[Supabase](http://supabase.com?utm_source=egghead&utm_campaign=remix) is a collection of open-source tools that wrap around a PostgreSQL database. In this course, we look at building a realtime chat application with Remix, using Supabase for db hosting, authentication, authorization and subscribe to realtime db events - updating the UI as the database changes.

We will learn about:

- loaders and actions in Remix
- querying and mutating data with Supabase
- authentication with GitHub
- authorization with RLS
- merging client and server state with realtime events
- deploying a Remix app to Vercel

This course is 100% TypeScript, however, don't stress if you don't have any experience with TS, as Supabase does most of the heavy lifting here! 🎉

[Supabase](http://supabase.com?utm_source=egghead&utm_campaign=remix) handles hosting a database, authentication, authorization, file storage, realtime, edge functions, database functions, triggers and webhooks - lots of ways to build apps and automate backend stuff.

In this lesson, we head over to [database.new](https://database.new) to create a new Supabase project. Additionally, we use the dashboard to easily create a new table for our `messages`. We talk through some different data types and constraints that can be applied to columns. Lastly, we populate our new table with some example messages.

## Code Snippets

> SQL code snippets can be run against your Supabase database by heading over to your project's [SQL Editor](https://app.supabase.com/project/_/sql), pasting them into a new query, and clicking `RUN`.

**Create a messages table**

```sql
create table if not exists messages (
  id uuid default uuid_generate_v4() primary key,
  created_at timestamp with time zone default timezone('utc'::text, now()) not null,
  content text not null
);
```

**Insert messages**

```sql
insert into messages(content)
values
  ('first message'),
  ('second message');
```

## Resources

- [Supabase Docs](https://supabase.com/docs)

Create a Supabase Project with a Table and Example Data

[Remix](https://remix.run) is a web application framework built on top of React, that gives you sprinkles of server when you need it - fetching data on page load, mutating values in a db etc. In this lesson, we use the `create-remix` package to setup our new app. Additionally, we run the project is development mode with `npm run dev` and update the content on our `index` route.

## Code Snippets

**Create a Remix app**

```bash
npx create-remix <name-of-project>
```

## Resources

- [Remix docs](https://remix.run/docs/en/v1)

Setting Up a Remix Project

The [supabase-js](https://supabase.com/docs/reference/javascript) package allows us to connect to our Supabase project, and easily query and mutate data. In this lesson, we install `supabase-js`, set up environment variables for `SUPABASE_URL` and `SUPABASE_ANON_KEY`, and create a Supabase client to use across our application.

Additionally, we look at writing an RLS policy to enable `read` access to our `messages` table, use our Supabase client to select all messages, and display them in our Remix app on load.

## Code Snippets

**Install supabase-js**

```bash
npm i @supabase/supabase-js
```

**Use a Loader function to fetch data**

```tsx
export const loader = async () => {
  return null;
};
```

**Fetch data with Supabase Client**

```tsx
const { data } = await supabase.from("messages").select();
```

**Full component**

```tsx
import { useLoaderData } from "@remix-run/react";
import supabase from "utils/supabase";

export const loader = async ({}) => {
  const { data } = await supabase.from("messages").select();
  return { data };
};

export default function Index() {
  const { data } = useLoaderData();
  return <pre>{JSON.stringify(data, null, 2)}</pre>;
}
```

**Enable read access with RLS policy**

```sql
create policy "users can read messages" ON "public"."messages"
as permissive for select
to public
using (true);
```

> SQL code snippets can be run against your Supabase database by heading over to your project's [SQL Editor](https://app.supabase.com/project/_/sql), pasting them into a new query, and clicking `RUN`.

## Resources

- [Supabase-js docs](https://supabase.com/docs/reference/javascript)
- [Implement Row Level Security in Supabase (video)](https://www.youtube.com/watch?v=Ow_Uzedfohk)
- [Auto-generated project docs](https://app.supabase.com/project/_/api)

Query Supabase Data with Remix Loaders

TypeScript helps us build more robust, maintainable and safe applications. In this lesson, we look at installing the [Supabase CLI](https://supabase.com/docs/reference/cli), and using it to generate type definitions for Supabase.

