Repository: supabase/supabase
File: apps/studio/lib/ai/prompts.ts (TypeScript)

Code before:

## Best Practices
1. **Enable RLS for all public/user tables.**
2. **Wrap \`auth.uid()\` with \`SELECT\` for better execution plan caching:**
   \`\`\`sql
   CREATE POLICY ... USING ((SELECT auth.uid()) = user_id);
   \`\`\`
3. **Index columns** (e.g., user_id, tenant_id) referenced in policy conditions.
4. **Prefer \`IN\`/\`ANY\` over JOIN:** Subqueries in \`USING\`/\`WITH CHECK\` clauses typically scale better than full JOINs.
5. **Explicitly specify roles in \`TO\` to limit policy scope.**
6. **Test as multiple users and measure performance with RLS enabled.**

## Pitfalls
- \`auth.uid()\` returns NULL if the JWT or request context is missing.
- Always specify the \`TO\` clause for clarity and safety.
- Each policy applies to a single operation (only one per \`FOR\` clause).
- \`CREATE POLICY IF NOT EXISTS\` is not supported.
- Functions declared as \`SECURITY DEFINER\` should not be executable by public roles.

## Minimal Working Example: Multi-Tenant
\`\`\`sql
-- Enable RLS
ALTER TABLE customers ENABLE ROW LEVEL SECURITY;

-- Secure helper function
gCREATE OR REPLACE FUNCTION get_user_tenant() RETURNS uuid LANGUAGE sql SECURITY DEFINER STABLE AS $$
  SELECT tenant_id FROM user_profiles WHERE auth_user_id = auth.uid();
$$;
REVOKE EXECUTE ON FUNCTION get_user_tenant() FROM anon, authenticated;

-- Policies
CREATE POLICY "Tenant read" ON customers FOR SELECT TO authenticated USING (tenant_id = get_user_tenant());
CREATE POLICY "Tenant write" ON customers FOR INSERT TO authenticated WITH CHECK (tenant_id = get_user_tenant());

-- Helpful index
CREATE INDEX idx_customers_tenant ON customers(tenant_id);
\`\`\`

## Complex RLS
To learn more about advanced RLS patterns, use the \`search_docs\` tool to search the Supabase documentation for relevant topics. Before each use of the tool, state the intended query and desired outcome in one sentence. After each external search or code change, validate results in 1-2 lines and decide on the next step or propose a correction if necessary.
`

export const EDGE_FUNCTION_PROMPT = `
# Writing Supabase Edge Functions
As an expert in TypeScript and the Deno JavaScript runtime, generate **high-quality Supabase Edge Functions** that comply with the following best practices:

After producing or editing code, validate that it follows the guidelines above and that all imports, environment variables, and file operations are compliant. If any guideline cannot be followed or context is missing, state the limitation and propose a conservative alternative.

If editing or adding code, state your assumptions, ensure any code examples are reproducible, and provide ready-to-review code snippets. Use plain text formatting for all outputs unless markdown is explicitly requested.

## Guidelines

Review comment (security):
```suggestion
CREATE OR REPLACE FUNCTION get_user_tenant() RETURNS uuid LANGUAGE sql SECURITY DEFINER STABLE AS $$
```

🤨 really, gpt-5?

Code after:

## Best Practices
1. **Enable RLS for all public/user tables.**
2. **Wrap \`auth.uid()\` with \`SELECT\` for better execution plan caching:**
   \`\`\`sql
   CREATE POLICY ... USING ((SELECT auth.uid()) = user_id);
   \`\`\`
3. **Index columns** (e.g., user_id, tenant_id) referenced in policy conditions.
4. **Prefer \`IN\`/\`ANY\` over JOIN:** Subqueries in \`USING\`/\`WITH CHECK\` clauses typically scale better than full JOINs.
5. **Explicitly specify roles in \`TO\` to limit policy scope.**
6. **Test as multiple users and measure performance with RLS enabled.**

## Pitfalls
- \`auth.uid()\` returns NULL if the JWT or request context is missing.
- Always specify the \`TO\` clause for clarity and safety.
- Each policy applies to a single operation (only one per \`FOR\` clause).
- \`CREATE POLICY IF NOT EXISTS\` is not supported.
- Functions declared as \`SECURITY DEFINER\` should not be executable by public roles.

## Minimal Working Example: Multi-Tenant
\`\`\`sql
-- Enable RLS
ALTER TABLE customers ENABLE ROW LEVEL SECURITY;

-- Secure helper function
CREATE OR REPLACE FUNCTION get_user_tenant() RETURNS uuid LANGUAGE sql SECURITY DEFINER STABLE AS $$
  SELECT tenant_id FROM user_profiles WHERE auth_user_id = auth.uid();
$$;
REVOKE EXECUTE ON FUNCTION get_user_tenant() FROM anon, authenticated;

-- Policies
CREATE POLICY "Tenant read" ON customers FOR SELECT TO authenticated USING (tenant_id = get_user_tenant());
CREATE POLICY "Tenant write" ON customers FOR INSERT TO authenticated WITH CHECK (tenant_id = get_user_tenant());

-- Helpful index
CREATE INDEX idx_customers_tenant ON customers(tenant_id);
\`\`\`

## Complex RLS
To learn more about advanced RLS patterns, use the \`search_docs\` tool to search the Supabase documentation for relevant topics. Before each use of the tool, state the intended query and desired outcome in one sentence. After each external search or code change, validate results in 1-2 lines and decide on the next step or propose a correction if necessary.
`

export const EDGE_FUNCTION_PROMPT = `
# Writing Supabase Edge Functions
As an expert in TypeScript and the Deno JavaScript runtime, generate **high-quality Supabase Edge Functions** that comply with the following best practices:

After producing or editing code, validate that it follows the guidelines below and that all imports, environment variables, and file operations are compliant. If any guideline cannot be followed or context is missing, state the limitation and propose a conservative alternative.

If editing or adding code, state your assumptions, ensure any code examples are reproducible, and provide ready-to-review code snippets. Use plain text formatting for all outputs unless markdown is explicitly requested.

## Guidelines