AppHighway + Supabase: Complete Backend Stack Without Servers

// Set secrets via Supabase CLI
supabase secrets set APPHIGHWAY_API_KEY=your_key_here

// Access in Edge Functions
const apiKey = Deno.env.get('APPHIGHWAY_API_KEY')

Why: Prevents accidental key exposure, enables easy key rotation, different keys per environment

const callWithRetry = async (fn: () => Promise<any>, retries = 3) => {
  for (let i = 0; i < retries; i++) {
    try {
      return await fn();
    } catch (error) {
      if (i === retries - 1) throw error;
      await new Promise(resolve => setTimeout(resolve, Math.pow(2, i) * 1000));
    }
  }
};

Why: Handles transient network failures, improves reliability, better user experience

-- Users can only see their own data
CREATE POLICY "Users view own data"
  ON user_data FOR SELECT
  USING (auth.uid() = user_id);

-- Edge Functions can write but users can't
CREATE POLICY "Service role can write"
  ON processed_data FOR INSERT
  WITH CHECK (true);

Why: Prevents data leaks, enforces security at database level, defense in depth

// Check cache first
const { data: cached } = await supabase
  .from('api_cache')
  .select('result')
  .eq('key', cacheKey)
  .gte('expires_at', new Date().toISOString())
  .single();

if (cached) return cached.result;

// Call API and cache
const result = await callAppHighway();
await supabase.from('api_cache').insert({
  key: cacheKey,
  result,
  expires_at: new Date(Date.now() + 3600000).toISOString() // 1 hour
});

Why: Reduces API costs, improves response time, reduces load on AppHighway

-- Process in background
CREATE TRIGGER process_async
  AFTER INSERT ON tasks
  FOR EACH ROW
  EXECUTE FUNCTION call_edge_function();

-- User gets immediate response
INSERT INTO tasks (data) VALUES ('...');
RETURN IMMEDIATELY;

Why: Better UX with instant responses, handles heavy processing asynchronously, scalable architecture

// Add timing logs
const start = Date.now();
const result = await callAppHighway();
console.log(`API call took ${Date.now() - start}ms`);

// Log errors with context
try {
  await process();
} catch (error) {
  console.error('Processing failed:', {
    error: error.message,
    userId,
    timestamp: new Date().toISOString()
  });
  throw error;
}

Why: Identify performance bottlenecks, debug production issues, optimize API usage

// Instead of sequential processing
for (const item of items) {
  await processWithAppHighway(item); // Slow!
}

// Use parallel processing
const results = await Promise.all(
  items.map(item => processWithAppHighway(item))
); // Fast!

Why: 10x faster processing, better resource utilization, lower latency

try {
  const result = await callAppHighway();
} catch (error) {
  if (error.status === 429) {
    // Rate limit - retry with backoff
    return await retryWithBackoff();
  } else if (error.status === 401) {
    // Invalid API key - alert admin
    await notifyAdmin('Invalid AppHighway tool key');
    throw new Error('Configuration error');
  } else if (error.status >= 500) {
    // Server error - retry
    return await retry();
  } else {
    // Client error - return to user
    throw new Error(`API error: ${error.message}`);
  }
}

Why: Better debugging, graceful degradation, improved reliability

// Define database types
import { Database } from './database.types';

type Review = Database['public']['Tables']['reviews']['Row'];

// Define API response types
interface SentimentResult {
  score: number;
  label: 'positive' | 'negative' | 'neutral';
  confidence: number;
}

const analyzeReview = async (review: Review): Promise<SentimentResult> => {
  // Fully type-safe
};

Why: Catch errors at compile time, better IDE support, self-documenting code

const corsHeaders = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
};

serve(async (req) => {
  // Handle preflight
  if (req.method === 'OPTIONS') {
    return new Response('ok', { headers: corsHeaders });
  }

  // Include in response
  return new Response(data, {
    headers: { ...corsHeaders, 'Content-Type': 'application/json' }
  });
});

Why: Enables browser-based API calls, prevents CORS errors, better security