We can use this to add TypeScript support to our Supabase client, which flows through our entire application - server and client. This means we get in-editor feedback about what we can and can't do with Supabase, helping to discover cool new things, while reducing bugs.

Additionally, we use the `LoaderArgs` type signature for our Loader function, which allows us to infer the return type in our component.

> Note: this does not automatically update with changes to Supabase. You need to manually run this command whenever you change the structure of the database.

## Code Snippets

**Generate TypeScript definitions from Supabase**

```bash
supabase gen types typescript --project-id your-project-id > db_types.ts
```

**Create typesafe Supabase client**

```tsx
import { createClient } from "@supabase/supabase-js";

import type { Database } from "db_types";

export default createClient<Database>(
  process.env.SUPABASE_URL!,
  process.env.SUPABASE_ANON_KEY!
);
```

**Fetch data with end-to-end type defs**

```tsx
import { useLoaderData } from "@remix-run/react";
import supabase from "utils/supabase";

import type { LoaderArgs } from "@remix-run/node";

export const loader = async ({}: LoaderArgs) => {
  const { data } = await supabase.from("messages").select();
  return { messages: data ?? [] };
};

export default function Index() {
  const { messages } = useLoaderData<typeof loader>();
  return <pre>{JSON.stringify(messages, null, 2)}</pre>;
}
```

## Resources

- [Supabase CLI](https://supabase.com/docs/reference/cli)
- [Supabase TypeScript Support](https://supabase.com/docs/reference/javascript/typescript-support)
- [Remix decision to infer types](https://github.com/remix-run/remix/blob/main/decisions/0003-infer-types-for-useloaderdata-and-useactiondata-from-loader-and-action-via-generics.md)

Generate TypeScript Type Definitions with the Supabase CLI

Supabase supports [a collection of auth strategies](https://supabase.com/docs/guides/auth) - Email and password, passwordless and OAuth. In this lesson, we look at implementing OAuth with GitHub.

In order to do this, we [create a new GitHub OAuth app](https://github.com/settings/applications/new), and configure Supabase to use its Client ID and Secret. Additionally, we create a `<Login />` component that uses the Supabase client to sign users in and out.

This identifies a problem that we don't have access to the environment variables required to create a Supabase client outside of loaders or actions. Therefore, we pipe through our `SUPABASE_URL` and `SUPABASE_ANON_KEY` from the Loader function, and create a singleton Supabase client, to use across our components.

Lastly, we look at sharing this single instance of Supabase through the Outlet Context and declare types to ensure we have TypeScript helping us out throughout the application.

## Code Snippets

**Expose environment variables from the server**

```tsx
export const loader = async ({}: LoaderArgs) => {
  const env = {
    SUPABASE_URL: process.env.SUPABASE_URL!,
    SUPABASE_ANON_KEY: process.env.SUPABASE_ANON_KEY!,
  };

  return json({ env });
};
```

**Access `env` in component**

```tsx
const { env } = useLoaderData<typeof loader>();
```

**Create a singleton Supabase client**

```tsx
const [supabase] = useState(() =>
  createClient<Database>(env.SUPABASE_URL, env.SUPABASE_ANON_KEY)
);
```

