RLS for the owner
Add database rules so only the signed-in owner can read and update orders, and prove it: as a stranger you see nothing and change nothing, and as Adjoa you see every order.
Why this matters
Your /admin page is locked. But the orders don't live in your Next.js app. They live in Supabase, and Supabase can be reached directly by anyone who has your project's public URL and publishable key. Every visitor's browser has both, because the menu and order form need them.
So the real question is: what does the database itself allow? In Module 7 you set the rules: the public may add orders but not read them. That's why /admin would show an empty list if you tried to load orders right now: nobody, not even Adjoa, has permission to read them yet.
In this lesson you give that permission to exactly one person, the signed-in owner, and to nobody else. Then you prove it from both sides. This is the lock that still holds if every other lock fails. It's also the lock that beginners most often get wrong, so you'll read every line before it runs.
In the full lesson
- The idea in plain English
- Do it
- Check it worked
- Understand what AI wrote
- Quick check
- What you can do now
The step-by-step, the prompt to copy, the video and the check-it-worked list, for every lesson in all 15 modules. GHS 399 ($40), paid once by mobile money or card, yours to keep.