From a558f5e67e844483b8904aaab91f18813bc7011b Mon Sep 17 00:00:00 2001
From: Jamie Brunton <jamie@jbrunton.co.uk>
Date: Fri, 16 Jan 2026 18:41:21 +0000
Subject: [PATCH] Use RPC function for gift premium to fix RLS issues

---
 apps/admin/src/pages/users/UserDetailPage.tsx | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/apps/admin/src/pages/users/UserDetailPage.tsx b/apps/admin/src/pages/users/UserDetailPage.tsx
index e980cf4..a6c21e5 100644
--- a/apps/admin/src/pages/users/UserDetailPage.tsx
+++ b/apps/admin/src/pages/users/UserDetailPage.tsx
@@ -321,14 +321,10 @@ export function UserDetailPage() {
                 }
                 expiresAt = date.toISOString();
             }
-            const { error } = await auditedSupabase.insert('subscriptions', {
-                user_id: userId,
-                revenuecat_app_user_id: 'admin_grant',
-                product_id: 'admin_premium',
-                status: 'active',
-                store: 'manual',
-                purchased_at: new Date().toISOString(),
-                expires_at: expiresAt,
+            // Use RPC function which handles permissions internally
+            const { error } = await supabase.rpc('admin_gift_premium', {
+                target_user_id: userId,
+                expires_at_param: expiresAt,
             });
             if (error) throw error;
             const { data: updatedProfile } = await supabase.rpc('get_profile_with_auth_info', { user_id: userId }).single();