**Share global variables with Outlet Context**

```tsx
<Outlet context={{ supabase }} />
```

**Consuming Outlet Context**

```tsx
const { supabase } = useOutletContext<SupabaseOutletContext>();
```

**Logging in with GitHub**

```tsx
await supabase.auth.signInWithOAuth({
  provider: "github",
});
```

**Logging out**

```tsx
await supabase.auth.signOut();
```

**Entire root component**

```tsx
import { json, LoaderArgs, MetaFunction } from "@remix-run/node";
import {
  Links,
  LiveReload,
  Meta,
  Outlet,
  Scripts,
  ScrollRestoration,
  useLoaderData,
} from "@remix-run/react";
import { createClient, SupabaseClient } from "@supabase/supabase-js";
import { useState } from "react";

import type { Database } from "db_types";

type TypedSupabaseClient = SupabaseClient<Database>;

export type SupabaseOutletContext = {
  supabase: TypedSupabaseClient;
};

export const meta: MetaFunction = () => ({
  charset: "utf-8",
  title: "New Remix App",
  viewport: "width=device-width,initial-scale=1",
});

export const loader = async ({}: LoaderArgs) => {
  const env = {
    SUPABASE_URL: process.env.SUPABASE_URL!,
    SUPABASE_ANON_KEY: process.env.SUPABASE_ANON_KEY!,
  };

  return json({ env });
};

export default function App() {
  const { env } = useLoaderData<typeof loader>();

  const [supabase] = useState(() =>
    createClient<Database>(env.SUPABASE_URL, env.SUPABASE_ANON_KEY)
  );
  return (
    <html lang="en">
      <head>
        <Meta />
        <Links />
      </head>
      <body>
        <Outlet context={{ supabase }} />
        <ScrollRestoration />
        <Scripts />
        <LiveReload />
      </body>
    </html>
  );
}
```

## Resources

- [Supabase docs - login with GitHub](https://supabase.com/docs/guides/auth/auth-github)
- [Remix docs - Outlet Context](https://remix.run/docs/en/v1/api/remix#useoutletcontext)

Implement Authentication for Supabase with OAuth and Github

Row Level Security denies all access to the database. Select, insert, update and delete queries will be blocked by default. This allows us to write access policies in the database itself, to allow only what our application needs to function.

In this lesson, we look at adding a `user_id` column to the `messages` table, which has a foreign key relationship to the `auth.users` table - what Supabase uses to manage authentication and sessions.

Additionally, we step through a common migration pattern to use when existing data conflicts with the constraints of a new change in structure - we want each message to belong to a user, but the existing data had no column for `user_id`. This requires a three-step process where we add the column without the `not null` constraint, update the existing data to belong to a user, and then add the `not null` constraint to the `user_id` column.

Lastly, we update our RLS policy to only allow read access to signed in users.

## Code Snippets

> SQL code snippets can be run against your Supabase database by heading over to your project's [SQL Editor](https://app.supabase.com/project/_/sql), pasting them into a new query, and clicking `RUN`.

**Add column with not null constraint**

```sql
alter table public.messages
add user_id uuid references auth.users not null;
```

**Add column without not null constraint**

```sql
alter table public.messages
add user_id uuid references auth.users;
```

**Add not null constraint to column**

```sql
alter table public.messages
alter column user_id set not null;
```

**Alter RLS policy to require authenticated user**

```sql
begin;
  alter policy "users can read messages" on "public"."messages" rename to "authenticated users can read messages";
  alter policy "authenticated users can read messages" on "public"."messages" to authenticated;
commit;
```

## Resources

- [Implement Row Level Security in Supabase (video)](https://www.youtube.com/watch?v=Ow_Uzedfohk)

Restrict Access to the Messages Table in a Database with Row Level Security (RLS) Policies

Remix Loaders allow us to fetch data server-side, before rendering a component. This works great if you are implementing your authorization rules for data fetching in the loader function, however, Supabase allows us to use Row Level Security policies to write access policies alongside the data in the database.

By default, `supabase-js` stores session data in `localStorage`, which exists only within the user's browser. If we want this session to be available within Loader or Action functions in Remix, we need to store the session in a cookie. Cookies are automatically sent with every request to the server.

In this lesson, we look at using the Supabase Auth Helpers package for Remix to automate this process, and swap out the storage mechanism for the Supabase client, to use cookies to store session data.

Additionally, we refactor our application to use the new `createServerClient` and `createBrowserClient` functions, making cookies the single source of truth about the user's current session, across the server and client-side of our Remix app.

