Fix Supabase mutations + require service role for admin edits

src/app/page.tsx

@@ -77,7 +77,7 @@ const SOURCE_MODELS = [
     "deepseek/deepseek-r1",
     "Qwen/Qwen2.5-72B-Instruct",
     "meta-llama/Llama-3.1-8B-Instruct",
-    "Other",
+    "Other (Huggingface Models)",
 ];
 
 const REASONING_DEPTHS = ["low", "medium", "high"];
@@ -248,7 +248,8 @@ export default function Home() {
 
     async function handleDatasetSubmit(e: React.FormEvent) {
         e.preventDefault();
-        const resolvedSourceModel = sourceModel === "Other" ? sourceModelOther.trim() : sourceModel;
+        const resolvedSourceModel =
+            sourceModel === "Other (Huggingface Models)" ? sourceModelOther.trim() : sourceModel;
         if (!resolvedSourceModel) {
             toast({ title: "Error", description: "Please select a source model", variant: "destructive" });
             return;
@@ -584,7 +585,7 @@ export default function Home() {
                                                         value={sourceModel}
                                                         onValueChange={(v) => {
                                                             setSourceModel(v);
-                                                            if (v !== "Other") {
+                                                            if (v !== "Other (Huggingface Models)") {
                                                                 setSourceModelOther("");
                                                                 setHfModelQuery("");
                                                                 setHuggingfaceModels([]);

src/lib/store.ts

@@ -129,20 +129,20 @@ export async function getDatasetRequests(): Promise<DatasetRequest[]> {
 
 export async function getRequest(type: RequestType, id: string): Promise<DistillationRequest | DatasetRequest | null> {
     const table = type === "distillation" ? "distillation_requests" : "dataset_requests";
-    const { data, error } = await supabaseRest<any>(`/rest/v1/${table}`, {
+    const { data, error } = await supabaseRest<any[]>(`/rest/v1/${table}`, {
         query: {
             select: "*",
             id: `eq.${id}`,
         },
-        acceptObject: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    if (!data) return null;
-    return type === "distillation" ? mapDistillationRow(data) : mapDatasetRow(data);
+    const row = Array.isArray(data) ? data[0] : null;
+    if (!row) return null;
+    return type === "distillation" ? mapDistillationRow(row) : mapDatasetRow(row);
 }
 
 export async function updateDistillationRequest(
@@ -154,19 +154,20 @@ export async function updateDistillationRequest(
     if (typeof updates.studentModel === "string") body.student_model = updates.studentModel;
     if (typeof updates.additionalNotes === "string") body.additional_notes = updates.additionalNotes;
 
-    const { data, error } = await supabaseRest<any>("/rest/v1/distillation_requests", {
+    const { data, error } = await supabaseRest<any[]>("/rest/v1/distillation_requests", {
         method: "PATCH",
         body: JSON.stringify(body),
         query: { select: "*", id: `eq.${id}` },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    return data ? mapDistillationRow(data) : null;
+    const row = Array.isArray(data) ? data[0] : null;
+    return row ? mapDistillationRow(row) : null;
 }
 
 export async function updateDatasetRequest(
@@ -180,19 +181,20 @@ export async function updateDatasetRequest(
     if (Array.isArray(updates.topics)) body.topics = updates.topics.map(String);
     if (typeof updates.additionalNotes === "string") body.additional_notes = updates.additionalNotes;
 
-    const { data, error } = await supabaseRest<any>("/rest/v1/dataset_requests", {
+    const { data, error } = await supabaseRest<any[]>("/rest/v1/dataset_requests", {
         method: "PATCH",
         body: JSON.stringify(body),
         query: { select: "*", id: `eq.${id}` },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    return data ? mapDatasetRow(data) : null;
+    const row = Array.isArray(data) ? data[0] : null;
+    return row ? mapDatasetRow(row) : null;
 }
 
 export async function updateRequestStatus(
@@ -201,19 +203,19 @@ export async function updateRequestStatus(
     status: "pending" | "in_progress" | "completed"
 ): Promise<boolean> {
     const table = type === "distillation" ? "distillation_requests" : "dataset_requests";
-    const { data, error } = await supabaseRest<any>(`/rest/v1/${table}`, {
+    const { data, error } = await supabaseRest<any[]>(`/rest/v1/${table}`, {
         method: "PATCH",
         body: JSON.stringify({ status }),
         query: { select: "id", id: `eq.${id}` },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    return Boolean(data?.id);
+    return Array.isArray(data) ? Boolean(data[0]?.id) : false;
 }
 
 export async function deleteRequest(type: RequestType, id: string): Promise<boolean> {
@@ -223,22 +225,23 @@ export async function deleteRequest(type: RequestType, id: string): Promise<bool
             request_type: `eq.${type}`,
             request_id: `eq.${id}`,
         },
+        requireServiceRole: true,
     });
 
     const table = type === "distillation" ? "distillation_requests" : "dataset_requests";
-    const { data, error } = await supabaseRest<any>(`/rest/v1/${table}`, {
+    const { data, error } = await supabaseRest<any[]>(`/rest/v1/${table}`, {
         method: "DELETE",
         body: null,
         query: { select: "id", id: `eq.${id}` },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    return Boolean(data?.id);
+    return Array.isArray(data) ? Boolean(data[0]?.id) : false;
 }
 
 export async function getThread(type: RequestType, id: string): Promise<DiscussionThread> {
@@ -265,7 +268,7 @@ export async function getThread(type: RequestType, id: string): Promise<Discussi
 }
 
 export async function addAdminComment(type: RequestType, id: string, body: string, ownerId: string): Promise<DiscussionComment> {
-    const { data, error } = await supabaseRest<any>("/rest/v1/request_comments", {
+    const { data, error } = await supabaseRest<any[]>("/rest/v1/request_comments", {
         method: "POST",
         body: JSON.stringify({
             request_type: type,
@@ -277,18 +280,19 @@ export async function addAdminComment(type: RequestType, id: string, body: strin
         }),
         query: { select: "*" },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    if (!data) {
+    const row = Array.isArray(data) ? data[0] : null;
+    if (!row) {
         throw new Error("Failed to create comment");
     }
 
