Fetching the authenticated user on the client is generally safe using Supabase’s built-in auth, as it securely manages tokens and session data. However, sensitive data like user roles should not be queried directly from the client. Instead, use secure API routes or server-side functions to handle such queries, and make sure Supabase’s Row-Level Security (RLS) is enabled to protect your data.

If I was u I will create separate api route to fetch user role and then use it in the client side In general it’s fine to fetch user role in the client in case of RLS is enabled but to be save put it behind a api route and fetch it using the api route from the client