Cursor vs Lovable

Build a dashboard page in this codebase using the existing component library and styling approach; check for Tailwind, CSS modules, or styled-components before writing anything. Lay out a header with a date range picker, four stat cards showing {{resource}} metrics with a delta versus the previous period, one line chart, and a recent activity table with client-side sorting. Fetch data through a single typed hook per widget so each region renders independently with its own skeleton state, an error state with a retry button, and an empty state with real copy rather than a blank div. Collapse the grid to one column below 768px. Do not add a charting library if one is already installed. When done, start the dev server, verify there are no console errors, and list the components you added.

Build an analytics dashboard for an app that tracks {{resource}}.

Layout: fixed left sidebar (Overview, {{resource}}, Reports, Settings), a top bar with a date range picker (presets for last 7 days, last 30 days, and custom) and a user menu. Main area on a 12-column grid.

Overview page:
- Four stat cards: total {{resource}}, count added this period, percent change versus the prior period with a signed value, and a fourth card labeled Placeholder that I will define later.
- A line chart of daily counts across the selected range and a bar chart of the top five categories, both using Recharts inside responsive containers with explicit heights.
- A table of the 20 most recent records: sortable columns, a status badge, a row action menu, and pagination beyond 20 rows.

Data: create a Supabase table and seed roughly 90 days of plausible demo rows so every card and chart renders from real queries, not hardcoded arrays. Changing the date range must refetch and update every widget on the page.

States: skeleton loaders while queries run, an empty state with one line of explanation when the range has no data, and an inline retry button on query failure.

Styling: neutral grays with a single accent color, generous whitespace, no gradients. Works at 1280px wide; on mobile the grid collapses to one column and the sidebar becomes a drawer.

Skip auth for now. When finished, list which component reads from which table and column so I can point them at production data later.

Add JWT authentication to the existing API in this repo. Create POST /auth/register and POST /auth/login endpoints that hash passwords with bcrypt or argon2, never plaintext, then issue a short-lived access token (15 minutes) and a refresh token (7 days) stored as an httpOnly, Secure, SameSite=Strict cookie. Add middleware that verifies the access token signature and expiry, attaches the user to the request, and returns 401 with a WWW-Authenticate header on failure rather than 500. Include POST /auth/refresh with refresh token rotation and a revocation check against {{database}}. Read the signing secret from an environment variable and fail fast at startup if it is missing. Cover expired tokens, tampered signatures, and reuse of a rotated refresh token in tests, run them, and list changed files.

Add JWT-based authentication to this app using Supabase Auth, covering the client, the database, and the edge functions.

Flows: email and password signup with a confirmation step, sign in, a magic link option, password reset, and sign out. On signup, insert a row into a profiles table keyed to the new user id.

Route protection: redirect signed-out visitors from any authenticated route to /login with a return-to parameter, and send signed-in users away from /login. Keep the session in the Supabase client so a refresh does not log anyone out, and refresh tokens silently instead of bouncing to login when the access token expires.

Database: enable row level security on every user-owned table and write policies against auth.uid(), leaving no table with policies disabled.

Edge functions: each function reads the Authorization header, verifies the JWT through the Supabase client, and returns 401 with a JSON error body when it is missing or invalid. No function may fall back to the service role for user-scoped reads.

UI states: a loading gate while the session restores so protected pages never flash before redirect, inline errors for wrong credentials, and a resend link on the confirmation notice.

Acceptance: an expired session on a protected page recovers without a visible logout, calling an edge function with no header returns 401 not 500, password reset works end to end from the email link, and querying another user's rows from the browser console returns nothing.