Production Safety

1. 1

   Define durable database invariants

   Create tables, constraints, grants, RLS policies, RPC functions, and service-role access in migrations instead of relying on runtime assumptions.

   Relevant Product code

   • supabase/migrations/20260426000000_init.sql
2. 2

   Preserve request context

   Browser requests receive request context through the proxy, while excluded webhook and scheduled routes establish and return their own request ids.

   Relevant Product code

   • src/proxy.ts
   • src/lib/observe/request/request-id.ts
   • src/app/api/notifications/webhooks/resend/route.ts
3. 3

   Claim before processing external events

   Webhook handlers verify signatures, store event rows, reject duplicate processed events, and reclaim only stale processing leases.

   Relevant Product code

   • src/lib/security/webhooks/request.ts
   • src/lib/security/webhooks/processing.ts
4. 4

   Reserve a single-purchase checkout

   Attempt-scoped checkout claims reserve a profile and plan before opening a provider session, then prevent stale or duplicate attempts from overwriting newer checkout state.

   Relevant Product code

   • src/features/billing/server/checkout/persistence/claims.ts
   • supabase/migrations/20260426000000_init.sql
5. 5

   Protect scheduled work

   Cron services validate CRON_SECRET, reject placeholder values, compare authorization without leaking timing, and rate-limit scheduler calls.

   Relevant Product code

   • src/lib/security/secrets/cron-secret.ts
   • src/features/notifications/server/outbox/services/cron.ts
6. 6

   Retry through outbox state

   Workers claim a bounded batch, record success or failure, back off transient errors, and dead-letter rows after repeated failures.

   Relevant Product code

   • src/features/notifications/server/outbox/services/worker.ts

Use this example as a starting point, then adapt it to your product's rules and configuration.

A configured but obvious placeholder secret is treated the same as a missing secret.

export function readValidatedCronSecret(value: string | undefined = process.env.CRON_SECRET): string | null {
  const secret = value?.trim();
  if (!secret) {
    return null;
  }

  if (PLACEHOLDER_CRON_SECRETS.has(secret.toLowerCase())) {
    return null;
  }

  return secret;
}

Use this example as a starting point, then adapt it to your product's rules and configuration.

A processing row can be retried only after the lease timeout, which protects against duplicate live workers and crashed workers.

const WEBHOOK_PROCESSING_STALE_AFTER_MS = 15 * 60 * 1000;

export function isWebhookProcessingStale(
  processingStartedAt: string | null | undefined,
  nowMs: number = Date.now(),
  staleAfterMs: number = WEBHOOK_PROCESSING_STALE_AFTER_MS,
): boolean {
  if (!processingStartedAt) {
    return true;
  }

  const startedAtMs = Date.parse(processingStartedAt);
  if (!Number.isFinite(startedAtMs)) {
    return true;
  }

  return nowMs - startedAtMs >= staleAfterMs;
}