Build a Food Delivery Backend in Lovable

Build a three-sided food delivery backend. Stack: React + Vite + TypeScript + Tailwind + shadcn/ui (already scaffolded), React Router v6, Supabase JS client against Lovable Cloud.

IMPORTANT: This app has three user roles — customer, restaurant_owner, and driver. All role checks MUST go through a SECURITY DEFINER plpgsql function. Never check role with inline SQL in RLS policies — it causes infinite recursion on the profiles table.

## Database schema (migration: supabase/migrations/0001_food_delivery_schema.sql)

First, enable extensions:
CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;
CREATE EXTENSION IF NOT EXISTS cube;

Create the has_role() function BEFORE any tables:
CREATE OR REPLACE FUNCTION has_role(role_name text)
RETURNS boolean
LANGUAGE plpgsql
SECURITY DEFINER
STABLE
AS $$
BEGIN
  RETURN (auth.jwt() -> 'app_metadata' ->> 'role') = role_name;
END;
$$;

Create six tables:

1. `profiles` — id (uuid references auth.users.id on delete cascade, pk), role (text check (role in ('customer','restaurant_owner','driver','admin')) not null), full_name (text), phone (text), created_at (timestamptz default now()).
   RLS: enable. FOR SELECT: per-user (id = auth.uid()). FOR INSERT: WITH CHECK (id = auth.uid()) — role is set by admin via app_metadata, not here. FOR UPDATE: USING (id = auth.uid()) — cannot update role column (enforce this at app layer).

2. `restaurants` — id (uuid pk default gen_random_uuid()), owner_id (uuid references auth.users.id not null), name (text not null), slug (text unique not null), address (text), lat (float), lng (float), stripe_account_id (text), accepting_orders (bool default false), logo_path (text), created_at (timestamptz default now()).
   RLS: enable. FOR SELECT TO anon, authenticated USING (accepting_orders = true). FOR INSERT TO authenticated WITH CHECK (has_role('restaurant_owner') AND owner_id = auth.uid()). FOR UPDATE TO authenticated USING (has_role('restaurant_owner') AND owner_id = auth.uid()). Admin: USING (has_role('admin')).

3. `menu_items` — id (uuid pk default gen_random_uuid()), restaurant_id (uuid references restaurants.id not null), name (text not null), description (text), price_cents (int not null), photo_path (text), available (bool default true), category (text), created_at (timestamptz default now()).
   RLS: enable. FOR SELECT TO anon, authenticated USING (available = true). Restaurant owner write: WITH CHECK (EXISTS (SELECT 1 FROM restaurants r WHERE r.id = menu_items.restaurant_id AND r.owner_id = auth.uid())).

4. `orders` — id (uuid pk default gen_random_uuid()), customer_id (uuid references auth.users.id not null), restaurant_id (uuid references restaurants.id not null), driver_id (uuid references auth.users.id nullable), status (text not null default 'placed' check (status in ('placed','preparing','ready','en_route','delivered','cancelled'))), subtotal_cents (int not null), fee_cents (int not null default 0), total_cents (int not null), delivery_address (text not null), delivery_lat (float), delivery_lng (float), stripe_payment_intent_id (text unique), placed_at (timestamptz default now()).
   RLS: enable. Customer reads own: FOR SELECT TO authenticated USING (customer_id = auth.uid()). Restaurant reads its own orders: FOR SELECT TO authenticated USING (EXISTS (SELECT 1 FROM restaurants r WHERE r.id = orders.restaurant_id AND r.owner_id = auth.uid())). Driver reads assigned or ready-unassigned: FOR SELECT TO authenticated USING (driver_id = auth.uid() OR (status = 'ready' AND driver_id IS NULL AND has_role('driver'))). Admin: USING (has_role('admin')).
   No direct INSERT for customers — orders created via checkout edge function (service-role).

5. `order_items` — id (uuid pk default gen_random_uuid()), order_id (uuid references orders.id not null), menu_item_id (uuid references menu_items.id not null), qty (int not null check (qty > 0)), unit_price_cents (int not null).
   RLS: enable. Inherit via order — SELECT USING (EXISTS (SELECT 1 FROM orders o WHERE o.id = order_items.order_id AND (o.customer_id = auth.uid() OR EXISTS (SELECT 1 FROM restaurants r WHERE r.id = o.restaurant_id AND r.owner_id = auth.uid()) OR o.driver_id = auth.uid()))).

6. `drivers` — id (uuid references auth.users.id on delete cascade, pk), vehicle_type (text), online (bool default false), current_lat (float), current_lng (float), last_ping (timestamptz default now()).
   RLS: enable. Driver writes own: USING (id = auth.uid()). Restaurant reads drivers assigned to their orders: FOR SELECT TO authenticated USING (EXISTS (SELECT 1 FROM orders o WHERE o.driver_id = drivers.id AND EXISTS (SELECT 1 FROM restaurants r WHERE r.id = o.restaurant_id AND r.owner_id = auth.uid()))).

