Lovable Prompts for Building Polls and Surveys

Run the following verification in Cloud → Database → SQL Editor to confirm the RLS policies on responses and answers are correct:

```sql
SELECT tablename, policyname, cmd, roles
FROM pg_policies
WHERE tablename IN ('responses', 'answers')
ORDER BY tablename, cmd;
```

You should see:
- responses: INSERT for {anon, authenticated}, SELECT for authenticated only
- answers: INSERT for {anon, authenticated}, SELECT for authenticated only

If SELECT for anon appears on responses or answers, run:
```sql
DROP POLICY IF EXISTS responses_anon_select ON responses;
DROP POLICY IF EXISTS answers_anon_select ON answers;
```

Then verify in an incognito browser using the browser console:
```javascript
const { data, error } = await supabase.from('responses').select();
console.log(data, error);
```

The result must be 0 rows returned (or a Postgres RLS error). If data contains rows, the SELECT policy for anon is still active. Drop it and re-verify. This test must pass before any public launch — anyone with your Supabase project URL can otherwise read all survey responses.

Upgrade the submit-response edge function to validate required questions and insert atomically:

In supabase/functions/submit-response/index.ts:

```typescript
import { createClient } from 'jsr:@supabase/supabase-js@2';

Deno.serve(async (req) => {
  const corsHeaders = {
    'Access-Control-Allow-Origin': '*',
    'Access-Control-Allow-Headers': 'authorization,content-type',
  };
  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders });

  const supabase = createClient(
    Deno.env.get('SUPABASE_URL')!,
    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!,
  );

  const { survey_id, fingerprint, answers } = await req.json();

  // Validate survey is published
  const { data: survey } = await supabase.from('surveys').select('id,allow_multiple_submissions,require_auth,closes_at').eq('id', survey_id).eq('status', 'published').maybeSingle();
  if (!survey) return new Response(JSON.stringify({ ok: false, reason: 'survey_not_found' }), { status: 404, headers: corsHeaders });
  if (survey.closes_at && new Date(survey.closes_at) < new Date()) return new Response(JSON.stringify({ ok: false, reason: 'survey_closed' }), { status: 410, headers: corsHeaders });

  // Enforce one-response-per-fingerprint when allow_multiple_submissions=false
  if (!survey.allow_multiple_submissions) {
    const { count } = await supabase.from('responses').select('*', { count: 'exact', head: true }).eq('survey_id', survey_id).eq('respondent_fingerprint', fingerprint);
    if ((count ?? 0) > 0) return new Response(JSON.stringify({ ok: false, reason: 'already_submitted' }), { status: 409, headers: corsHeaders });
  }

  // Validate required questions are answered
  const { data: questions } = await supabase.from('questions').select('id,required,type').eq('survey_id', survey_id);
  const answerMap = new Map(answers.map((a: any) => [a.question_id, a]));
  for (const q of (questions ?? [])) {
    if (!q.required) continue;
    const a = answerMap.get(q.id);
    const hasValue = a && (a.value_text || a.value_int != null || a.value_choice || (a.value_choices && a.value_choices.length > 0));
    if (!hasValue) return new Response(JSON.stringify({ ok: false, reason: 'missing_required', question_id: q.id }), { status: 422, headers: corsHeaders });
  }

  // Insert response + answers (not truly atomic without a transaction, but service-role insert is fast)
  const { data: response } = await supabase.from('responses').insert({ survey_id, respondent_fingerprint: fingerprint }).select('id').single();
  await supabase.from('answers').insert(answers.map((a: any) => ({ ...a, response_id: response.id })));

  return new Response(JSON.stringify({ ok: true, response_id: response.id }), { headers: corsHeaders });
});
```

This function uses the service-role key so it bypasses RLS and can insert on behalf of anon users. The RLS on the client-side tables still applies to any direct Supabase JS calls from the browser.

Strengthen the one-submission enforcement in Respond.tsx:

1. For signed-in users: fingerprint = auth.uid(). This is the strongest deduplication.

2. For anonymous users: generate a fingerprint as `localStorage.getItem('survey_fp') || crypto.randomUUID()`. Store it: `localStorage.setItem('survey_fp', fp)`. Include IP hash (from the edge function reading the x-forwarded-for header, hashed with SHA-256) as a second signal.

3. Before rendering the survey form, call the survey endpoint to check if this fingerprint has already submitted:
```typescript
const { count } = await supabase.from('responses').select('*', { count: 'exact', head: true }).eq('survey_id', surveyId).eq('respondent_fingerprint', fingerprint);
if (count > 0) navigate('/s/' + slug + '/thanks?already=1');
```

4. On the ThankYou page, if `?already=1` is present, show: 'You have already completed this survey.'

Note: cookie-clear + new IP bypasses this for anonymous users. For high-stakes surveys, set surveys.require_auth=true and enforce via auth.uid() — only authenticated users can submit, making deduplication cryptographically strong.

Enable Supabase Realtime on the responses table so the SurveyResults page updates as new responses arrive — useful for live polls at events or webinars.

1. In Cloud → Database → Realtime, enable Realtime for the 'responses' table (toggle to ON).

2. In SurveyResults.tsx, subscribe to new responses for this survey:
```typescript
useEffect(() => {
  const channel = supabase
    .channel('responses-' + surveyId)
    .on('postgres_changes', {
      event: 'INSERT',
      schema: 'public',
      table: 'responses',
      filter: `survey_id=eq.${surveyId}`,
    }, () => {
      // Re-fetch aggregations
      refetchResults();
    })
    .subscribe();
  return () => supabase.removeChannel(channel);
}, [surveyId]);
```

3. Show a live response counter at the top of the results page: 'X responses (live)'. The counter increments in real time.

4. Add a 'Live mode' toggle that hides individual text answers (to prevent reading individual submissions as they come in) and only shows aggregate counts.

Note: Realtime respects RLS — the subscription only fires for the survey owner because the SELECT policy on responses requires owner_id=auth.uid().

Add an 'AI Suggest Questions' button to the survey editor that generates 5 questions from a topic.

1. Add a 'Suggest questions...' input at the top of the question editor: a text field for the survey topic and a 'Generate 5 questions' button.

2. On click, call the Lovable AI connector (Gemini 3 Flash, the default in the Lovable AI panel) with: 'Create 5 survey questions for the topic: "[topic]". Mix of question types: 2 single_choice, 1 scale_1_5, 1 short_text, 1 multiple_choice. Return JSON array: [{type, question_text, options (for choice questions), required: true}]'

3. Parse the response and insert all 5 questions into the questions table for this survey, positioned after existing questions.

4. Show a loading spinner during the call and a toast 'Added 5 questions — review and edit them.'

5. Handle errors: if the AI call fails or returns invalid JSON, show 'AI suggestion failed. Try rephrasing your topic.'

Do not auto-publish the survey after generating questions — creator must review and click Publish manually.