice.id}`);
+
+          if (invoice.subscription) {
+            const subscription = await stripe.subscriptions.retrieve(
+              invoice.subscription as string
+            );
+
+            const { data: existing } = await supabase
+              .from("subscriptions")
+              .select("user_id")
+              .eq("stripe_subscription_id", subscription.id)
+              .single();
+
+            if (existing?.user_id) {
+              await supabase.from("subscriptions").upsert({
+                user_id: existing.user_id,
+                stripe_customer_id: subscription.customer as string,
+                stripe_subscription_id: subscription.id,
+                stripe_price_id: subscription.items.data[0]?.price.id,
+                status: subscription.status,
+                current_period_start: new Date(subscription.current_period_start * 1000).toISOString(),
+                current_period_end: new Date(subscription.current_period_end * 1000).toISOString(),
+                cancel_at_period_end: subscription.cancel_at_period_end,
+              });
+            }
+          }
           break;
+        }
+
+        case "invoice.payment_failed": {
+          const invoice = event.data.object as Stripe.Invoice;
+          console.log(`❌ Invoice payment failed: ${invoice.id}`);
+
+          if (invoice.subscription) {
+            await supabase
+              .from("subscriptions")
+              .update({ status: "past_due" })
+              .eq("stripe_subscription_id", invoice.subscription as string);
+          }
+          break;
+        }
+
         default:
-          throw new Error(`Unhandled event: ${event.type}`);
+          console.log(`Unhandled event type: ${event.type}`);
       }
     } catch (error) {
-      console.log(error);
+      console.error("Webhook handler error:", error);
       return NextResponse.json(
         { message: "Webhook handler failed" },
         { status: 500 },

app/auth/callback/route.ts

···
+import { createClient } from "@/lib/supabase/server";
+import { NextResponse } from "next/server";
+
+export async function GET(request: Request) {
+  const requestUrl = new URL(request.url);
+  const code = requestUrl.searchParams.get("code");
+  const next = requestUrl.searchParams.get("next") || "/dashboard";
+
+  if (code) {
+    const supabase = await createClient();
+    await supabase.auth.exchangeCodeForSession(code);
+  }
+
+  return NextResponse.redirect(new URL(next, request.url));
+}

