Build an Auction Platform in Lovable

Enable Supabase Realtime on the auctions and bids tables. In AuctionDetail.tsx, add two Realtime subscriptions inside a single useEffect:

1. Subscribe to channel 'auction-{id}' filtering on auctions:id=eq.{auctionId}. On UPDATE event, update the local auction state with the new current_bid_cents, current_bidder_id, bid_count, and ends_at.

2. Subscribe to channel 'bids-{id}' filtering on bids:auction_id=eq.{auctionId}. On INSERT event, prepend the new bid to BidHistoryList and update the HighBidBadge.

Also add a re-subscribe on document.visibilitychange so the subscriptions reconnect when the user returns to the tab after backgrounding the browser. Add a 30-second polling fallback: if no Realtime event has been received in 30s, fetch the latest 5 bids and the current auction state directly from Supabase. Clean up all subscriptions on component unmount.

Create a Supabase Edge Function at supabase/functions/close-auction/index.ts. This function runs on a schedule every 60 seconds.

The function should:
1. Query auctions where ends_at < now() AND status = 'live'.
2. For each, set status = 'closed' in a single UPDATE.
3. For each closed auction where current_bidder_id IS NOT NULL (there was a winner), INSERT a row into payments (auction_id, winner_id = current_bidder_id, amount_cents = current_bid_cents, status = 'pending').
4. If there was no winner (current_bidder_id IS NULL), skip the payments insert — just close the auction.
5. After writing all payments rows, invoke the charge-winner Edge Function for each payment row (pass payment_id as the body). Use the Supabase JS client with the service-role key to call the function.
6. Return a summary JSON: {closed_count, payments_created}.

This function requires the service-role key — use Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') (Lovable Cloud auto-injects this). After generating, go to Cloud tab → Edge Functions → close-auction → Schedule and set it to run every 60 seconds.

Create a Supabase Edge Function at supabase/functions/charge-winner/index.ts. This function is called by close-auction with a payment_id in the body.

The function should:
1. Read the payment row from the payments table using the provided payment_id.
2. Look up profiles.stripe_customer_id for the winner.
3. If stripe_customer_id exists: create a Stripe PaymentIntent with amount = payment.amount_cents, currency = 'usd', customer = stripe_customer_id, confirm = true (auto-confirm if they have a saved payment method). Update payments.status to 'succeeded' or 'failed' based on the result.
4. If stripe_customer_id is null: send a Resend email to the winner's email address with a Stripe Payment Link URL and a message like 'Congratulations — you won [auction title]! Complete your purchase here: [link]'. Update payments.status to 'pending' with a note.
5. Return {payment_id, status}.

Use STRIPE_SECRET_KEY from Deno.env.get() and RESEND_API_KEY for emails. Never hardcode keys. The function must handle errors gracefully — if Stripe fails, log the error, set status='failed', and return a 200 (so close-auction doesn't retry in a loop).

Create a Supabase Edge Function at supabase/functions/ensure-stripe-customer/index.ts that accepts a user object (id, email) and creates a Stripe Customer record if one doesn't already exist for that user.

The function should:
1. Check profiles.stripe_customer_id for the given user id — if it already exists, return it immediately.
2. If not, call stripe.customers.create({ email: user.email, metadata: { supabase_user_id: user.id } }).
3. Update profiles.stripe_customer_id = customer.id where id = user.id using the service-role key.
4. Return { stripe_customer_id }.

Then create a Postgres trigger function `on_auth_user_created` that fires AFTER INSERT ON auth.users. The trigger should call ensure-stripe-customer via an HTTP request using net.http_post() (pg_net extension). Also run a one-time backfill: for all profiles where stripe_customer_id IS NULL, call ensure-stripe-customer.

Add a backfill button in /admin/moderation that runs the backfill on demand.

Update the place_bid Postgres RPC to add three anti-shilling guards:

1. Seller cannot bid on own auction: if auth.uid() = (SELECT seller_id FROM auctions WHERE id = p_auction_id), raise exception 'Sellers cannot bid on their own listings.'.

2. Rate limit: if EXISTS (SELECT 1 FROM bids WHERE bidder_id = auth.uid() AND auction_id = p_auction_id AND placed_at > now() - interval '2 seconds'), raise exception 'Please wait a moment before placing another bid.'

3. Flag for review: if (SELECT count(*) FROM bids b JOIN auctions a ON a.id = b.auction_id WHERE b.bidder_id = auth.uid() AND a.seller_id = (SELECT seller_id FROM auctions WHERE id = p_auction_id)) > 50, INSERT into a new table `fraud_flags` (user_id, reason, created_at) — create this table with RLS admin-only. Do not block the bid, just flag it.

Create the fraud_flags table in a new migration with RLS admin-only SELECT and INSERT via place_bid (SECURITY DEFINER bypass). Add a Fraud Flags tab in /admin/moderation.

Add a Seller Dashboard section to /account under a My Listings tab. Show each of the seller's auctions with: title, current status, current_bid_cents vs reserve_cents, bid_count, ends_at countdown.

For closed auctions where current_bid_cents < reserve_cents: show a yellow 'Reserve not met' badge and a 'Relist' button that creates a new auction pre-filled with the same title/description/image/reserve and a new ends_at.

For closed auctions where the reserve was met but payment.status = 'pending': show 'Awaiting payment' with the winner's display_name.

For closed auctions where payment.status = 'succeeded': show 'Sold' with the final amount.

Update close-auction Edge Function: when closing an auction, if current_bid_cents < reserve_cents, do NOT create a payments row — set status='closed' and log the reserve-not-met outcome in a new column `close_reason` (text, values: 'won','reserve_not_met','no_bids','cancelled') on the auctions table. Add this column in a new migration.

Add Resend winner notification emails to the charge-winner Edge Function. After processing a payment (whether succeeded or pending), send a branded email to the winner using RESEND_API_KEY from Deno.env.get():

Subject: 'You won: [auction title]!'
Body: Congratulate the winner, show the winning amount, include a link to /account and a link to their Stripe portal (if stripe_customer_id exists).

Also send a seller notification email: 'Your auction [title] has closed. Winning bid: $X.XX. Winner: [display_name].'

Use Resend's Node.js-compatible SDK: import { Resend } from 'https://esm.sh/resend@latest'. Wrap both sends in try/catch — a failed email must never fail the webhook response.

Add RESEND_API_KEY to Cloud tab → Secrets before running this prompt.