Gemini API × Supabase フルスタックAIアプリ本番開発ガイド

# .env.local
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key-here
GEMINI_API_KEY=YOUR_GEMINI_API_KEY

npm install @supabase/supabase-js @supabase/ssr

// lib/auth.ts
import { createClient } from '@supabase/supabase-js'
 
const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
)
 
export async function signUpUser(email: string, password: string) {
  const { data, error } = await supabase.auth.signUp({
    email,
    password,
    options: {
      emailRedirectTo: `${process.env.NEXT_PUBLIC_APP_URL}/auth/callback`,
    },
  })
 
  if (error) throw new Error(error.message)
  return data
}
 
export async function signInUser(email: string, password: string) {
  const { data, error } = await supabase.auth.signInWithPassword({
    email,
    password,
  })
 
  if (error) throw new Error(error.message)
  return data.session
}

-- profiles テーブル
CREATE TABLE profiles (
  id UUID REFERENCES auth.users(id) ON DELETE CASCADE PRIMARY KEY,
  display_name TEXT,
  avatar_url TEXT,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
-- RLS: ユーザーは自分のプロフィールのみ読み書き可能
ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;
 
CREATE POLICY "Users can view own profile"
  ON profiles FOR SELECT
  USING (auth.uid() = id);
 
CREATE POLICY "Users can update own profile"
  ON profiles FOR UPDATE
  USING (auth.uid() = id);

-- auth.users に新規ユーザーが挿入されたとき、profiles に行を自動作成
CREATE FUNCTION public.handle_new_user()
RETURNS TRIGGER AS $$
BEGIN
  INSERT INTO public.profiles (id, display_name)
  VALUES (new.id, new.email);
  RETURN new;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;
 
CREATE TRIGGER on_auth_user_created
  AFTER INSERT ON auth.users
  FOR EACH ROW EXECUTE FUNCTION public.handle_new_user();

-- pgvector 拡張の有効化
CREATE EXTENSION IF NOT EXISTS vector;
 
-- ベクトル型が利用可能になったことを確認
SELECT * FROM pg_extension WHERE extname = 'vector';

-- documents テーブル
CREATE TABLE documents (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE NOT NULL,
  title TEXT NOT NULL,
  content TEXT NOT NULL,
  source_url TEXT,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
-- document_chunks テーブル（テキスト分割後のチャンク）
CREATE TABLE document_chunks (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  document_id UUID REFERENCES documents(id) ON DELETE CASCADE NOT NULL,
  chunk_index INT NOT NULL,
  content TEXT NOT NULL,
  -- Gemini の embedding-001 モデルは 768 次元
  embedding vector(768),
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
-- セマンティック検索用インデックス
CREATE INDEX ON document_chunks
  USING ivfflat (embedding vector_cosine_ops)
  WITH (lists = 100);
 
-- RLS: ユーザーは自分のドキュメントのみアクセス可能
ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
ALTER TABLE document_chunks ENABLE ROW LEVEL SECURITY;
 
CREATE POLICY "Users can view own documents"
  ON documents FOR SELECT
  USING (auth.uid() = user_id);
 
CREATE POLICY "Users can view own document chunks"
  ON document_chunks FOR SELECT
  USING (
    document_id IN (
      SELECT id FROM documents WHERE user_id = auth.uid()
    )
  );

-- セマンティック検索（クエリベクトルで最上位 5 件を取得）
SELECT
  dc.id,
  dc.content,
  1 - (dc.embedding <=> query_embedding) AS similarity
FROM document_chunks dc
WHERE dc.document_id IN (
  SELECT id FROM documents WHERE user_id = auth.uid()
)
ORDER BY dc.embedding <=> query_embedding
LIMIT 5;