app/dashboard/dashboard-client.tsx

···
+"use client";
+
+import { useState } from "react";
+import { createSubscriptionCheckout } from "@/actions/subscription";
+
+interface DashboardClientProps {
+  subscribed: boolean;
+  subscription: any;
+  priceId: string;
+}
+
+export default function DashboardClient({ subscribed, subscription, priceId }: DashboardClientProps) {
+  const [loading, setLoading] = useState(false);
+
+  const handleSubscribe = async () => {
+    if (!priceId) {
+      alert("Stripe price ID not configured. Please set NEXT_PUBLIC_STRIPE_PRICE_ID in your environment variables.");
+      return;
+    }
+
+    setLoading(true);
+    try {
+      const { url } = await createSubscriptionCheckout(priceId);
+      if (url) {
+        window.location.href = url;
+      }
+    } catch (error) {
+      console.error("Error creating checkout:", error);
+      alert("Failed to create checkout session. Please try again.");
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleServerCall = async (endpoint: string) => {
+    try {
+      const response = await fetch(`/api/server/${endpoint}`, {
+        method: "POST",
+      });
+
+      if (!response.ok) {
+        const error = await response.json();
+        throw new Error(error.message || "Failed to make server call");
+      }
+
+      const data = await response.json();
+      alert(`Success: ${JSON.stringify(data, null, 2)}`);
+    } catch (error) {
+      console.error("Error making server call:", error);
+      alert(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  };
+
+  if (!subscribed) {
+    return (
+      <div style={{ marginTop: "32px", padding: "24px", border: "1px solid #ccc", borderRadius: "8px" }}>
+        <h2>Subscribe to Access</h2>
+        <p>You need an active subscription to access the server features.</p>
+        <button
+          onClick={handleSubscribe}
+          disabled={loading}
+          style={{
+            marginTop: "16px",
+            padding: "12px 24px",
+            borderRadius: "6px",
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            border: "1px solid #ffffff",
+            cursor: loading ? "not-allowed" : "pointer",
+            fontWeight: 600,
+            opacity: loading ? 0.6 : 1,
+          }}
+        >
+          {loading ? "Loading..." : "Subscribe Now"}
+        </button>
+      </div>
+    );
+  }
+
+  return (
+    <div style={{ marginTop: "32px" }}>
+      <div style={{ padding: "24px", border: "1px solid #4caf50", borderRadius: "8px", backgroundColor: "#f0f9f0", marginBottom: "24px" }}>
+        <h2 style={{ color: "#4caf50", marginTop: 0 }}>✓ Active Subscription</h2>
+        {subscription && (
+          <div>
+            <p>
+              <strong>Status:</strong> {subscription.status}
+            </p>
+            {subscription.current_period_end && (
+              <p>
+                <strong>Renews:</strong> {new Date(subscription.current_period_end).toLocaleDateString()}
+              </p>
+            )}
+          </div>
+        )}
+      </div>
+
+      <div style={{ padding: "24px", border: "1px solid #ccc", borderRadius: "8px" }}>
+        <h2>Server Actions</h2>
+        <p>You have access to the following server endpoints:</p>
+        
+        <div style={{ display: "flex", flexDirection: "column", gap: "12px", marginTop: "16px" }}>
+          <button
+            onClick={() => handleServerCall("action1")}
+            style={{
+              padding: "12px 24px",
+              borderRadius: "6px",
+              backgroundColor: "#000000",
+              color: "#ffffff",
+              border: "1px solid #ffffff",
+              cursor: "pointer",
+              fontWeight: 600,
+            }}
+          >
+            Call Server Action 1
+          </button>
+          
+          <button
+            onClick={() => handleServerCall("action2")}
+            style={{
+              padding: "12px 24px",
+              borderRadius: "6px",
+              backgroundColor: "#000000",
+              color: "#ffffff",
+              border: "1px solid #ffffff",
+              cursor: "pointer",
+              fontWeight: 600,
+            }}
+          >
+            Call Server Action 2
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

app/dashboard/page.tsx

···
+import { redirect } from "next/navigation";
+import { createClient } from "@/lib/supabase/server";
+import { getSubscriptionStatus, syncSubscriptionFromCheckoutSession } from "@/actions/subscription";
+import DashboardClient from "./dashboard-client";
+
+export default async function DashboardPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ session_id?: string }>;
+}) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
+  if (!user) {
+    redirect("/login");
+  }
+
+  const params = await searchParams;
+  
+  // If we have a session_id, try to sync the subscription (fallback if webhook hasn't fired)
+  if (params.session_id) {
+    await syncSubscriptionFromCheckoutSession(params.session_id);
+  }
+
+  const { subscribed, subscription } = await getSubscriptionStatus();
+
+  return (
+    <main className="page-container">
+      <h1>Dashboard</h1>
+      <p>Welcome, {user.email}!</p>
+      
+      <DashboardClient 
+        subscribed={subscribed} 
+        subscription={subscription}
+        priceId={process.env.NEXT_PUBLIC_STRIPE_PRICE_ID || ""}
+      />
+    </main>
+  );
+}

app/layout.tsx

···
 import { SpeedInsights } from "@vercel/speed-insights/next";
 import { Analytics } from "@vercel/analytics/next";
 import { Space_Grotesk } from "next/font/google";
+import Link from "next/link";
+import { createClient } from "@/lib/supabase/server";
+import { signOut } from "@/actions/auth";
 
 import "./globals.css";
 
···
   },
 };
 
