CREATE TABLE public.defender_incidents (
  id            uuid DEFAULT gen_random_uuid() PRIMARY KEY,
  incident_id   text UNIQUE NOT NULL,
  title         text,
  severity      text,
  status        text,
  assigned_to   text,
  created_time  timestamptz,
  updated_time  timestamptz,
  raw           jsonb,
  synced_at     timestamptz DEFAULT now()
);

-- Enable RLS immediately
ALTER TABLE public.defender_incidents ENABLE ROW LEVEL SECURITY;

-- Allow read-only access for authenticated admin users
CREATE POLICY "Admins can view incidents"
  ON public.defender_incidents FOR SELECT
  USING (auth.role() = 'authenticated');

// supabase/functions/sync-defender/index.ts
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

const supabase = createClient(
  Deno.env.get('SUPABASE_URL')!,
  Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!  // ← server-side only
)

Deno.serve(async (req) => {
  // Verify Defender webhook secret
  const secret = req.headers.get('x-webhook-secret')
  if (secret !== Deno.env.get('DEFENDER_WEBHOOK_SECRET')) {
    return new Response('Unauthorized', { status: 401 })
  }

  const incidents = await req.json()

  const rows = incidents.value.map((inc: any) => ({
    incident_id:  inc.id,
    title:        inc.displayName,
    severity:     inc.severity,
    status:       inc.status,
    assigned_to:  inc.assignedTo,
    created_time: inc.createdDateTime,
    updated_time: inc.lastUpdateDateTime,
    raw:          inc,
  }))

  const { error } = await supabase
    .from('defender_incidents')
    .upsert(rows, { onConflict: 'incident_id' })

  if (error) return new Response(error.message, { status: 500 })
  return new Response(JSON.stringify({ synced: rows.length }), {
    headers: { 'Content-Type': 'application/json' }
  })
})

supabase functions deploy sync-defender --no-verify-jwt

supabase secrets set \
  SUPABASE_SERVICE_ROLE_KEY=your_service_role_key \
  DEFENDER_WEBHOOK_SECRET=your_random_secret

Endpoint URL:  https://<project-ref>.supabase.co/functions/v1/sync-defender
Custom Header: x-webhook-secret: your_random_secret
Events:        Incident Created, Incident Updated

import { createClient } from '@supabase/supabase-js'

// ✅ Use anon key on the client — NOT the service role key
const supabase = createClient(
  'https://your-project.supabase.co',
  'your-anon-key'  // public, safe for clients
)

// RLS policy controls what this user can see
const { data: incidents } = await supabase
  .from('defender_incidents')
  .select('*')
  .order('created_time', { ascending: false })
  .limit(50)