Skip to content
vibespell

.cursor/rules/project.mdc

Cursor rules for Next.js + Supabase

Cursor rules are a markdown file with a short frontmatter header. Cursor attaches them to the agent so it stops guessing how this repo builds, tests, and styles code. This copy is written for a Next.js + Supabase project. This repository is a Next.js app using Supabase. The browser uses the anon key only. Row Level Security is the authorization layer, and the service role stays on the server.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes Next.js App Router plus Supabase. It does not assume a particular component library. If the repo uses `@supabase/ssr`, keep that cookie pattern.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: project.mdc. Legacy path: .cursorrules

---
description: "Working rules for a Next.js + Supabase repository"
globs: "**/*"
alwaysApply: true
---

# Project rules

Follow these rules on every task in this Next.js + Supabase repository.
If the project still uses a root `.cursorrules` file, keep the same rules there.

## Stack

This repository is a Next.js app using Supabase. The browser uses the anon key only. Row Level Security is the authorization layer, and the service role stays on the server.

## Layout

- Server Components and route handlers create the server Supabase client.
- Client components talk to Supabase only for flows the project already does in the browser, such as the auth UI.
- SQL and policies live in the supabase folder if the repo tracks them.

## Commands

- Dev server: `npm run dev`
- Tests: `npm test`
- Types: `Generate Supabase types with the script the repo already has`

Use the script the repo already defines when it differs from the command above.

## Conventions

- Use the anon key in the browser. The service role key never ships to the client.
- Assume RLS is on. A query that only works with the service role is a bug unless the task is an admin job.
- Read the user from the server client. Do not trust a user id from the request body.
- Regenerate database types when columns change, using the project's script.
- Keep Server Components the default. Add a client component only for auth widgets or local state.
- Match the existing cookie and middleware session refresh.

## Testing

Add or update tests when behavior changes.

Test the server action or route with a mocked Supabase client. Cover the unauthorized case.

## Style

- Optimize for the next reader over the shortest diff.
- Comment only when the why is non-obvious.
- Name things the way neighboring files already do.
- Do not reformat code you did not change.

## Errors

- Fail at the boundary. Do not swallow errors.
- Return a clear error when RLS hides a row or the session is missing. Do not leak the service-role error to the browser.

## Scope

- Do the requested task. Do not refactor unrelated code.
- Match the rigor already in the repo. Fix what you touch.
- Ask one clarifying question only when the task cannot be finished without it. Otherwise state the assumption and continue.

## Avoid

- Do not disable RLS to make a query return rows.
- Do not call `supabase.auth.getSession()` in untrusted client code and treat it as proof on the server.
- Do not store the service role in NEXT_PUBLIC_.
- Do not invent a second auth library next to Supabase Auth.

## Done when

- The requested behavior works.
- The dev server renders the change, and a policy or type update is included when the table changed.
- The diff stays inside the task.
- You list anything you could not run.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor rules on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/project.mdc

    Save it at `.cursor/rules/project.mdc` in the Next.js + Supabase repo and create the folders if they are missing. If the project still uses one root rules file, save the body as `.cursorrules`.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Next.js + Supabase agent often gets wrong, such as a server query that uses the user-scoped client, not the service role. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor rules in a Next.js + Supabase repo?

Save it at `.cursor/rules/project.mdc` in the Next.js + Supabase repo and create the folders if they are missing. If the project still uses one root rules file, save the body as `.cursorrules`.

Which tools read this Cursor rules?

Cursor reads `.cursor/rules/*.mdc` and, on older setups, a root `.cursorrules` file. Other tools ignore the frontmatter, so use AGENTS.md when more than one agent edits the repo.

What does the Next.js + Supabase example assume?

The example assumes Next.js App Router plus Supabase. It does not assume a particular component library. If the repo uses `@supabase/ssr`, keep that cookie pattern.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Next.js + Supabase

Cursor rules for other stacks