-export default function RootLayout({ children }: LayoutProps) {
+export default async function RootLayout({ children }: LayoutProps) {
+  const supabase = await createClient();
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+
   return (
     <html lang="en">
       <body className={fontSans.className}>
         <div className="container">
           <header>
             <div className="header-content">
-              <h1>eny.space</h1>
+              <Link href="/" style={{ textDecoration: "none", color: "inherit" }}>
+                <h1>eny.space</h1>
+              </Link>
+              <nav style={{ display: "flex", flexDirection: "column", gap: "12px", marginTop: "24px" }}>
+                {user ? (
+                  <>
+                    <Link href="/dashboard" style={{ color: "var(--h2-color)" }}>Dashboard</Link>
+                    <form action={signOut} style={{ margin: 0 }}>
+                      <button 
+                        type="submit" 
+                        style={{ 
+                          background: "none", 
+                          border: "none", 
+                          cursor: "pointer", 
+                          color: "var(--h2-color)",
+                          padding: 0,
+                          textAlign: "left",
+                          font: "inherit"
+                        }}
+                      >
+                        Sign Out
+                      </button>
+                    </form>
+                  </>
+                ) : (
+                  <>
+                    <Link href="/login" style={{ color: "var(--h2-color)" }}>Login</Link>
+                    <Link href="/signup" style={{ color: "var(--h2-color)" }}>Sign Up</Link>
+                  </>
+                )}
+              </nav>
             </div>
           </header>
           {children}

app/login/page.tsx

···
+import { signIn } from "@/actions/auth";
+import Link from "next/link";
+
+export default function LoginPage() {
+  return (
+    <main className="page-container" style={{ maxWidth: "400px", margin: "0 auto" }}>
+      <h1>Login</h1>
+      <form action={signIn} style={{ display: "flex", flexDirection: "column", gap: "16px" }}>
+        <div>
+          <label htmlFor="email" style={{ display: "block", marginBottom: "8px" }}>
+            Email
+          </label>
+          <input
+            type="email"
+            id="email"
+            name="email"
+            required
+            style={{
+              width: "100%",
+              padding: "8px",
+              borderRadius: "4px",
+              border: "1px solid #ccc",
+            }}
+          />
+        </div>
+        <div>
+          <label htmlFor="password" style={{ display: "block", marginBottom: "8px" }}>
+            Password
+          </label>
+          <input
+            type="password"
+            id="password"
+            name="password"
+            required
+            style={{
+              width: "100%",
+              padding: "8px",
+              borderRadius: "4px",
+              border: "1px solid #ccc",
+            }}
+          />
+        </div>
+        <button
+          type="submit"
+          style={{
+            padding: "12px 24px",
+            borderRadius: "6px",
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            border: "1px solid #ffffff",
+            cursor: "pointer",
+            fontWeight: 600,
+          }}
+        >
+          Login
+        </button>
+      </form>
+      <p style={{ marginTop: "16px", textAlign: "center" }}>
+        Don&apos;t have an account? <Link href="/signup">Sign up</Link>
+      </p>
+    </main>
+  );
+}

app/signup/page.tsx

···
+import { signUp } from "@/actions/auth";
+import Link from "next/link";
+
+export default function SignUpPage() {
+  return (
+    <main className="page-container" style={{ maxWidth: "400px", margin: "0 auto" }}>
+      <h1>Sign Up</h1>
+      <form action={signUp} style={{ display: "flex", flexDirection: "column", gap: "16px" }}>
+        <div>
+          <label htmlFor="email" style={{ display: "block", marginBottom: "8px" }}>
+            Email
+          </label>
+          <input
+            type="email"
+            id="email"
+            name="email"
+            required
+            style={{
+              width: "100%",
+              padding: "8px",
+              borderRadius: "4px",
+              border: "1px solid #ccc",
+            }}
+          />
+        </div>
+        <div>
+          <label htmlFor="password" style={{ display: "block", marginBottom: "8px" }}>
+            Password
+          </label>
+          <input
+            type="password"
+            id="password"
+            name="password"
+            required
+            minLength={6}
+            style={{
+              width: "100%",
+              padding: "8px",
+              borderRadius: "4px",
+              border: "1px solid #ccc",
+            }}
+          />
+        </div>
+        <button
+          type="submit"
+          style={{
+            padding: "12px 24px",
+            borderRadius: "6px",
+            backgroundColor: "#000000",
+            color: "#ffffff",
+            border: "1px solid #ffffff",
+            cursor: "pointer",
+            fontWeight: 600,
+          }}
+        >
+          Sign Up
+        </button>
+      </form>
+      <p style={{ marginTop: "16px", textAlign: "center" }}>
+        Already have an account? <Link href="/login">Login</Link>
+      </p>
+    </main>
+  );
+}

