0034: Tenant column on block tables
Adopted tables keep organization_id; block-created tables use the library's tenant column until better-supabase offers a global tenant column name.
0036: Browser Supabase client for realtime and token refresh
The browser keeps a Supabase client for direct Realtime and token refresh; the better-supabase relay serves Realtime only during support sessions.
0034: Tenant column on block tables
Adopted tables keep organization_id; block-created tables use the library's tenant column until better-supabase offers a global tenant column name.
0036: Browser Supabase client for realtime and token refresh
The browser keeps a Supabase client for direct Realtime and token refresh; the better-supabase relay serves Realtime only during support sessions.
Support and impersonation sessions are read-only in the database through PermDock's readOnlyActors, not only in the app.
A platform administrator can view the app as a user (support session), read-only by default. The app blocks writes in actions, but a write that reaches PostgREST or SQL directly is not stopped by the database.
rls.readOnlyActors lists support and impersonation in packages/identity/permdock.config.ts, with rls.tokenScopes: true.permdock_actor_may_write(); generated policies get it from PermDock.permdock rls verify --introspect --helpers-only runs in CI and fails on a write policy without the check.Last updated on
0034: Tenant column on block tables
Adopted tables keep organization_id; block-created tables use the library's tenant column until better-supabase offers a global tenant column name.
0036: Browser Supabase client for realtime and token refresh
The browser keeps a Supabase client for direct Realtime and token refresh; the better-supabase relay serves Realtime only during support sessions.