// lib/semantic-search.ts
export async function semanticSearch(
  supabase: SupabaseClient,
  queryEmbedding: number[],
  userId: string,
  limit: number = 5
) {
  const { data, error } = await supabase
    .from('document_chunks')
    .select('id, content, similarity: similarity')
    .filter(
      'document_id',
      'in',
      `(SELECT id FROM documents WHERE user_id = '${userId}')`
    )
    .order('embedding', { ascending: false })
    .limit(limit)
 
  if (error) throw new Error(error.message)
  return data
}

// supabase/functions/embed-document/index.ts
import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
 
const supabaseUrl = Deno.env.get('SUPABASE_URL')!
const supabaseKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
const geminiApiKey = Deno.env.get('GEMINI_API_KEY')!
 
const supabase = createClient(supabaseUrl, supabaseKey)
 
// テキストを単語単位で分割（簡易版）
function chunkText(text: string, maxTokens: number = 500): string[] {
  const words = text.split(/\s+/)
  const chunks: string[] = []
  let currentChunk = ''
 
  for (const word of words) {
    if ((currentChunk + ' ' + word).split(' ').length > maxTokens) {
      chunks.push(currentChunk)
      currentChunk = word
    } else {
      currentChunk += (currentChunk ? ' ' : '') + word
    }
  }
 
  if (currentChunk) chunks.push(currentChunk)
  return chunks
}
 
// Gemini Embedding API を呼び出し
async function generateEmbedding(text: string): Promise<number[]> {
  const response = await fetch(
    'https://generativelanguage.googleapis.com/v1beta/models/embedding-001:embedContent',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-goog-api-key': geminiApiKey,
      },
      body: JSON.stringify({
        model: 'models/embedding-001',
        content: {
          parts: [{ text }],
        },
      }),
    }
  )
 
  if (!response.ok) {
    throw new Error(`Embedding API error: ${response.statusText}`)
  }
 
  const data = await response.json()
  return data.embedding.values
}
 
serve(async (req) => {
  const { documentId, content, userId } = await req.json()
 
  // テキスト分割
  const chunks = chunkText(content, 500)
 
  // 各チャンクの埋め込みを生成して保存
  for (let i = 0; i < chunks.length; i++) {
    const embedding = await generateEmbedding(chunks[i])
 
    const { error } = await supabase.from('document_chunks').insert({
      document_id: documentId,
      chunk_index: i,
      content: chunks[i],
      embedding,
    })
 
    if (error) {
      console.error('Insert error:', error)
      return new Response(`Error: ${error.message}`, { status: 500 })
    }
  }
 
  return new Response(JSON.stringify({ success: true, chunkCount: chunks.length }), {
    headers: { 'Content-Type': 'application/json' },
  })
})

// Edge Function: バッチ処理（例：30秒ごとに実行）
serve(async (req) => {
  // 未処理のドキュメントチャンクを取得
  const { data: pendingChunks } = await supabase
    .from('document_chunks')
    .select('id, content')
    .is('embedding', null)
    .limit(10) // 1回で 10 個処理
 
  for (const chunk of pendingChunks || []) {
    const embedding = await generateEmbedding(chunk.content)
    await supabase
      .from('document_chunks')
      .update({ embedding })
      .eq('id', chunk.id)
  }
 
  return new Response('OK')
})

// supabase/functions/rag-chat/index.ts
import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
 
const supabaseUrl = Deno.env.get('SUPABASE_URL')!
const supabaseKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
const geminiApiKey = Deno.env.get('GEMINI_API_KEY')!
 
const supabase = createClient(supabaseUrl, supabaseKey)
 
async function generateEmbedding(text: string): Promise<number[]> {
  const response = await fetch(
    'https://generativelanguage.googleapis.com/v1beta/models/embedding-001:embedContent',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-goog-api-key': geminiApiKey,
      },
      body: JSON.stringify({
        model: 'models/embedding-001',
        content: { parts: [{ text }] },
      }),
    }
  )
  const data = await response.json()
  return data.embedding.values
}
 
async function ragChat(
  userId: string,
  question: string,
  conversationId: string
): Promise<string> {
  // 1. ユーザーの質問を埋め込み化
  const questionEmbedding = await generateEmbedding(question)
 
  // 2. セマンティック検索で関連ドキュメントを取得
  // （注：Supabase RLS 対応のため、RPC または Service Role で実行）
  const { data: relevantChunks } = await supabase.rpc('search_documents', {
    query_embedding: questionEmbedding,
    user_id: userId,
    match_limit: 5,
  })
 
