Build a Two-Sided Marketplace in Lovable

Replace the stripe-webhook Edge Function stub with a working implementation. This is the most important follow-up — do not process real money without it.

In supabase/functions/stripe-webhook/index.ts:

1. Read the raw body FIRST, before any other processing:
   const body = await req.text();
   const signature = req.headers.get('Stripe-Signature') ?? '';

2. Verify using the ASYNC variant (Deno requires this):
   const event = await stripe.webhooks.constructEventAsync(
     body,
     signature,
     Deno.env.get('STRIPE_WEBHOOK_SECRET') ?? ''
   );
   Do NOT call req.json() — that mutates the body stream and breaks verification.

3. Handle checkout.session.completed:
   - Read event.data.object.metadata.listing_id and metadata.buyer_id
   - INSERT into orders: { buyer_id, listing_id, amount_cents, platform_fee_cents, seller_amount_cents, status: 'paid', stripe_payment_intent_id }
   - UPDATE listings SET status='sold' WHERE id=listing_id
   - INSERT into payouts: { seller_id, amount_cents: seller_amount_cents, status: 'pending' }
   - Send a Resend confirmation email to buyer if RESEND_API_KEY is set

4. Return 200 for all recognized events; return 400 only on signature failure.

Register the deployed Edge Function URL in Stripe Dashboard → Developers → Webhooks → Add endpoint. Listen for: checkout.session.completed.

Audit and tighten every RLS policy before going public.

1. Sign out completely and open an incognito browser window. Go to /search — you should see only active listings (status='active' AND is_deleted=false). If you see draft or removed listings, the policy is broken.

2. Paste in Build mode: 'List every RLS policy on listings, listing_images, orders, payouts, and profiles. For each policy, show the USING clause and WITH CHECK clause. Confirm: (a) listings SELECT allows anon role with USING status=''active'' AND is_deleted=false — no auth.uid() check, (b) listing_images SELECT allows anon only for images whose parent listing is active, (c) orders SELECT never allows anon, (d) payouts SELECT never allows anon.'

3. Confirm the Storage bucket 'listing-images' has a policy allowing public read. In Cloud tab → Database → SQL Editor: SELECT * FROM storage.policies WHERE bucket_id='listing-images'; — there should be at least one SELECT policy for the anon role.

4. If any anon-accessible policy requires auth.uid() IS NOT NULL, drop it and recreate without that check.

Replace the current ilike search with Postgres full-text search for better results on the /search page.

1. Add a generated tsvector column to listings: ALTER TABLE listings ADD COLUMN search_vector tsvector GENERATED ALWAYS AS (to_tsvector('english', coalesce(title,'') || ' ' || coalesce(description,''))) STORED;

2. Add a GIN index: CREATE INDEX idx_listings_search ON listings USING GIN(search_vector);

3. Create an RPC function search_listings(query text, category text, min_price int, max_price int, page_size int, page_offset int) that returns a table of listings with rank score:
   SELECT *, ts_rank(search_vector, websearch_to_tsquery('english', query)) as rank
   FROM listings
   WHERE status='active' AND is_deleted=false
   AND (query IS NULL OR search_vector @@ websearch_to_tsquery('english', query))
   AND (category IS NULL OR category = $2)
   AND (min_price IS NULL OR price_cents >= min_price)
   AND (max_price IS NULL OR price_cents <= max_price)
   ORDER BY rank DESC, created_at DESC
   LIMIT page_size OFFSET page_offset;

4. Update the /search page to call supabase.rpc('search_listings', {...params}) instead of the current .from('listings').ilike() call. Pass SearchBar's debounced query value.

Add a post-purchase review system so buyers can rate listings after delivery.

1. Create a reviews table: id (uuid pk), order_id (uuid unique references orders(id)), listing_id (uuid references listings(id)), reviewer_id (uuid references auth.users(id)), rating (int check(rating between 1 and 5)), body (text), created_at (timestamptz). RLS: INSERT only for authenticated users WHERE reviewer_id=auth.uid() AND EXISTS(SELECT 1 FROM orders WHERE id=order_id AND buyer_id=auth.uid() AND status='delivered'); SELECT public-read.

2. Add two computed columns to listings: avg_rating (numeric) and review_count (int) — either as materialized view or computed via a Postgres VIEW reviews_summary(listing_id, avg_rating, review_count).

3. On ListingCard, show a star rating badge (shadcn Badge) with avg_rating and review_count if review_count > 0.

4. On /listings/:id detail page, below the purchase section, show a Reviews section listing all reviews with star rating, reviewer name (from profiles_public view), body text, and relative date. At the bottom, if the buyer has a delivered order for this listing and hasn't reviewed yet, show a 'Leave a review' form with 5-star picker and textarea.

Add listing flagging so buyers can report inappropriate content, and an admin UI to action the reports.

1. Create a flags table: id (uuid pk), listing_id (uuid references listings(id)), reporter_id (uuid references auth.users(id)), reason (text), created_at (timestamptz). RLS: INSERT for authenticated users, SELECT for admin only. UNIQUE(listing_id, reporter_id) to prevent duplicate reports from the same buyer.

2. On /listings/:id, add a 'Report listing' button (visible to signed-in buyers who are not the seller). Clicking opens a Dialog with a reason dropdown (Prohibited item / Counterfeit / Spam / Misleading description) and a Submit button. Insert into flags.

3. Create /admin/moderation page: SELECT listings with JOIN to flags COUNT, ordered by flag count DESC. For each flagged listing, show: title, seller name, flag count, flag reasons list, listing preview image, and two action buttons: 'Remove listing' (sets is_deleted=true, sends Resend email to seller) and 'Dismiss flags' (deletes all flags for that listing).

4. The Remove action should call the admin Edge Function or SQL directly via the service-role key — add it in a new Edge Function admin-remove-listing that verifies JWT app_metadata.role='admin' before executing.

Fix the case where a seller completes Stripe Connect KYC but still sees payouts_enabled=false on their dashboard.

Stripe does not push a redirect parameter telling your app that KYC is complete — you must poll the Account status on each dashboard load.

1. Create an Edge Function refresh-connect-status: accept GET with no body, read the caller's JWT, get profiles.stripe_account_id for that user, call stripe.accounts.retrieve(stripe_account_id), check account.payouts_enabled and account.charges_enabled, UPDATE profiles SET payouts_enabled=true WHERE id=caller_uid if both are true, return { payouts_enabled, charges_enabled }.

2. On SellerDashboard mount (useEffect), if profiles.stripe_account_id is not null AND payouts_enabled is false, call supabase.functions.invoke('refresh-connect-status'). If the response shows payouts_enabled=true, refetch the profiles row.

3. Show a status banner at the top of SellerDashboard: 'Verifying your payout account...' while the function is in flight; 'Payouts active' with a green check when payouts_enabled=true; 'Complete your payout setup' with a ConnectOnboardingButton if still false after checking.