## Code Snippets

**Install Remix Auth Helpers**

```bash
npm i @supabase/auth-helpers-remix
```

**Create server-side Supabase client**

```tsx
import { createServerClient } from "@supabase/auth-helpers-remix";

import type { Database } from "db_types";

export default ({
  request,
  response,
}: {
  request: Request;
  response: Response;
}) =>
  createServerClient<Database>(
    process.env.SUPABASE_URL!,
    process.env.SUPABASE_ANON_KEY!,
    { request, response }
  );
```

**Create client-side Supabase client (simplified)**

```tsx
import { useState } from "react";
import { createBrowserClient } from "@supabase/auth-helpers-remix";

export const loader = async ({ request }: LoaderArgs) => {
  const env = {
    SUPABASE_URL: process.env.SUPABASE_URL!,
    SUPABASE_ANON_KEY: process.env.SUPABASE_ANON_KEY!,
  };

  return json({ env });
};

const { env, session } = useLoaderData<typeof loader>();

const [supabase] = useState(() =>
  createBrowserClient<Database>(env.SUPABASE_URL, env.SUPABASE_ANON_KEY)
);

return <Outlet context={{ supabase }} />;
```

**Use Supabase in a loader**

```tsx
export const loader = async ({ request }: LoaderArgs) => {
  const response = new Response();
  const supabase = createServerSupabase({ request, response });

  const { data } = await supabase.from("messages").select();

  return json({ data }, { headers: response.headers });
};
```

**Use Supabase in an action**

```tsx
export const action = async ({ request }: ActionArgs) => {
  const response = new Response();
  const supabase = createServerSupabase({ request, response });

  const { data } = await supabase.from("messages").insert({ content: "hello" });

  return json({ data }, { headers: response.headers });
};
```

**Use Supabase in a component**

```tsx
import { useOutletContext } from "@remix-run/react";

import type { SupabaseOutletContext } from "~/root";

export default function Login() {
  const { supabase } = useOutletContext<SupabaseOutletContext>();

  const handleLogin = async () => {
    await supabase.auth.signInWithOAuth({
      provider: "github",
    });
  };

  return <button onClick={handleLogin}>Login</button>;
}
```

## Resources

- [Supabase docs - Remix Auth Helpers](https://supabase.com/docs/guides/auth/auth-helpers/remix)

Make Cookies the User Session Single Source of Truth with Supabase Auth Helpers

The OAuth flow is asynchronous. This means we get redirected to the landing page before GitHub and Supabase have decided that you can be trusted! 👍

Since our Loader functions get called when we first load the page they make a request to Supabase before receiving a valid access token. This causes RLS to deny the request to select data.

Once our session has been correctly set, Supabase is happy but we aren't telling Remix to fetch this data again. In this lesson, we look at combining the `onAuthStateChange` hook from Supabase with the `useRevalidator` hook in Remix to recall any active `loaders` when the state of our user changes, keeping data in sync with mutations.

Therefore, any time the user's session is updated - the auth flow has completed for either signing in or out - Remix will automatically call all loader functions that are active on the current route (this could be many with nested routing), fetching fresh data from Supabase with a valid access token.

## Code Snippets

**onAuthStateChange listener**

```tsx
useEffect(() => {
  const {
    data: { subscription },
  } = supabase.auth.onAuthStateChange((event, session) => {
    if (session?.access_token !== serverAccessToken) {
      revalidator.revalidate()
    }
  });

  return () => {
    subscription.unsubscribe();
  };
}, [supabase, serverAccessToken, revalidator]);
```

## Resources

- [Supabase docs - onAuthStateChange](https://supabase.com/docs/reference/javascript/auth-onauthstatechange)
- [Reactor Router docs - useRevalidator](https://reactrouter.com/en/main/hooks/use-revalidator)

Keep Data in Sync with Mutations Using Active Remix Loader Functions

To mutate data in Remix, we use an Action function. In this lesson, we look at creating a Remix `<Form />` to submit the content of a message as a `post` request to our `Action` function.

Additionally, we use the server-side Supabase client from the Remix Auth Helpers package to make an authenticated request to Supabase, writing the new message to the `messages` table.

Futhermore, we run into an issue with RLS as we have not yet written a policy for the `insert` action. By setting this to the `authenticated` role and ensuring that the `user_id` column is equal to the value returned by the `auth.uid()` function - a function we get from Supabase to retrieve the ID for the user attempting to insert a new row - we ensure that users can not write a message on someone else's behalf.

Lastly, we use the `auth.uid()` function to set the default value of the `user_id` column to the ID of the user attempting to `insert` the new row in the `messages` table.

