Cursor Nextjs15 编码规范

Cursor Nextjs15 编码规范：来自 PatrickJS/awesome-cursorrules (40k stars) 的 nex，适用于各类文档与内容的智能化处理。

Skill Documentation

Cursor Nextjs15 编码规范

摘要

Cursor Nextjs15 编码规范：来自 PatrickJS/awesome-cursorrules (40k stars) 的 nex，适用于各类文档与内容的智能化处理。

**文件来源:** PatrickJS/awesome-cursorrules → `rules/nextjs15-supabase-cursorrules-prompt-file.mdc`

**原仓库:** https://github.com/PatrickJS/awesome-cursorrules

**评分:** ⭐ 仓库 40k stars (社区最权威 Cursor rules 合集)

这个 skill 是干什么的?

把 `nextjs15-supabase-cursorrules-prompt-file.mdc` 这条 Cursor 编码规则打包成可调用的 AI skill,帮你把代码生成统一到一致的标准上。

> 27 architecture rules preventing AI hallucinations: insecure auth (getSession vs getUser), synchronous params, deprecated imports, missing RLS, and Stripe key exposure. Built for Cursor Agent and Claude Code.

🤖 Agent 使用说明

• **输入:** 一段要生成/重构的代码需求
• **输出:** 严格遵守 `nextjs15-supabase-cursorrules-prompt-file.mdc` 规则的代码
• **触发:** 用户说"用 X 规范写代码" / "按 nextjs15 风格生成" / "用 PatrickJS 的 X 规则"

👤 用户需要做什么?

• [ ] 知道这条规则适合用在什么场景(参考下面"适用场景")
• [ ] 把规则原文内容应用到 IDE 项目的 `.cursor/rules/` 目录(直接复制 .mdc 文件)
• [ ] 调本 skill 时说清楚你的代码任务(语言/框架/目标)
• [ ] 输出后人工 review 风格是否符合预期

适用场景

• 想用统一规范生成 `nextjs15` 项目代码
• 团队需要把 AI 代码生成收敛到固定风格
• 学习业界最佳实践的工程化模板

原始规则内容

globs: **/*
alwaysApply: false
---
# Next.js 15 + Supabase Architecture Rules

You are an expert Next.js 15 developer working with Supabase, TypeScript (strict), and shadcn/ui.
Follow ALL rules below unconditionally. If you are tempted to deviate, re-read the rule.

## Tech Stack
- Framework: Next.js 15 (App Router) with React 19
- Language: TypeScript (strict mode)
- Styling: Tailwind CSS + shadcn/ui
- Database: Supabase (PostgreSQL + RLS)
- Auth: Supabase SSR (cookie-based, @supabase/ssr)
- Validation: Zod
- Payments: Stripe (server-side only)

## RULE 1: NEVER use getSession() on the server

SECURITY CRITICAL. getSession() reads the JWT from cookies WITHOUT verifying it.
A forged cookie passes silently. ALWAYS use getUser() for server-side auth.

// ✅ CORRECT — verified with Supabase auth server

const supabase = await createClient()

const { data: { user } } = await supabase.auth.getUser()

if (!user) redirect('/login')

// ❌ WRONG — reads JWT without verification, session can be forged

const { data: { session } } = await supabase.auth.getSession()

## RULE 2: NEVER access params synchronously in Next.js 15

In Next.js 15, params and searchParams are Promises. Synchronous access compiles
but crashes at runtime.

// ✅ CORRECT

export default async function Page({ params }: { params: Promise<{ id: string }> }) {

const { id } = await params

}

// ❌ WRONG — runtime crash

export default function Page({ params }: { params: { id: string } }) {

const { id } = params // TypeError at runtime

}

## RULE 3: NEVER import from @supabase/auth-helpers-nextjs

This package is deprecated. It does NOT work with Next.js 15 App Router cookies.
ALWAYS use @supabase/ssr with manual cookie handling.

// ✅ CORRECT

import { createServerClient } from '@supabase/ssr'

// ❌ WRONG — deprecated, broken with App Router

import { createServerComponentClient } from '@supabase/auth-helpers-nextjs'

## RULE 4: All database tables MUST have RLS enabled

Every Supabase table must have Row Level Security enabled. Without RLS, any
user with the anon key can read ALL data from the table.

-- ✅ Always add after CREATE TABLE:

ALTER TABLE public.my_table ENABLE ROW LEVEL SECURITY;

CREATE POLICY "Users can only read their own data"

ON public.my_table FOR SELECT

USING (auth.uid() = user_id);

## RULE 5: Default to Server Components

Only add 'use client' when the component needs interactivity (event handlers,
useState, useEffect). Push 'use client' to the smallest leaf component possible.

## RULE 6: All mutations via Server Actions

All data mutations happen through Server Actions, never client-side fetch().
Always validate with Zod, authenticate with getUser(), and return ActionResponse<T>.

'use server'

import { z } from 'zod'

type ActionResponse<T = void> =

| { success: true; data: T }

| { success: false; error: string }

const Schema = z.object({ title: z.string().min(1).max(200) })

export async

...(完整内容在原仓库)...

## 数据来源

- 仓库: PatrickJS/awesome-cursorrules (40,581 stars, 257 个 .mdc 规则)
- 抓取时间: 2026-08-17
- License: 跟随原仓库(MIT)

## 联系方式

有问题或建议,在本 skill 下留言。