lib/supabase/admin.ts

···
+import { createClient } from "@supabase/supabase-js";
+
+// Admin client for server-side operations that bypass RLS
+// Use this ONLY in server-side code that needs to bypass RLS (like webhooks)
+export function createAdminClient() {
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+
+  if (!supabaseUrl || !supabaseServiceKey) {
+    throw new Error(
+      "Missing Supabase admin credentials. Please set NEXT_PUBLIC_SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY in your environment variables."
+    );
+  }
+
+  return createClient(supabaseUrl, supabaseServiceKey, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+    },
+  });
+}

lib/supabase/client.ts

···
+import { createBrowserClient } from "@supabase/ssr";
+
+export function createClient() {
+  return createBrowserClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
+  );
+}

lib/supabase/server.ts

···
+import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+
+export async function createClient() {
+  const cookieStore = await cookies();
+
+  return createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return cookieStore.getAll();
+        },
+        setAll(cookiesToSet) {
+          try {
+            cookiesToSet.forEach(({ name, value, options }) =>
+              cookieStore.set(name, value, options)
+            );
+          } catch {
+            // The `setAll` method was called from a Server Component.
+            // This can be ignored if you have middleware refreshing
+            // user sessions.
+          }
+        },
+      },
+    }
+  );
+}

package-lock.json

···
         "@radix-ui/react-slot": "^1.2.4",
         "@stripe/react-stripe-js": "2.4.0",
         "@stripe/stripe-js": "2.2.2",
+        "@supabase/ssr": "^0.8.0",
+        "@supabase/supabase-js": "^2.90.1",
         "@tailwindcss/postcss": "^4.1.18",
         "@vercel/analytics": "^1.6.1",
         "@vercel/speed-insights": "^1.3.1",
···
       "integrity": "sha512-LvFZRZEBoMe6vXC6RoOAIbXWo/0JDdndq43ekL9M6affcM7PtF5KALmwt91BazW7q49sbSl0l7TunWhhSwEW4w==",
       "license": "MIT"
     },
+    "node_modules/@supabase/auth-js": {
+      "version": "2.90.1",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.90.1.tgz",
+      "integrity": "sha512-vxb66dgo6h3yyPbR06735Ps+dK3hj0JwS8w9fdQPVZQmocSTlKUW5MfxSy99mN0XqCCuLMQ3jCEiIIUU23e9ng==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/functions-js": {
+      "version": "2.90.1",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.90.1.tgz",
+      "integrity": "sha512-x9mV9dF1Lam9qL3zlpP6mSM5C9iqMPtF5B/tU1Jj/F0ufX5mjDf9ghVBaErVxmrQJRL4+iMKWKY2GnODkpS8tw==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/postgrest-js": {
+      "version": "2.90.1",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.90.1.tgz",
+      "integrity": "sha512-jh6vqzaYzoFn3raaC0hcFt9h+Bt+uxNRBSdc7PfToQeRGk7PDPoweHsbdiPWREtDVTGKfu+PyPW9e2jbK+BCgQ==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/realtime-js": {
+      "version": "2.90.1",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.90.1.tgz",
+      "integrity": "sha512-PWbnEMkcQRuor8jhObp4+Snufkq8C6fBp+MchVp2qBPY1NXk/c3Iv3YyiFYVzo0Dzuw4nAlT4+ahuPggy4r32w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/phoenix": "^1.6.6",
