[gellosparkles]

Summary

• USC-only sign-up: new migration 20261103000000_usc_signup_gate.sql adds public.hook_before_user_created, a Supabase Auth "before user created" hook. It rejects any new account whose email isn't @usc.edu (403, "Sign up with your @usc.edu email."). Because it runs inside Supabase, it applies even to calls that skip the app. Existing accounts are unaffected. The hook is enabled for local Supabase in config.toml.
• Security headers on every route via next.config.ts:
  • CSP frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'
  • X-Content-Type-Options: nosniff
  • Referrer-Policy
  • Permissions-Policy
  • HSTS
  • No script-src restriction, because a nonce-based CSP would make every page dynamic.
• Schedule cache: 30s instead of the minutes preset (5 min), so event edits show up quickly. The custom profile keeps / partially prerendered; the seconds preset would turn it into a dynamic hole.
• People search limit: 200 → 1000, so the header counts are exact for the expected roughly 300 hackers.
• CI (.github/workflows/ci.yml): runs lint, build, tsc --noEmit and npm test --if-present, with placeholder Supabase env.

Does not touch the files changed in #4 (redirect and avatar validation, OTP sign-in, test script).

After merge (shared Supabase project)

1. npx supabase migration list, then npx supabase db push
2. Dashboard → Authentication → Hooks → Before User Created → Postgres function public.hook_before_user_created

Test plan

• npm run lint, npm run build, npx tsc --noEmit pass locally
• Headers present on /login (curl)
• Home and people pages render on the local dev server
• After db push: sign-up with a non-USC email is rejected; a @usc.edu sign-up succeeds

🤖 Generated with Claude Code