# CLAUDE.md - this project

Project instructions for Claude Code.

## Project

A Python + FastAPI + Supabase + pytest project.

Stack: Python + FastAPI, Supabase, pytest.

## Commands

- Install deps: `uv sync`
- Dev server: `uv run fastapi dev`
- Lint and format: `uv run ruff check . && uv run ruff format .`
- Tests: `uv run pytest`
- New migration: `npx supabase migration new <name>`
- Generate TS types: `npx supabase gen types typescript --local > types/supabase.ts`
- Tests: `uv run pytest -q`

## Project structure

- `app/main.py` creates the app; one `APIRouter` per domain in `app/routers/`.
- Pydantic schemas in `app/schemas/`, business logic in `app/services/`.

## How to work in this repo

- Read the relevant files before editing. Follow the patterns already in the codebase over these generic rules.
- Make the smallest change that solves the task. Do not refactor or reformat unrelated code.
- Before saying a task is done, run the type-check, lint and tests listed under Commands and fix what you broke.
- If requirements are ambiguous, ask one clear question instead of guessing.
- Never commit secrets, API keys or `.env` files. Use env vars and keep `.env.example` up to date.
- Do not add a new dependency when the standard library or an existing dependency already covers it.
- Ask before adding, removing or upgrading any dependency.
- Ask before changing database schemas, auth, payments or CI configuration.
- Never delete files, drop data or run destructive commands (`rm -rf`, `git push --force`, `DROP TABLE`) without explicit approval.
- Keep each change under ~200 changed lines where possible; split larger work into steps.

## Python + FastAPI

- Type-hint every function. Use `Annotated[..., Depends(...)]` for dependencies.
- Request and response bodies are Pydantic v2 models; set `response_model` so output is filtered.
- Use `async def` only when the endpoint awaits async I/O. Blocking libraries go in plain `def` endpoints.
- Inject DB sessions, settings and the current user with dependencies, not globals.
- Load settings with `pydantic-settings` from env vars.
- Raise `HTTPException` with a clear `detail` for expected errors.
- Manage dependencies with `uv add <pkg>`; do not hand-edit lock files.

## Supabase

- Enable Row Level Security on every table and write explicit policies. No table ships without RLS.
- The anon/publishable key is public. The `service_role`/secret key bypasses RLS: use it only in trusted server code, never in the client.
- Change the schema with migration files in `supabase/migrations/`, not by clicking in the dashboard.
- On the server, verify the user with `supabase.auth.getUser()` (or `getClaims()`); do not trust `getSession()` alone for authorization.

## pytest

- Tests live in `tests/` named `test_*.py`. Use plain `assert`.
- Share setup with fixtures in `conftest.py`; use `@pytest.mark.parametrize` for input tables.
- Mock external services (HTTP, LLM APIs, payment providers); tests must not hit the network.
- Every bug fix adds a regression test.

## Reference docs

- [FastAPI docs](https://fastapi.tiangolo.com)
- [Supabase docs](https://supabase.com/docs)
- [pytest docs](https://docs.pytest.org)