## Three distinct layouts

`src/layouts/CustomerLayout.tsx` — mobile-first, bottom tab nav: Home / Orders / Cart / Profile. Clean, food-app feel. Orange-600 primary. Include CartDrawer (Sheet from bottom).

`src/layouts/RestaurantLayout.tsx` — sidebar: Orders / Menu / Settings. Desktop-first. Show 'Accepting orders' toggle at top of sidebar that calls supabase.from('restaurants').update({ accepting_orders: !current }) for the owner's restaurant.

`src/layouts/DriverLayout.tsx` — single-screen layout, mostly the active order card at top with status. No sidebar. Large map area placeholder (div with bg-gray-100 and text 'Map loads here').

All three layouts use `<RoleGuard role={required_role}>` that reads app_metadata.role from the Supabase session and redirects to / if the role doesn't match.

## Pages (add to src/App.tsx with role-based routing)

Customer routes: / (Browse.tsx — restaurant grid with earthdistance ordering), /restaurant/[slug] (RestaurantDetail.tsx — menu with add-to-cart), /cart (Cart.tsx — cart items + checkout button), /checkout (Checkout.tsx — delivery address + calls checkout edge function), /orders (OrderHistory.tsx — past orders), /orders/[id] (OrderDetail.tsx with LiveOrderTracker component).

Restaurant routes: /r/orders (OrderQueue.tsx — live list of placed/preparing orders with status update buttons), /r/menu (MenuEditor.tsx — menu item CRUD with photo upload), /r/settings (RestaurantSettings.tsx — name, address, Stripe Connect status).

Driver routes: /d/active (ActiveOrder.tsx — current assigned order with customer address + status update buttons: En Route / Delivered), /d/history (DeliveryHistory.tsx).

## Key components

`src/components/CartDrawer.tsx` — Sheet from bottom with cart items, qty controls, subtotal, checkout CTA.

`src/components/MenuItemRow.tsx` — item name, description, price, photo thumbnail, Add button.

`src/components/OrderStatusBadge.tsx` — color-coded badge: placed=yellow, preparing=orange, ready=blue, en_route=purple, delivered=green, cancelled=red.

`src/components/LiveOrderTracker.tsx` — simple step indicator showing all status stages with the current one highlighted. Subscribes to Supabase Realtime on orders filtered by the order id.

`src/components/RoleGuard.tsx` — reads auth session and app_metadata.role, shows loading spinner while checking, redirects to / if role does not match.

## Edge functions

`supabase/functions/get-nearby-restaurants/index.ts` — GET with query params lat, lng, radius_km (default 5). Uses earthdistance: SELECT *, (earth_distance(ll_to_earth(lat, lng), ll_to_earth($1, $2)) / 1000) AS dist_km FROM restaurants WHERE accepting_orders = true AND earth_distance(ll_to_earth(lat, lng), ll_to_earth($1, $2)) < $3 * 1000 ORDER BY dist_km LIMIT 20. Return { restaurants: [...] }.

`supabase/functions/checkout/index.ts` — POST JSON { restaurant_id, cart_items: [{menu_item_id, qty}], delivery_address, delivery_lat, delivery_lng, customer_id }. Steps: (1) CORS preflight. (2) Verify cart_items exist and are available. (3) Calculate subtotal. (4) Fetch restaurant.stripe_account_id. (5) Create Stripe PaymentIntent with application_fee_amount = subtotal * 0.15 (15% platform fee) and transfer_data: { destination: restaurant.stripe_account_id }. (6) Return { client_secret } to client for Stripe Elements. Do NOT create the order row here — create it in the webhook after payment confirmation.

`supabase/functions/stripe-webhook/index.ts` — CRITICAL: (1) const rawBody = await req.text(); — this MUST be the first line, before any JSON.parse. (2) CORS preflight. (3) const sig = req.headers.get('stripe-signature'); (4) const event = await stripe.webhooks.constructEventAsync(rawBody, sig, Deno.env.get('STRIPE_WEBHOOK_SECRET')); — use constructEventAsync, NOT constructEvent. (5) On event.type === 'payment_intent.succeeded': INSERT INTO orders (..., stripe_payment_intent_id) ON CONFLICT (stripe_payment_intent_id) DO NOTHING (idempotent). (6) INSERT INTO order_items for each cart item. (7) Send confirmation email via Resend. (8) Return 200 immediately.

`supabase/functions/dispatch-order/index.ts` — called internally when orders.status flips to 'ready'. Finds online drivers within 3km using earthdistance, picks the one with the lowest count of en_route orders, sets orders.driver_id. Return 200.

## Styling

Orange-600 primary. Rounded-2xl cards with food photography placeholder. Customer app: mobile-first with large touch targets. Restaurant app: desktop table-first. Driver app: single-screen, minimal. Use shadcn Drawer, Sheet, Badge, Card, Skeleton, Toast throughout.

Generate migration (with has_role function) first, then three layouts, then pages in role order (customer first), then edge functions.