skills.rest
chriso789
chriso789COMMUNITY
Explore all skills by this author →
GitHub

pitch-crm-architecture-guard

Enforces grouped Supabase edge function architecture and tenant security rules for Pitch CRM backend work.

Updated Sep 24, 2025
Search Tags:#architecture#security#multi-tenant#supabase#crm#edge functions#webhooks
One-click install
npx skills add https://github.com/chriso789/pitch-1 --skill pitch-crm-architecture-guard-chriso789
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pitch-crm-architecture-guard
Source: https://github.com/chriso789/pitch-1/tree/main/.agents/skills/pitch-crm-architecture-guard
Command: npx skills add https://github.com/chriso789/pitch-1 --skill pitch-crm-architecture-guard-chriso789

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It prevents Supabase edge function sprawl, tenant data leaks, and unsafe backend patterns by forcing all new backend logic into grouped routed functions instead of one-off standalone functions. ## Core Features & Use Cases - Edge Function Grouping Enforcement: Routes all new backend logic into existing *-api, *-worker, or *-webhook grouped functions and rejects new standalone function folders. - Security & Tenancy Guardrails: Blocks trusting client-supplied company_id or roles, requires server-side tenant resolution, worker secrets, webhook signature verification, and audit logging. - Use Case: When asked to add a new feature like a notification sender, the Skill rejects creating a new edge function and instead adds a route inside the appropriate grouped function, with the frontend calling it via edgeApi("domain-api", "/route", payload). ## Quick Start Ask the AI to add a new backend feature or edge function to the Pitch CRM project and it will route the work through the correct grouped function.

Frequently Asked Questions about pitch-crm-architecture-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new backend feature without creating a new Supabase edge function?▼

Add a route inside the appropriate grouped function using its router, such as app.post("/your-route", handler). The frontend then calls it with edgeApi("domain-api", "/your-route", payload) instead of invoking a standalone function.

How should Supabase edge functions be organized in a multi-tenant CRM?▼

Group functions by concern: *-api for authenticated app actions, *-worker for background jobs and cron, and *-webhook for provider callbacks. Legacy standalone functions should be migrated into these groups using a shim forwarder.

Can I trust company_id or tenant_id sent from the frontend?▼

No. Client-supplied company_id, tenant_id, brand_id, or roles must never be trusted. Resolve tenancy server-side from the authenticated user using shared auth and tenant helpers that verify membership.

When is it acceptable to delete a Supabase webhook function?▼

Only after an audit confirms zero dependencies from frontend, backend, cron, or providers, and the provider dashboard webhook URL has been confirmed updated. Deleting a live public webhook endpoint breaks provider integrations.

How do worker routes authenticate internal requests in Supabase?▼

Worker routes must require either the service role key or an INTERNAL_WORKER_SECRET. Secrets are accessed through Deno.env.get via a shared env helper, never hardcoded in source.

Related Skills

Explore More Software Engineering Skills→
yaresimeonthomasyaresimeonthomas

backend-dev

Configure Supabase migrations, RLS policies, and edge functions for Atomic CRM.

Community
Intermediate
Jason-hub-starJason-hub-star

toss-supabase-mcp

Automate Supabase MCP migrations, edge deployments, and log validation.

Community
Intermediate
trycompaitrycompai
1.9k

security-review

Review code changes for high-risk security vulnerabilities and fix confirmed findings.

Official
Advanced
oakossoakoss
14

hono

Develop web APIs and backend services with the Hono framework across multiple JavaScript runtimes.

Official
Intermediate