Progress Report - November 24, 2025

Project: ISO Tracker

✅ Completed

• Fixed critical email signup functionality for 3i-atlas.live landing page
• Resolved RLS (Row-Level Security) policy violation preventing new signups
• Documented proper server-side vs client-side authentication key usage pattern

🐛 Issues & Learnings

Issue: Email Signup RLS Policy Violation

• Root Cause: API route used NEXT_PUBLIC_SUPABASE_ANON_KEY for server-side operation instead of service role key. Anon keys are meant for client-side operations only, while server-side API routes should use SUPABASE_SERVICE_ROLE_KEY for trusted operations.
• Fix: Changed apps/web/app/api/email-signup/route.ts to use service role key, which correctly bypasses RLS for trusted server-side operations
• Prevention: Document authentication key usage pattern - server-side API routes (/app/api/*) should use service role key, client-side components should use anon key. Add this pattern to architecture.md for future reference.
• Time Impact: ~2 hours debugging

Impact Summary

Fixed a critical blocker preventing new email signups on the 3i-atlas.live landing page. The issue revealed an important architectural pattern: distinguishing between client-side and server-side authentication in Supabase. This fix unblocks user acquisition for the landing page.

Next Steps

• Sprint 14: Stripe Payments integration (critical monetization feature)
• Deploy email signup fix to production
• Sprint 15: User profile pages and final MVP polish

Generated from progress.md on November 24, 2025 at 8:48 PM