ClipSpacesClipSpaces Docs
Back to app

All releases

Supabase backend: scaffold + migration

Added

  • Supabase migrations (supabase/migrations/), all applied to the remote project kekqxaixiayjxilvbmqr:
    • 20260608000100_schema.sql — spaces, space_members, cards tables; updated_at triggers; auto owner-membership trigger.
    • 20260608000200_rls.sql — RLS on all tables + membership helper functions.
    • 20260608000300_connections.sql — OAuth connections table; token columns revoked from the browser role.
    • 20260608000400_realtime.sql — cards + spaces added to the realtime publication with replica identity full.
    • 20260608000500_storage.sql — public cards storage bucket + object policies.
    • 20260609125500_advisor_hardening.sql — see Changed/Security below.
  • Client scaffolds (lib/supabase/): client.ts, server.ts, admin.ts, middleware.ts (updateSession helper), types.ts (hand-written Database types), cards.ts (Card ⇄ row mapping).
  • supabase/README.md — migration + wiring guide.
  • supabase CLI pinned as a dev dependency (2.105.0); supabase init created config.toml.
  • CHANGELOG.md (this file).

Changed

  • package.json — added @supabase/ssr, @supabase/supabase-js, and the supabase CLI.
  • .env.example — documented the Supabase env vars using the new key names.
  • Client scaffolds read the new API key names (NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY / SUPABASE_SECRET_KEY) with fallback to the legacy anon / service_role names.

Security

  • 20260609125500_advisor_hardening.sql resolved all supabase db advisors warnings: moved SECURITY DEFINER helpers + trigger functions into a non-exposed private schema, pinned search_path = '', wrapped direct auth.uid() calls in (select auth.uid()), and dropped the broad bucket SELECT policy that allowed file listing. Advisors now report 0 WARN / 0 ERROR.

Verified

  • supabase migration list --linked — all 6 migrations aligned local/remote.
  • Live catalog check — 4 tables with RLS enabled, 14 public policies + 2 storage policies, all 5 functions in the private schema.

Notes

  • Nothing in the app imports lib/supabase/* yet, so the app still runs on the in-memory WebSocket server (server.js) + localStorage.
  • .env.local has the URL + publishable key; SUPABASE_SECRET_KEY not yet set (only needed once the OAuth/admin paths land).