+        "@types/ws": "^8.18.1",
+        "tslib": "2.8.1",
+        "ws": "^8.18.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/ssr": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/@supabase/ssr/-/ssr-0.8.0.tgz",
+      "integrity": "sha512-/PKk8kNFSs8QvvJ2vOww1mF5/c5W8y42duYtXvkOSe+yZKRgTTZywYG2l41pjhNomqESZCpZtXuWmYjFRMV+dw==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie": "^1.0.2"
+      },
+      "peerDependencies": {
+        "@supabase/supabase-js": "^2.76.1"
+      }
+    },
+    "node_modules/@supabase/storage-js": {
+      "version": "2.90.1",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.90.1.tgz",
+      "integrity": "sha512-GHY+Ps/K/RBfRj7kwx+iVf2HIdqOS43rM2iDOIDpapyUnGA9CCBFzFV/XvfzznGykd//z2dkGZhlZZprsVFqGg==",
+      "license": "MIT",
+      "dependencies": {
+        "iceberg-js": "^0.8.1",
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@supabase/supabase-js": {
+      "version": "2.90.1",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.90.1.tgz",
+      "integrity": "sha512-U8KaKGLUgTIFHtwEW1dgw1gK7XrdpvvYo7nzzqPx721GqPe8WZbAiLh/hmyKLGBYQ/mmQNr20vU9tWSDZpii3w==",
+      "license": "MIT",
+      "dependencies": {
+        "@supabase/auth-js": "2.90.1",
+        "@supabase/functions-js": "2.90.1",
+        "@supabase/postgrest-js": "2.90.1",
+        "@supabase/realtime-js": "2.90.1",
+        "@supabase/storage-js": "2.90.1"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
     "node_modules/@swc/helpers": {
       "version": "0.5.15",
       "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
···
       "integrity": "sha512-q0RkvNgMweWWIvSMDiXhflGUKMdIxBo2M2tYM/0kEGDueQByFzK4KZAgu5YHGFNxziTlppNpTIBcqHQAxlfHdA==",
       "license": "MIT"
     },
+    "node_modules/@types/phoenix": {
+      "version": "1.6.7",
+      "resolved": "https://registry.npmjs.org/@types/phoenix/-/phoenix-1.6.7.tgz",
+      "integrity": "sha512-oN9ive//QSBkf19rfDv45M7eZPi0eEXylht2OLEXicu5b4KoQ1OzXIw+xDSGWxSxe1JmepRR/ZH283vsu518/Q==",
+      "license": "MIT"
+    },
     "node_modules/@types/prop-types": {
       "version": "15.7.15",
       "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
···
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/@types/ws": {
+      "version": "8.18.1",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
+      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@vercel/analytics": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/@vercel/analytics/-/analytics-1.6.1.tgz",
···
         "node": ">=6"
       }
     },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/csstype": {
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
···
       },
       "engines": {
         "node": ">= 0.4"
+      }
+    },
+    "node_modules/iceberg-js": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",
+      "integrity": "sha512-1dhVQZXhcHje7798IVM+xoo/1ZdVfzOMIc8/rgVSijRK38EDqOJoGula9N/8ZI5RD8QTxNQtK/Gozpr+qUqRRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/jiti": {
···
       },
       "engines": {
         "node": ">=14.17"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.19.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
+      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
       }
     }
   }