## Code Snippets

**Write data to Supabase**

```tsx
export const action = async ({ request }: ActionArgs) => {
  const response = new Response();
  const supabase = createServerSupabase({ request, response });

  const { message } = Object.fromEntries(await request.formData());

  await supabase.from("messages").insert({ content: String(message) });

  return json(null, { headers: response.headers });
};
```

**Form to submit to action**

```tsx
<Form method="post">
  <input type="text" name="message" />
  <button type="submit">Send</button>
</Form>
```

**Add policy for insert**

```sql
create policy "users can insert their own messages" on "public"."messages"
as permissive for insert
to authenticated
wuth check (user_id = auth.uid());
```

> SQL code snippets can be run against your Supabase database by heading over to your project's [SQL Editor](https://app.supabase.com/project/_/sql), pasting them into a new query, and clicking `RUN`.

## Resources

- [Supabase docs - insert](https://supabase.com/docs/reference/javascript/insert)
- [Implement Row Level Security in Supabase (video)](https://www.youtube.com/watch?v=Ow_Uzedfohk)
- [Remix docs - Writing data](https://remix.run/docs/en/v1/guides/data-writes)

Securely Mutate Supabase Data with Remix Actions

[Supabase Realtime](https://supabase.com/docs/guides/realtime) allow us to subscribe to change events in the database - `insert`, `update` and `delete` - and update the UI dynamically. In this lesson, we [enable `replication` on the `messages` table](https://app.supabase.com/project/_/database/replication) to tell Supabase we want to know about changes to this table.

Additionally, we use the Supabase client to set up a subscription for `insert` events on the `messages` table. This will receive websocket updates from Supabase, which we can handle in a callback function, and merge our server state with realtime updates, to allow our application to dynamically update as new messages are sent.

## Code Snippets

**Subscribe to realtime updates**

```tsx
useEffect(() => {
  const channel = supabase
    .channel("*")
    .on(
      "postgres_changes",
      { event: "INSERT", schema: "public", table: "messages" },
      (payload) => {
        const newMessage = payload.new as Message;

        if (!messages.find((message) => message.id === newMessage.id)) {
          setMessages([...messages, newMessage]);
        }
      }
    )
    .subscribe();

  return () => {
    supabase.removeChannel(channel);
  };
}, [supabase, messages, setMessages]);
```

**Enable realtime events on messages table**

```sql
alter table public.messages
replica identity full;
```

> SQL code snippets can be run against your Supabase database by heading over to your project's [SQL Editor](https://app.supabase.com/project/_/sql), pasting them into a new query, and clicking `RUN`.

## Resources

- [Your project's replication settings](https://app.supabase.com/project/_/database/replication)
- [Supabase docs - Realtime guide](https://supabase.com/docs/guides/realtime)
- [Supabase docs - Realtime in JS](https://supabase.com/docs/reference/javascript/subscribe)

Subscribe to Database Changes with Supabase Realtime

Using a GitHub repo to deploy our application to Vercel, keeps our code and live production site in sync. In this lesson we look at using the [GitHub CLI](https://cli.github.com/) tool to create a public repo, and adding it as a remote origin for our project.

Additionally, we create a new Vercel project from this GitHub repo, add our Supabase environment variables, and deploy. Lastly, we update the Homepage URL in our GitHub OAuth app to be our new Vercel URL, and set our Supabase project's [Authentication Site URL](https://app.supabase.com/project/_/auth/url-configuration) to our new live application URL.

## Extension ideas

- Style the app using Tailwind CSS (or another method of choice)
- Implement the ability for a user to `update` and `delete` their own messages
- Add the option to set a username and display this alongside messages
- Add separate message threads/chat rooms
- Implement private messages/chat rooms

## Resources

- [GitHub CLI](https://cli.github.com/)
- [Vercel docs](https://vercel.com/docs)
- [Deploying Remix app to Vercel](https://vercel.com/guides/deploying-remix-with-vercel)

Build a Realtime Chat App with Remix and Supabase

Instructor

Course content (11 lessons)

Instructor