  // 3. コンテキストを生成
  const context = (relevantChunks || [])
    .map((chunk: any) => chunk.content)
    .join('\n\n')
 
  // 4. Gemini API に RAG プロンプトを送信
  const response = await fetch(
    'https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:generateContent',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-goog-api-key': geminiApiKey,
      },
      body: JSON.stringify({
        contents: [
          {
            parts: [
              {
                text: `以下のコンテキストを使用して、ユーザーの質問に答えてください。
 
コンテキスト：
${context}
 
質問：${question}
 
回答：`,
              },
            ],
          },
        ],
        generationConfig: {
          temperature: 0.7,
          maxOutputTokens: 1024,
        },
      }),
    }
  )
 
  const result = await response.json()
  return result.candidates[0].content.parts[0].text
}
 
serve(async (req) => {
  if (req.method !== 'POST') {
    return new Response('Method not allowed', { status: 405 })
  }
 
  const { userId, question, conversationId } = await req.json()
 
  try {
    const answer = await ragChat(userId, question, conversationId)
 
    // 会話履歴を保存
    await supabase.from('messages').insert({
      conversation_id: conversationId,
      user_id: userId,
      role: 'user',
      content: question,
    })
 
    await supabase.from('messages').insert({
      conversation_id: conversationId,
      user_id: userId,
      role: 'assistant',
      content: answer,
    })
 
    return new Response(JSON.stringify({ answer }), {
      headers: { 'Content-Type': 'application/json' },
    })
  } catch (error: any) {
    return new Response(JSON.stringify({ error: error.message }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' },
    })
  }
})

-- RPC 関数: セマンティック検索
CREATE OR REPLACE FUNCTION search_documents(
  query_embedding vector,
  user_id uuid,
  match_limit int DEFAULT 5
)
RETURNS TABLE (
  id uuid,
  content text,
  similarity float8
) AS $$
BEGIN
  RETURN QUERY
  SELECT
    dc.id,
    dc.content,
    1 - (dc.embedding <=> query_embedding)::float8 AS similarity
  FROM document_chunks dc
  WHERE dc.document_id IN (
    SELECT id FROM documents WHERE documents.user_id = search_documents.user_id
  )
  ORDER BY dc.embedding <=> query_embedding
  LIMIT match_limit;
END;
$$ LANGUAGE plpgsql;

// lib/realtime-chat.ts
import { useEffect, useState } from 'react'
import { supabase } from '@/lib/supabase'
 
export function useRealtimeMessages(conversationId: string) {
  const [messages, setMessages] = useState<any[]>([])
 
  useEffect(() => {
    // 初期メッセージを取得
    const fetchMessages = async () => {
      const { data } = await supabase
        .from('messages')
        .select('*')
        .eq('conversation_id', conversationId)
        .order('created_at', { ascending: true })
 
      setMessages(data || [])
    }
 
    fetchMessages()
 
    // Realtime リッスナー登録
    const channel = supabase
      .channel(`messages:${conversationId}`)
      .on(
        'postgres_changes',
        {
          event: 'INSERT',
          schema: 'public',
          table: 'messages',
          filter: `conversation_id=eq.${conversationId}`,
        },
        (payload) => {
          setMessages((prev) => [...prev, payload.new])
        }
      )
      .subscribe()
 
    return () => {
      supabase.removeChannel(channel)
    }
  }, [conversationId])
 
  return messages
}

// lib/gemini-stream.ts
export async function* streamGeminiResponse(
  prompt: string,
  apiKey: string
) {
  const response = await fetch(
    'https://generativelanguage.googleapis.com/v1beta/models/gemini-1.5-flash:streamGenerateContent?alt=sse',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-goog-api-key': apiKey,
      },
      body: JSON.stringify({
        contents: [{ parts: [{ text: prompt }] }],
        generationConfig: {
          temperature: 0.7,
          maxOutputTokens: 1024,
        },
      }),
    }
  )
 