package.json

···
     "@radix-ui/react-slot": "^1.2.4",
     "@stripe/react-stripe-js": "2.4.0",
     "@stripe/stripe-js": "2.2.2",
+    "@supabase/ssr": "^0.8.0",
+    "@supabase/supabase-js": "^2.90.1",
     "@tailwindcss/postcss": "^4.1.18",
     "@vercel/analytics": "^1.6.1",
     "@vercel/speed-insights": "^1.3.1",

supabase/.temp/cli-latest

···
+v2.67.1

supabase/.temp/gotrue-version

···
+v2.185.0

supabase/.temp/pooler-url

···
+postgresql://[e-mail]:5432/postgres

supabase/.temp/postgres-version

···
+17.6.1.063

supabase/.temp/project-ref

···
+espdzfmvhthcskxzrnyq

supabase/.temp/rest-version

···
+v14.1

supabase/.temp/storage-migration

···
+buckets-objects-grants-postgres

supabase/.temp/storage-version

···
+v1.33.0

supabase/migrations/001_subscriptions.sql

···
+-- Create subscriptions table to track user subscriptions
+CREATE TABLE IF NOT EXISTS subscriptions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  stripe_customer_id TEXT,
+  stripe_subscription_id TEXT UNIQUE,
+  stripe_price_id TEXT,
+  status TEXT NOT NULL,
+  current_period_start TIMESTAMPTZ,
+  current_period_end TIMESTAMPTZ,
+  cancel_at_period_end BOOLEAN DEFAULT false,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Create index for faster lookups
+CREATE INDEX IF NOT EXISTS subscriptions_user_id_idx ON subscriptions(user_id);
+CREATE INDEX IF NOT EXISTS subscriptions_stripe_customer_id_idx ON subscriptions(stripe_customer_id);
+CREATE INDEX IF NOT EXISTS subscriptions_stripe_subscription_id_idx ON subscriptions(stripe_subscription_id);
+
+-- Enable Row Level Security
+ALTER TABLE subscriptions ENABLE ROW LEVEL SECURITY;
+
+-- Policy: Users can only see their own subscriptions
+DROP POLICY IF EXISTS "Users can view own subscriptions" ON subscriptions;
+CREATE POLICY "Users can view own subscriptions"
+  ON subscriptions
+  FOR SELECT
+  USING (auth.uid() = user_id);
+
+-- Policy: Users can insert their own subscription records (for initial customer creation)
+-- But they can ONLY insert records with status='incomplete' to prevent fraud
+DROP POLICY IF EXISTS "Users can insert own subscriptions" ON subscriptions;
+CREATE POLICY "Users can insert own subscriptions"
+  ON subscriptions
+  FOR INSERT
+  WITH CHECK (
+    auth.uid() = user_id 
+    AND status = 'incomplete'
+  );
+
+-- Users CANNOT update their own subscriptions directly
+-- All updates must come from webhooks (using service role) or validated server actions
+-- This prevents users from setting status='active' without paying
+DROP POLICY IF EXISTS "Users can update own subscriptions" ON subscriptions;
+
+-- Note: Service role (used by webhooks via admin client) bypasses RLS entirely
+-- The admin client uses SUPABASE_SERVICE_ROLE_KEY which automatically bypasses all RLS policies.
+-- No policy needed for service role since it bypasses RLS.
+
+-- Function to update updated_at timestamp
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+-- Trigger to automatically update updated_at
+DROP TRIGGER IF EXISTS update_subscriptions_updated_at ON subscriptions;
+CREATE TRIGGER update_subscriptions_updated_at
+  BEFORE UPDATE ON subscriptions
+  FOR EACH ROW
+  EXECUTE FUNCTION update_updated_at_column();

supabase/migrations/002_add_user_insert_update_policies.sql

···
+-- Add policies to allow users to insert and update their own subscriptions
+-- This is needed for the checkout flow to work without requiring service role key
+-- NOTE: This migration is now obsolete - we removed UPDATE policy for security
+-- Keeping it for migration history, but it will be skipped if policies already exist
+
+-- Policy: Users can insert their own subscription records (for initial customer creation)
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies 
+    WHERE schemaname = 'public' 
+    AND tablename = 'subscriptions' 
+    AND policyname = 'Users can insert own subscriptions'
+  ) THEN
+    CREATE POLICY "Users can insert own subscriptions"
+      ON subscriptions
+      FOR INSERT
+      WITH CHECK (auth.uid() = user_id);
+  END IF;
+END $$;

supabase/migrations/003_remove_user_update_policy.sql

···
+-- Remove the UPDATE policy that allows users to update their own subscriptions
+-- This is a security fix: users should NOT be able to modify subscription status
+-- All updates must come from webhooks (service role) or validated server actions
+
+-- This migration is safe to run multiple times
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies 
+    WHERE schemaname = 'public' 
+    AND tablename = 'subscriptions' 
+    AND policyname = 'Users can update own subscriptions'
+  ) THEN
+    DROP POLICY "Users can update own subscriptions" ON subscriptions;
+  END IF;
+END $$;

supabase/migrations/004_add_subscription_validation.sql

···
+-- Additional security: Add a check constraint to ensure data integrity
+-- Note: RLS policies already prevent users from updating, but this adds an extra layer
+
+-- Ensure status is one of the valid Stripe subscription statuses
+ALTER TABLE subscriptions 
+  DROP CONSTRAINT IF EXISTS valid_subscription_status;
+
+ALTER TABLE subscriptions
+  ADD CONSTRAINT valid_subscription_status 
+  CHECK (status IN (
+    'incomplete', 
+    'incomplete_expired', 
+    'trialing', 
+    'active', 
+    'past_due', 
+    'canceled', 
+    'unpaid',
+    'paused'
+  ));