Lovable Prompts for Building a Classifieds Site

Add four layers of anti-spam to the submit-inquiry and submit-ad edge functions. Paste this right after the starter finishes:

1. **Honeypot field:** In InquiryForm.tsx and PostForm.tsx, add a hidden text input with name='website' and style `display:none; position:absolute; opacity:0;`. In submit-inquiry edge function, if the `website` field is non-empty, return 200 silently without inserting — bots fill hidden fields, humans don't.

2. **IP rate limit:** In submit-inquiry, read `req.headers.get('cf-connecting-ip') || req.headers.get('x-forwarded-for')`. Check a simple in-memory counter using Supabase `supabase.from('ip_rate_limits').upsert({ip, count: 1, window_start: now})`. If count > 3 in the last 60 minutes for this IP, return HTTP 429 with `{ error: 'Too many inquiries. Try again later.' }`.

3. **Cloudflare Turnstile:** In InquiryForm.tsx, render the Turnstile widget: `<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer />` and a `<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY" />`. Read the `cf-turnstile-response` token from the form. In submit-inquiry edge function, verify it: `const result = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { method: 'POST', body: JSON.stringify({ secret: Deno.env.get('TURNSTILE_SECRET_KEY'), response: token }) })`. If success is false, return 403.

4. **Email confirmation gate on submit-ad:** submit-ad must set status='pending_review' (not 'active') and email a confirmation link. Add this check so posting without clicking the email link never creates an active ad.

Test: submit a form from an incognito browser without filling the Turnstile. You should see HTTP 403.

Explicitly verify and harden the RLS policies on the inquiries and reports tables. Paste this prompt as a verification step:

In Cloud → Database → SQL Editor, run the following to confirm the policies:
```sql
SELECT tablename, policyname, cmd, roles, qual, with_check
FROM pg_policies
WHERE tablename IN ('inquiries', 'reports');
```

You should see INSERT-only policies for anon on both tables, and NO SELECT policy for anon on either. If a SELECT policy for anon exists on inquiries, drop it immediately:
```sql
DROP POLICY IF EXISTS inquiries_anon_select ON inquiries;
```

Then verify in an incognito browser using the browser console:
```javascript
const { data, error } = await supabase.from('inquiries').select();
console.log(data, error); // should return 0 rows or RLS error
```

If data is non-empty (you can see inquiries), the SELECT policy for anon is still active. Drop it and add only: `CREATE POLICY inquiries_owner_select ON inquiries FOR SELECT TO authenticated USING (EXISTS (SELECT 1 FROM ads WHERE ads.id = inquiries.ad_id AND ads.poster_id = auth.uid()));`

Repeat the incognito test after fixing. Confirm 0 rows returned for anon.

Set up automatic ad expiry so ads that have passed their 30-day window are automatically moved to status='expired'. Two steps:

1. Enable pg_cron in Cloud → Database → SQL Editor:
```sql
CREATE EXTENSION IF NOT EXISTS pg_cron;
```

2. Schedule the expire-ads job to run every hour:
```sql
SELECT cron.schedule(
  'expire-ads',
  '0 * * * *',
  $$ UPDATE ads SET status='expired' WHERE status='active' AND expires_at <= now(); $$
);
```

3. Also add a 3-day warning job that sends an email to poster_email when their ad expires in 3 days:
```sql
SELECT cron.schedule(
  'expire-ads-warning',
  '0 9 * * *',
  $$ SELECT net.http_post(url := (SELECT value FROM app_settings WHERE key = 'edge_function_url') || '/functions/v1/send-expiry-warnings', headers := '{"Authorization": "Bearer SERVICE_ROLE_KEY"}'::jsonb); $$
);
```

For the simpler version without the warning email, just run the first two SQL statements. Verify by updating one ad's expires_at to 5 minutes ago and confirming it moves to status='expired' within the hour.

Add an OpenAI moderation pass to the submit-ad edge function to flag obviously prohibited content (hate speech, sexual content, violence, self-harm) before an ad becomes active.

In submit-ad/index.ts, after the initial validation and before the database insert, add:
```typescript
const openaiKey = Deno.env.get('OPENAI_API_KEY');
if (openaiKey) {
  const modResponse = await fetch('https://api.openai.com/v1/moderations', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${openaiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify({ input: `${title} ${description}` })
  });
  const modResult = await modResponse.json();
  const flagged = modResult.results?.[0]?.flagged;
  if (flagged) {
    return new Response(JSON.stringify({ ok: false, reason: 'content_policy' }), { status: 422 });
  }
}
```

Add OPENAI_API_KEY to Cloud → Secrets (not as VITE_OPENAI_KEY — never client-side). Cost: ~$0.0001 per ad submitted, negligible. If the OpenAI call fails (timeout, outage), log the error but DO NOT block the submission — content moderation failure should not prevent legitimate ads from posting.

Add a 'Bump your ad to the top' feature where posters pay $5 to feature their ad at the top of its category for 7 days.

1. Add columns to ads: `featured bool default false`, `featured_until timestamptz nullable`, `stripe_session_id text unique nullable`.

2. Create a `create-bump-session` edge function that creates a Stripe Checkout Session:
```typescript
const session = await stripe.checkout.sessions.create({
  payment_method_types: [],
  automatic_payment_methods: { enabled: true },
  line_items: [{ price_data: { currency: 'usd', product_data: { name: 'Ad Bump — 7 days featured' }, unit_amount: 500 }, quantity: 1 }],
  mode: 'payment',
  success_url: `${Deno.env.get('SITE_URL')}/ad/${adSlug}?bumped=1`,
  cancel_url: `${Deno.env.get('SITE_URL')}/ad/${adSlug}`,
  metadata: { ad_id: adId }
});
```

3. Create a `stripe-bump-webhook` edge function. Read raw body with `await req.text()`, verify with `await stripe.webhooks.constructEventAsync(rawBody, sig, Deno.env.get('STRIPE_WEBHOOK_SECRET'))`. On checkout.session.completed, update: `UPDATE ads SET featured=true, featured_until=now()+interval '7 days' WHERE id=metadata.ad_id`.

Add STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET to Cloud → Secrets. Test with Stripe test card 4242 4242 4242 4242 on a published (not preview) URL.