  // Server-Sent Events を解析
  const reader = response.body!.getReader()
  const decoder = new TextDecoder()
 
  while (true) {
    const { done, value } = await reader.read()
    if (done) break
 
    const chunk = decoder.decode(value)
    const lines = chunk.split('\n')
 
    for (const line of lines) {
      if (line.startsWith('data: ')) {
        const json = JSON.parse(line.slice(6))
        const text = json.candidates?.[0]?.content?.parts?.[0]?.text || ''
        if (text) yield text
      }
    }
  }
}

// components/ChatStream.tsx
'use client'
 
import { useState } from 'react'
import { streamGeminiResponse } from '@/lib/gemini-stream'
 
export function ChatStream() {
  const [response, setResponse] = useState('')
 
  const handleSubmit = async (prompt: string) => {
    setResponse('')
 
    for await (const chunk of streamGeminiResponse(
      prompt,
      process.env.NEXT_PUBLIC_GEMINI_API_KEY!
    )) {
      setResponse((prev) => prev + chunk)
    }
  }
 
  return (
    <div>
      <div className="mb-4 whitespace-pre-wrap">{response}</div>
      <button onClick={() => handleSubmit('こんにちは')}>
        ストリーミング開始
      </button>
    </div>
  )
}

-- conversations テーブル
CREATE TABLE conversations (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE NOT NULL,
  title TEXT,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
ALTER TABLE conversations ENABLE ROW LEVEL SECURITY;
 
CREATE POLICY "Users can view own conversations"
  ON conversations FOR SELECT
  USING (auth.uid() = user_id);
 
CREATE POLICY "Users can create conversations"
  ON conversations FOR INSERT
  WITH CHECK (auth.uid() = user_id);
 
CREATE POLICY "Users can update own conversations"
  ON conversations FOR UPDATE
  USING (auth.uid() = user_id);
 
CREATE POLICY "Users can delete own conversations"
  ON conversations FOR DELETE
  USING (auth.uid() = user_id);
 
-- messages テーブル
CREATE TABLE messages (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  conversation_id UUID REFERENCES conversations(id) ON DELETE CASCADE NOT NULL,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE NOT NULL,
  role TEXT NOT NULL CHECK (role IN ('user', 'assistant')),
  content TEXT NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
ALTER TABLE messages ENABLE ROW LEVEL SECURITY;
 
CREATE POLICY "Users can view messages in own conversations"
  ON messages FOR SELECT
  USING (
    conversation_id IN (
      SELECT id FROM conversations WHERE user_id = auth.uid()
    )
  );
 
CREATE POLICY "Users can insert messages in own conversations"
  ON messages FOR INSERT
  WITH CHECK (
    user_id = auth.uid()
    AND conversation_id IN (
      SELECT id FROM conversations WHERE user_id = auth.uid()
    )
  );

// supabase/functions/secure-rag-chat/index.ts
import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
import * as jose from 'https://deno.land/x/jose@v4.14.1/index.ts'
 
const supabaseUrl = Deno.env.get('SUPABASE_URL')!
const supabaseKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
const jwtSecret = Deno.env.get('SUPABASE_JWT_SECRET')!
 
const supabase = createClient(supabaseUrl, supabaseKey)
 
async function verifyToken(token: string) {
  try {
    const secret = new TextEncoder().encode(jwtSecret)
    const verified = await jose.jwtVerify(token, secret)
    return verified.payload.sub // user_id
  } catch (error) {
    throw new Error('Invalid token')
  }
}
 
serve(async (req) => {
  const authHeader = req.headers.get('Authorization')
  if (!authHeader) {
    return new Response('Unauthorized', { status: 401 })
  }
 
  const token = authHeader.replace('Bearer ', '')
  const userId = await verifyToken(token)
 
  // リクエストボディを解析
  const { conversationId, question } = await req.json()
 
  // conversations テーブルでユーザーが所有しているか確認
  const { data: conversation } = await supabase
    .from('conversations')
    .select('id')
    .eq('id', conversationId)
    .eq('user_id', userId)
    .single()
 
  if (!conversation) {
    return new Response('Forbidden', { status: 403 })
  }
 
  // ここで RAG 処理を実行...
  // （省略）
 
  return new Response(JSON.stringify({ success: true }), {
    headers: { 'Content-Type': 'application/json' },
  })
})

