fix: restrict leaderboard member visibility and fix auth recursion

- Tighten public.leaderboard_members policy to only allow users
  to see their own membership (user_id = auth.uid()).
- Update LeaderbordList: select owner_id, capture query error,
  and filter joined boards to role == "member".
- Use supabase.auth.getUser() in auth proxy and return undefined
  at the end of the middleware.
- Log auth middleware triggers and return early in proxy.ts

Author: mrepol742

app/components/dashboard/LeaderbordList.tsx

@@ -27,11 +27,11 @@ export default async function LeaderboardsList() {
     .select("id, name, slug, owner_id")
     .eq("owner_id", user.id);
 
-  const { data: joined } = await supabase
+  const { data: joined, error } = await supabase
     .from("leaderboard_members")
-    .select("leaderboards(id, name, slug)")
+    .select("leaderboards(id, name, slug, owner_id)")
     .eq("user_id", user.id)
-    .neq("role", "owner");
+    .eq("role", "member");
 
   const joinedBoards =
     joined?.flatMap((j: LeaderboardMember) => j.leaderboards) || [];

app/lib/proxy/auth.ts

@@ -25,11 +25,8 @@ export default async function Auth(req: NextRequest) {
   );
 
   const {
-    data: { session },
-  } = await supabase.auth.getSession();
-
-  const user = session?.user;
-
+    data: { user },
+  } = await supabase.auth.getUser();
   const { pathname } = req.nextUrl;
 
   const protectedRoutes = ["/dashboard", "/logout"];
@@ -49,5 +46,5 @@ export default async function Auth(req: NextRequest) {
     return NextResponse.redirect(new URL("/dashboard", req.url));
   }
 
-  return response;
+  return undefined;
 }

proxy.ts

@@ -16,7 +16,10 @@ export async function proxy(req: NextRequest) {
   }
 
   const authResponse = await auth(req);
-  if (authResponse) return authResponse;
+  if (authResponse) {
+    console.log("Auth middleware triggered for:", req.nextUrl.pathname);
+    return authResponse
+  };
 
   return NextResponse.next({
     request: { headers: req.headers },

sql/public.leaderboards.sql

@@ -57,17 +57,10 @@ for update
 using (auth.uid() = owner_id);
 
 /* ---- Members Policies ----- */
-create policy "Users can see members of joined leaderboards"
+create policy "Users can see their own membership"
 on public.leaderboard_members
 for select
-using (
-  user_id = auth.uid()
-  OR leaderboard_id IN (
-    select leaderboard_id
-    from public.leaderboard_members
-    where user_id = auth.uid()
-  )
-);
+using (user_id = auth.uid());
 
 create policy "Users can join leaderboard"
 on public.leaderboard_members