babita-svg/Reneo-live

Reneo is a commerce platform for solo entrepreneurs in Africa. It brings commerce, content, payments and communication into a single environment rather than a stack of disconnected tools. # Reneo Live — Full-Stack Live Commerce Platform Production-ready live commerce application for African entrepreneurs built with **React**, **TypeScript**, **Supabase** (Auth, Database, Storage, Realtime), **Express**, and **Agora RTC** (Low-latency Live Video Streaming). --- ## 📸 Architecture Overview ```text React 19 + TypeScript | +-----------------------------------+ | | v v Supabase Auth & Database Express Backend Server - User Sign In / Sign Up - Token Signer (/api/agora-token) - RLS Policies & Roles - Healthcheck API (/api/health) - Product & Session Storage - JWT Token Verification - Realtime WebSocket Chat | | v v Agora RTC Engine Storage & Realtime - Broadcaster (Publisher) - Audience (Subscriber) ``` --- ## 🔒 Security Model & Access Control ### Security Question (Mandatory Requirement): > **What stops a user from editing the ID in a request and deleting another seller's product?** **Answer:** Frontend UI buttons are never a security boundary. Row Level Security (RLS) enabled on the PostgreSQL `public.products` table in Supabase serves as the authoritative protection layer. ```sql -- Enforced Supabase Row Level Security Policy for Product Deletion CREATE POLICY "Sellers can delete their own products" ON public.products FOR DELETE USING ( auth.uid() = seller_id AND EXISTS (SELECT 1 FROM public.profiles WHERE id = auth.uid() AND role = 'seller') ); ``` When a user triggers an API request to delete product `id = 'prod_123'`, PostgreSQL extracts the cryptographically signed `auth.uid()` from the Supabase JWT access token. It validates this against `seller_id` on the target row. If `auth.uid() != seller_id`, PostgreSQL rejects the request at the database level and returns a `403 Permission Denied` error, rendering client-side parameter tampering …