docs/SUPABASE_SETUP.md

# Supabase setup (Auth + plans + quotas)

PlainRewrite uses Supabase for **Google + email login**, **Postgres profiles/plans/usage**, and FastAPI **JWT + quota checks**. Stripe can be added later by flipping `profiles.plan_id`.

## 1. Create a free Supabase project

1. Go to [https://supabase.com](https://supabase.com) → New project  
2. Open **Project Settings → API** and copy:
   - Project URL → `SUPABASE_URL`
   - `anon` `public` key → `SUPABASE_ANON_KEY`
   - `service_role` key → `SUPABASE_SERVICE_ROLE_KEY` (server only — never put in the browser)
3. Optional: **JWT Secret** → `SUPABASE_JWT_SECRET`

## 2. Run the schema

In Supabase → **SQL Editor**, paste and run:

`supabase/schema.sql`

This creates `plans`, `profiles`, `usage_daily`, and a trigger that auto-creates a Free profile on signup.

Default plans (INR):

| Plan | Daily rewrites | Max words / rewrite | Daily word cap | Price |
|------|----------------|---------------------|----------------|-------|
| Free | 5 | 400 | 1,500 | ₹0 |
| Pro | 50 | 2,000 | 15,000 | ₹199 |
| Plus | 200 | 5,000 | 50,000 | ₹499 |

Edit limits anytime in **Table Editor → plans**.

## 3. Enable auth providers

**Authentication → Providers**

- **Email** — enable (optional: disable “Confirm email” while testing)
- **Google** — enable; add Client ID/Secret from Google Cloud Console  
  Authorized redirect URI (from Supabase Google provider screen), typically:  
  `https://YOUR_PROJECT.supabase.co/auth/v1/callback`

**Authentication → URL Configuration**

Add your app URLs to **Redirect URLs**, e.g.:

- `http://127.0.0.1:7860`
- `http://localhost:7860`
- your Hugging Face / production URL

## 4. Configure PlainRewrite

Copy `.env.example` → `.env` and fill keys:

```env
SUPABASE_URL=https://xxxx.supabase.co
SUPABASE_ANON_KEY=eyJ...
SUPABASE_SERVICE_ROLE_KEY=eyJ...
SUPABASE_JWT_SECRET=your-jwt-secret
```

On Hugging Face Spaces / Docker, set the same as **secrets / env vars**.

- If these are **empty**, the app stays in **open local mode** (no login).
- If all three URL + anon + service role are set, **login is required** to rewrite.

## 5. Promote an admin

After you sign up once:

```sql
update public.profiles
set role = 'admin'
where email = 'you@example.com';
```

Manage users/plans in the Supabase dashboard (no custom admin UI yet):

- `profiles` — change `plan_id` (`free` / `pro` / `plus`), set `status` to `disabled`
- `plans` — change limits / INR prices
- `usage_daily` — inspect quotas

## 6. How it works

```
Browser (Supabase Auth) → JWT
        ↓
FastAPI verifies JWT
        ↓
Load profile + plan + today's usage (service role)
        ↓
Enforce limits → rewrite → increment usage
```

API:

- `GET /v1/auth/config` — public anon config for the UI  
- `GET /v1/me` — account + remaining quota  
- `POST /v1/rewrite` — requires `Authorization: Bearer <access_token>` when auth is on  

## 7. Stripe later

1. Create Stripe products for Pro (₹199) / Plus (₹499)  
2. On `checkout.session.completed` webhook, set:

```sql
update public.profiles set plan_id = 'pro' where id = '<user_uuid>';
```

No schema change required beyond what you already have.