// lib/cache.ts
import { createClient } from '@supabase/supabase-js'
 
const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!
)
 
export async function getOrCreateEmbedding(
  text: string,
  geminiApiKey: string
): Promise<number[]> {
  // キャッシュ確認
  const { data: cached } = await supabase
    .from('embedding_cache')
    .select('embedding')
    .eq('text_hash', hashText(text))
    .single()
 
  if (cached) {
    return cached.embedding
  }
 
  // 新規生成
  const embedding = await generateEmbedding(text, geminiApiKey)
 
  // キャッシュに保存
  await supabase.from('embedding_cache').insert({
    text_hash: hashText(text),
    text,
    embedding,
  })
 
  return embedding
}
 
function hashText(text: string): string {
  // SHA-256 ハッシュを計算
  return Array.from(
    new Uint8Array(
      await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text))
    )
  )
    .map((b) => b.toString(16).padStart(2, '0'))
    .join('')
}

CREATE TABLE embedding_cache (
  text_hash TEXT PRIMARY KEY,
  text TEXT NOT NULL,
  embedding vector(768) NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  access_count INT DEFAULT 1,
  last_accessed TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
-- 定期的に古いキャッシュを削除
CREATE OR REPLACE FUNCTION cleanup_old_cache()
RETURNS void AS $$
BEGIN
  DELETE FROM embedding_cache
  WHERE last_accessed < NOW() - INTERVAL '30 days'
    AND access_count < 5;
END;
$$ LANGUAGE plpgsql;

-- HNSW インデックス（IVFFLAT よりも高速・精度が高い）
CREATE INDEX ON document_chunks
  USING hnsw (embedding vector_cosine_ops)
  WITH (m = 16, ef_construction = 200);
 
-- テーブル統計を更新
ANALYZE document_chunks;

// lib/db-pool.ts
import { createClient } from '@supabase/supabase-js'
 
// シングルトン接続（複数回作成を避ける）
let supabaseClient: any = null
 
export function getSupabaseClient() {
  if (!supabaseClient) {
    supabaseClient = createClient(
      Deno.env.get('SUPABASE_URL')!,
      Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!
    )
  }
  return supabaseClient
}

-- 最も遅いクエリを取得
SELECT
  query,
  calls,
  mean_exec_time,
  max_exec_time
FROM pg_stat_statements
ORDER BY mean_exec_time DESC
LIMIT 10;

// 複数テキストの埋め込みをバッチで生成
async function batchGenerateEmbeddings(texts: string[]) {
  const requests = texts.map((text) => ({
    model: 'models/embedding-001',
    content: { parts: [{ text }] },
  }))
 
  const response = await fetch(
    'https://generativelanguage.googleapis.com/v1beta/models/embedding-batch:batchEmbedContent',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-goog-api-key': Deno.env.get('GEMINI_API_KEY')!,
      },
      body: JSON.stringify({ requests }),
    }
  )
 
  const result = await response.json()
  return result.embeddings
}

async function callGeminiWithRetry(
  url: string,
  options: RequestInit,
  maxRetries: number = 5
): Promise<Response> {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    const response = await fetch(url, options)
 
    if (response.status === 429) {
      // Too Many Requests
      const delay = Math.pow(2, attempt) * 1000
      console.log(`Rate limited. Retrying in ${delay}ms...`)
      await new Promise((resolve) => setTimeout(resolve, delay))
      continue
    }
 
    return response
  }
 
  throw new Error('Max retries exceeded')
}

-- api_usage テーブル
CREATE TABLE api_usage (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
  api_type TEXT NOT NULL CHECK (api_type IN ('embedding', 'generation', 'chat')),
  tokens_used INT NOT NULL,
  cost DECIMAL(10, 6) NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);
 
