# Parcel Empire — Supabase Setup Guide (Phase 11.31.1)

Supabase is the online backend for accounts, database records and cloud saves. It does **not** replace the web host that serves the Parcel Empire HTML, CSS, JavaScript and assets. Keep the frontend on IONOS, Netlify, Cloudflare Pages, Vercel or another HTTPS static host.

## What this corrected build supports

- Email/password and Google authentication through `login.html`
- Supabase session persistence in the browser
- Cross-device syncing of the current Phase 11.31 local game state
- Syncing of the current profile page
- Existing database tables/RPCs for future global ownership, wallets, marketplace, rewards and admin tools

The new file `js/supabase-live-bridge.js` connects the current Phase 11.31 pages to `atlas_profiles.player_state`. This makes the current prototype cloud-save capable, but local browser values are still not authoritative enough for real money or a competitive public launch.

## 1. Create the Supabase project

1. Create a new project in the Supabase dashboard.
2. Use a strong database password and store it safely.
3. Wait until the project is fully provisioned.
4. Use a separate project for testing and production.

## 2. Add the public browser connection values

Open the Supabase project settings and copy:

- Project URL
- Publishable key (recommended), or the legacy `anon` public key

Edit `js/config.js`:

```js
SUPABASE_URL: "https://YOUR-PROJECT.supabase.co",
SUPABASE_PUBLISHABLE_KEY: "YOUR_PUBLISHABLE_KEY",
SUPABASE_ANON_KEY: "",
```

You can instead put a legacy anon key into `SUPABASE_ANON_KEY`. Never put a secret key or service-role key in the website.

## 3. Create and secure the database

Run these files in the Supabase SQL Editor in this exact order:

1. `sql/supabase_schema.sql`
2. `sql/production_hardening.sql`
3. `sql/supabase_security_patch.sql`

The third file:

- removes direct browser creation of arbitrary wallets/parcels;
- makes parcel price, rarity and income server-decided in the purchase RPC;
- removes stored public profile emails;
- restricts database-function execution to authenticated users;
- keeps real-money rewards disabled.

## 4. Configure authentication URLs

In Supabase Auth URL configuration set the production Site URL to your exact HTTPS domain, for example:

```text
https://game.yourdomain.co.uk
```

Add redirect URLs such as:

```text
https://game.yourdomain.co.uk/login.html
https://game.yourdomain.co.uk/dashboard.html
https://game.yourdomain.co.uk/**
```

For local testing, also add the exact local URL and port you use, such as:

```text
http://localhost:8080/**
```

Enable Email authentication first. Configure Google only after email/password works.

## 5. Upload the frontend

Upload the **contents** of this project folder to the public web root of your HTTPS host. Keep the existing directory structure intact, including:

- `assets/`
- `css/`
- `js/`
- `sql/` (optional to host, but useful for setup)
- all root HTML files
- `manifest.webmanifest`
- `sw.js`

The public entry pages are:

- `index.html` — public landing page
- `login.html` — sign-in/create-account page
- `dashboard.html` — current game map

## 6. First online test

1. Open the hosted `login.html` in a private/incognito window.
2. Create an account and confirm the email if confirmations are enabled.
3. Sign in and enter `dashboard.html`.
4. Make one harmless prototype change, such as editing the profile or claiming a local daily reward.
5. Wait about 15 seconds or leave the page so the bridge flushes the save.
6. Sign in with the same account in another browser/device.
7. Confirm the cloud state loads.
8. Check Supabase Table Editor → `atlas_profiles` and confirm `player_state` is populated.

## 7. Before a public or real-money launch

Do not enable real payouts yet. The current map purchase UI still changes local state before using the authoritative server purchase RPC. The following work remains:

- wire the current buy flow to `atlas_buy_new_parcel`;
- display the server-returned rarity rather than a browser roll;
- use `atlas_wallets` as the only Land Bucks/rent authority;
- load global ownership from `atlas_parcels` on the current map;
- validate rewarded ads with a trusted provider/server callback;
- add real payment-provider receipt verification for shop purchases;
- implement password reset, abuse controls, moderation and account deletion;
- complete legal, age/KYC, tax and payout-provider reviews.

## Troubleshooting

- If the app still shows old code, unregister the old service worker or clear site data once. This build has a new cache version, but previously installed versions can remain open until refreshed.
- If signup works but redirects incorrectly, verify the exact Site URL and Redirect URLs in Supabase.
- If database calls return permission errors, confirm all three SQL files ran successfully and inspect Supabase Security Advisor.
- If cloud sync remains local, confirm both `SUPABASE_URL` and a browser-safe key are filled in and that `login.html`, `dashboard.html`, `js/cloud.js` and `js/supabase-live-bridge.js` were uploaded.