-    return mapCommentRow(data);
+    return mapCommentRow(row);
 }
 
 export async function addUserComment(
@@ -330,7 +334,7 @@ export async function updateComment(
     commentId: string,
     body: string
 ): Promise<DiscussionComment | null> {
-    const { data, error } = await supabaseRest<any>("/rest/v1/request_comments", {
+    const { data, error } = await supabaseRest<any[]>("/rest/v1/request_comments", {
         method: "PATCH",
         body: JSON.stringify({ body, edited_at: new Date().toISOString() }),
         query: {
@@ -340,14 +344,15 @@ export async function updateComment(
             request_id: `eq.${requestId}`,
         },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    return data ? mapCommentRow(data) : null;
+    const row = Array.isArray(data) ? data[0] : null;
+    return row ? mapCommentRow(row) : null;
 }
 
 export async function deleteComment(
@@ -355,7 +360,7 @@ export async function deleteComment(
     requestId: string,
     commentId: string
 ): Promise<boolean> {
-    const { data, error } = await supabaseRest<any>("/rest/v1/request_comments", {
+    const { data, error } = await supabaseRest<any[]>("/rest/v1/request_comments", {
         method: "DELETE",
         body: null,
         query: {
@@ -365,14 +370,14 @@ export async function deleteComment(
             request_id: `eq.${requestId}`,
         },
         preferReturn: "representation",
-        acceptObject: true,
+        requireServiceRole: true,
     });
 
     if (error) {
         throw new Error(error.message);
     }
 
-    return Boolean(data?.id);
+    return Array.isArray(data) ? Boolean(data[0]?.id) : false;
 }
 
 export async function addDistillationRequest(

src/lib/supabaseRest.ts

@@ -30,10 +30,14 @@ export async function supabaseRest<T>(
         preferReturn?: "representation" | "minimal";
         acceptObject?: boolean;
         count?: "exact" | "planned" | "estimated";
+        requireServiceRole?: boolean;
     } = {}
 ): Promise<{ data: T | null; error: SupabaseRestError | null; status: number; count: number | null }> {
     const { url, anonKey, serviceRoleKey } = getSupabaseEnv();
-    const apiKey = serviceRoleKey || anonKey;
+    if (init.requireServiceRole && !serviceRoleKey) {
+        throw new Error("Supabase env var missing: SUPABASE_SERVICE_ROLE_KEY (required for this operation)");
+    }
+    const apiKey = init.requireServiceRole ? (serviceRoleKey as string) : anonKey;
 
     const endpoint = new URL(path.startsWith("/") ? path : `/${path}`, url);
     if (init.query) {

supabase/schema.sql

@@ -68,12 +68,12 @@ begin
     end if;
 
     if voter_ip = any(current_ips) then
-        update public.distillation_requests
+        update public.distillation_requests as r
         set
-            voted_ips = array_remove(voted_ips, voter_ip),
-            upvotes = greatest(upvotes - 1, 0)
-        where id = request_id
-        returning public.distillation_requests.upvotes into upvotes;
+            voted_ips = array_remove(r.voted_ips, voter_ip),
+            upvotes = greatest(r.upvotes - 1, 0)
+        where r.id = request_id
+        returning r.upvotes into upvotes;
 
         success := true;
         action := 'unvoted';
@@ -81,12 +81,12 @@ begin
         return;
     end if;
 
-    update public.distillation_requests
+    update public.distillation_requests as r
     set
-        voted_ips = array_append(voted_ips, voter_ip),
-        upvotes = upvotes + 1
-    where id = request_id
-    returning public.distillation_requests.upvotes into upvotes;
+        voted_ips = array_append(r.voted_ips, voter_ip),
+        upvotes = r.upvotes + 1
+    where r.id = request_id
+    returning r.upvotes into upvotes;
 
     success := true;
     action := 'upvoted';
@@ -118,12 +118,12 @@ begin
     end if;
 
     if voter_ip = any(current_ips) then
-        update public.dataset_requests
+        update public.dataset_requests as r
         set
-            voted_ips = array_remove(voted_ips, voter_ip),
-            upvotes = greatest(upvotes - 1, 0)
-        where id = request_id
-        returning public.dataset_requests.upvotes into upvotes;
+            voted_ips = array_remove(r.voted_ips, voter_ip),
+            upvotes = greatest(r.upvotes - 1, 0)
+        where r.id = request_id
+        returning r.upvotes into upvotes;
 
         success := true;
         action := 'unvoted';
@@ -131,12 +131,12 @@ begin
         return;
     end if;
 
-    update public.dataset_requests
+    update public.dataset_requests as r
     set
-        voted_ips = array_append(voted_ips, voter_ip),
-        upvotes = upvotes + 1
-    where id = request_id
-    returning public.dataset_requests.upvotes into upvotes;
+        voted_ips = array_append(r.voted_ips, voter_ip),
+        upvotes = r.upvotes + 1
+    where r.id = request_id
+    returning r.upvotes into upvotes;
 
     success := true;
     action := 'upvoted';