0011: Multi-brand path routing
Every brand is served from one app host with the API, MCP server and docs as path rewrites, and the SaaS app renders each brand through a hidden brand root param.
0013: Ultracite for Oxlint and Oxfmt
Lint and format presets come from Ultracite 8. The hand-maintained ox-config package is gone.
0011: Multi-brand path routing
Every brand is served from one app host with the API, MCP server and docs as path rewrites, and the SaaS app renders each brand through a hidden brand root param.
0013: Ultracite for Oxlint and Oxfmt
Lint and format presets come from Ultracite 8. The hand-maintained ox-config package is gone.
Request paths reach better-supabase modules and Auth through the Data API and the Auth admin API; direct Postgres is reserved for the libraries that only speak SQL.
Several admin and organization pages opened a direct Postgres connection from the request path: the users list read last sign-ins from auth.sessions, suspend, ban and delete wrote auth.users and auth.sessions, the audit recorder called better_supabase.audit_event, the admin dashboard read job queue health, and the billing pages called the billing module and the Sync Engine read models. Each of these needed POSTGRES_URL, so a missing or wrong value broke pages that otherwise ran on the Data API like the rest of the app, and the request held a second connection pool next to PostgREST.
Request paths use the same three routes as every other service call:
api entry points in better-supabase.config.ts (sessions, audit, jobs and billing, next to the modules that already had them). The server calls them with rpcTransport(serviceClient, { schema: "api" }), and the entry points are granted to service_role only.auth.admin.updateUserById for bans, deleteAccount from better-supabase/server without sql). Ending another user's sessions goes through public.end_user_sessions, a service-role-only function.public (organization_subscription, organization_stripe_invoices, capture_organization_subscription_history, plan_subscription_ids) are called with db.$rpc on a service-role Db.Direct Postgres stays for the libraries that only speak SQL: the Stripe Sync Engine, job claiming and the drain, the webhook inbox, idempotency, agent checkpoints, usage reporting to Stripe and the API's caller Postgres modes. Both servers check for POSTGRES_URL in instrumentation.ts and refuse to start without it.
createAdminContext() from @workspace/core/request-context is the one way for apps and feature code to get a context on the secret key. It replaced createAdminRequestContext, and no other code reads SUPABASE_SECRET_KEY, except the API's MCP usage signer.
getSharedSupabaseAdminClient() from @workspace/supabase-runtime is the lower-level primitive under it. Only packages/core* and the packages/supabase-* providers call it directly, for wiring that needs a client rather than a whole context: rate limiting, billing, email delivery, payment webhooks, agent chat, comments and acting-user contexts. Apps never import it, which the boundary tags already enforce.
The repo standard keeps secret-key contexts off request paths. CentraKit allows them on a request path in these cases, each behind its own gate:
withPlatformAccess or requireAccess with a platform grant.withTenantAccess, requireAccess or the portal guard has checked the grant.apps/saas/lib/organizations/access.ts. It runs before the grant check because it feeds that check, and it returns only the organization row the gate needs.Reads that need no privilege use a publishable-key context instead, for example public product pages that call a security-definer RPC.
Cron routes, job handlers, webhooks and workflow steps use it as system work. Moving a case to a security-definer RPC is preferred whenever the call site changes for another reason.
api option and, when it should not be callable by clients, a functions list limited to service-role entry points. grants.test.sql checks that the new entry points are closed to anon and authenticated.rpcQueueMonitor) reads stats and dead letters and retries them, but cannot enqueue or claim; workers keep createJobs over ctx.postgresAdmin.POSTGRES_URL now fails at server start instead of on the first job, webhook or billing sync.Last updated on
0011: Multi-brand path routing
Every brand is served from one app host with the API, MCP server and docs as path rewrites, and the SaaS app renders each brand through a hidden brand root param.
0013: Ultracite for Oxlint and Oxfmt
Lint and format presets come from Ultracite 8. The hand-maintained ox-config package is gone.