+
Availability *
Tick every day and time block when you are generally available to teach (all times in your chosen timezone).
- {selectedAvail.size === 0 && (
-
Please select at least one availability window.
+ {errors.availability && (
+
{errors.availability.message}
)}
diff --git a/app/tutor/profile/actions.ts b/app/tutor/profile/actions.ts
index 18a01e4..f8713d2 100644
--- a/app/tutor/profile/actions.ts
+++ b/app/tutor/profile/actions.ts
@@ -30,18 +30,41 @@ export async function saveTutorProfile(
})
if (profileError) return { error: `Failed to save profile: ${profileError.message}` }
- // 2. Replace tutor_subjects: delete existing rows then re-insert
- const { error: deleteError } = await supabase
+ // 2. Update tutor_subjects safely: upsert provided rows, then delete stale ones.
+ // This avoids the partial-failure window of delete-then-insert (where a failed
+ // insert would leave the tutor with no subjects).
+ if (subjects.length > 0) {
+ const { error: upsertError } = await supabase.from('tutor_subjects').upsert(
+ subjects.map((s) => ({ tutor_user_id: user.id, subject_id: s.subject_id, level: s.level })),
+ { onConflict: 'tutor_user_id,subject_id,level' }
+ )
+ if (upsertError) return { error: `Failed to save subjects: ${upsertError.message}` }
+ }
+
+ // Remove stale (subject_id, level) combinations that are no longer in the new list.
+ // Fetch current subjects, compute the diff, and delete only the removed ones.
+ const { data: currentSubjects, error: fetchError } = await supabase
.from('tutor_subjects')
- .delete()
+ .select('subject_id, level')
.eq('tutor_user_id', user.id)
- if (deleteError) return { error: `Failed to update subjects: ${deleteError.message}` }
+ if (fetchError) return { error: `Failed to read subjects: ${fetchError.message}` }
- if (subjects.length > 0) {
- const { error: insertError } = await supabase.from('tutor_subjects').insert(
- subjects.map((s) => ({ tutor_user_id: user.id, subject_id: s.subject_id, level: s.level }))
- )
- if (insertError) return { error: `Failed to save subjects: ${insertError.message}` }
+ const newKeys = new Set(subjects.map((s) => `${s.subject_id}:${s.level}`))
+ const toDelete = (currentSubjects ?? []).filter(
+ (row) => !newKeys.has(`${row.subject_id}:${row.level}`)
+ )
+ if (toDelete.length > 0) {
+ // Build a single OR-filter to remove all stale rows in one round-trip instead of N.
+ // Syntax: and(subject_id.eq.X,level.eq.Y) per stale pair, joined by comma = OR.
+ const orFilter = toDelete
+ .map((row) => `and(subject_id.eq.${row.subject_id},level.eq.${row.level})`)
+ .join(',')
+ const { error: delError } = await supabase
+ .from('tutor_subjects')
+ .delete()
+ .eq('tutor_user_id', user.id)
+ .or(orFilter)
+ if (delError) return { error: `Failed to remove old subjects: ${delError.message}` }
}
// 3. Upsert tutor_availability
diff --git a/app/tutor/profile/page.tsx b/app/tutor/profile/page.tsx
index a95d52e..fd37ee5 100644
--- a/app/tutor/profile/page.tsx
+++ b/app/tutor/profile/page.tsx
@@ -18,9 +18,14 @@ export default async function TutorProfilePage() {
if (!user) redirect('/auth/sign-in')
+ // subjects table has no RLS — readable by any authenticated user via the user-scoped client.
+ // tutor_profiles / tutor_subjects / tutor_availability are read via the user-scoped client,
+ // which enforces RLS (tutor reads own rows). createAdminClient() is only used for subjects
+ // where it doesn't matter (no RLS), kept as adminClient to avoid an extra DB round-trip for
+ // the anon key path — but any of the calls below could equally use supabase directly.
const adminClient = createAdminClient()
- // Fetch subjects list and existing tutor profile in parallel
+ // Fetch subjects list (no RLS) via admin client; tutor-owned data via user-scoped client.
const [
{ data: subjectsData },
{ data: profileData },
@@ -29,21 +34,21 @@ export default async function TutorProfilePage() {
{ data: userProfile },
] = await Promise.all([
adminClient.from('subjects').select('id, name, code').eq('active', true).order('sort_order'),
- adminClient
+ supabase
.from('tutor_profiles')
.select('approved, bio, timezone')
.eq('tutor_user_id', user.id)
.maybeSingle(),
- adminClient
+ supabase
.from('tutor_subjects')
.select('subject_id, level')
.eq('tutor_user_id', user.id),
- adminClient
+ supabase
.from('tutor_availability')
.select('windows')
.eq('tutor_user_id', user.id)
.maybeSingle(),
- adminClient
+ supabase
.from('user_profiles')
.select('display_name, timezone')
.eq('user_id', user.id)
diff --git a/supabase/migrations/20260224000002_create_tutor_tables.sql b/supabase/migrations/20260224000002_create_tutor_tables.sql
index 1c760d0..038147e 100644
--- a/supabase/migrations/20260224000002_create_tutor_tables.sql
+++ b/supabase/migrations/20260224000002_create_tutor_tables.sql
@@ -69,19 +69,29 @@ create policy "tutor_profiles_select"
create policy "tutor_profiles_insert"
on public.tutor_profiles for insert to authenticated
- with check (tutor_user_id = auth.uid());
+ with check (
+ tutor_user_id = auth.uid()
+ and (approved = false or public.is_admin(auth.uid()))
+ );
create policy "tutor_profiles_update_own"
on public.tutor_profiles for update to authenticated
using (tutor_user_id = auth.uid())
- with check (tutor_user_id = auth.uid());
+ with check (
+ tutor_user_id = auth.uid()
+ and approved = (
+ select p.approved
+ from public.tutor_profiles p
+ where p.tutor_user_id = auth.uid()
+ )
+ );
create policy "tutor_profiles_admin_update"
on public.tutor_profiles for update to authenticated
using (public.is_admin(auth.uid()))
with check (public.is_admin(auth.uid()));
--- tutor_subjects: tutor manages own rows; admin reads all
+-- tutor_subjects: tutor manages own rows; admin reads/writes all
create policy "tutor_subjects_select"
on public.tutor_subjects for select to authenticated
using (tutor_user_id = auth.uid() or public.is_admin(auth.uid()));
@@ -91,7 +101,12 @@ create policy "tutor_subjects_write_own"
using (tutor_user_id = auth.uid())
with check (tutor_user_id = auth.uid());
--- tutor_availability: tutor manages own row; admin reads all
+create policy "tutor_subjects_admin_write"
+ on public.tutor_subjects for all to authenticated
+ using (public.is_admin(auth.uid()))
+ with check (public.is_admin(auth.uid()));
+
+-- tutor_availability: tutor manages own row; admin reads/writes all
create policy "tutor_availability_select"
on public.tutor_availability for select to authenticated
using (tutor_user_id = auth.uid() or public.is_admin(auth.uid()));
@@ -100,3 +115,8 @@ create policy "tutor_availability_write_own"
on public.tutor_availability for all to authenticated
using (tutor_user_id = auth.uid())
with check (tutor_user_id = auth.uid());
+
+create policy "tutor_availability_admin_write"
+ on public.tutor_availability for all to authenticated
+ using (public.is_admin(auth.uid()))
+ with check (public.is_admin(auth.uid()));