-- 月次の集計ビュー
CREATE VIEW monthly_api_usage AS
SELECT
  user_id,
  DATE_TRUNC('month', created_at) AS month,
  api_type,
  SUM(tokens_used) AS total_tokens,
  SUM(cost) AS total_cost
FROM api_usage
GROUP BY user_id, DATE_TRUNC('month', created_at), api_type;

// lib/usage.ts
export async function getMonthlyUsage(userId: string) {
  const { data } = await supabase
    .from('monthly_api_usage')
    .select('*')
    .eq('user_id', userId)
    .eq('month', new Date().toISOString().slice(0, 7))
 
  return data || []
}

serve(async (req) => {
  try {
    // 処理...
  } catch (error: any) {
    // エラーをロギングテーブルに記録
    await supabase.from('function_logs').insert({
      function_name: 'rag-chat',
      error_message: error.message,
      error_stack: error.stack,
      created_at: new Date(),
    })
 
    // アラートを送信（メール、Slack など）
    // await notifyError(error)
 
    return new Response(JSON.stringify({ error: error.message }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' },
    })
  }
})

-- IVFFlat（件数増加で lists の再調整が必要）から
-- HNSW（件数非依存・再現率が安定）へ張り替える
DROP INDEX IF EXISTS documents_embedding_idx;
 
CREATE INDEX documents_embedding_idx
  ON documents
  USING hnsw (embedding vector_cosine_ops)
  WITH (m = 16, ef_construction = 64);
 
-- 検索時の精度/速度はセッション単位で調整できる
SET hnsw.ef_search = 40;  -- 既定 40。再現率を上げたいときだけ 80〜100 に

// ❌ これは RLS を素通りする — 多テナントでは事故のもと
const admin = createClient(SUPABASE_URL, SERVICE_ROLE_KEY)
 
// ✅ リクエストの Authorization ヘッダを引き継ぐ
//    → RLS がそのユーザーの行だけに自動で絞り込む
const userClient = createClient(SUPABASE_URL, ANON_KEY, {
  global: { headers: { Authorization: req.headers.get('Authorization')! } },
})
 
const { data: { user } } = await userClient.auth.getUser()
if (!user) {
  return new Response('Unauthorized', { status: 401 })
}
// 以降の userClient での読み書きは RLS によりこのユーザーに限定される

// 同時実行を絞りつつ 429 を指数バックオフで吸収する
async function embedWithRetry(text: string, attempt = 0): Promise<number[]> {
  try {
    const res = await ai.models.embedContent({
      model: 'text-embedding-004',
      contents: text,
    })
    return res.embeddings[0].values
  } catch (e: any) {
    if (e.status === 429 && attempt < 5) {
      const waitMs = Math.min(2 ** attempt * 500, 16000) + Math.random() * 300
      await new Promise((r) => setTimeout(r, waitMs))
      return embedWithRetry(text, attempt + 1)
    }
    throw e
  }
}

// nuxt.config.ts
export default defineNuxtConfig({
  runtimeConfig: {
    // サーバー専用 — クライアントには出ない
    geminiApiKey: process.env.GEMINI_API_KEY,
    supabaseServiceRole: process.env.SUPABASE_SERVICE_ROLE_KEY,
    public: {
      // ここに置いたものはクライアントに露出する
      supabaseUrl: process.env.SUPABASE_URL,
      supabaseAnonKey: process.env.SUPABASE_ANON_KEY, // anon は公開前提なので可
    },
  },
})

// server/api/chat.post.ts
export default defineEventHandler(async (event) => {
  const config = useRuntimeConfig()
  const auth = getHeader(event, 'authorization')
  if (!auth) {
    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
  }
 
  // Edge Function 側へユーザーの JWT をそのまま引き継ぐ → RLS が本人の行だけに絞る
  const upstream = await fetch(`${config.public.supabaseUrl}/functions/v1/rag-chat`, {
    method: 'POST',
    headers: {
      Authorization: auth, // ブラウザから来た JWT を転送
      'Content-Type': 'application/json',
    },
    body: JSON.stringify(await readBody(event)),
  })
 
  // ストリームをためずにそのまま下流へ返す（次項）
  return sendStream(event, upstream.body!)
})