Supabase

The single backend: PostgreSQL + RLS + Auth + Edge Functions + Storage. Two projects.

Projects

	Project	Ref	Role
PROD	qr-setu-prod	ygmqxyrbnemhwkiyoboc	Isolated, real user data. The original/already-connected project.
DEV + UAT	qr-setu-dev	dyhjofjjuazhyqcvlrkx	Bootstrapped from a schema-only baseline; zero data rows.

Both provisioned 2026-07-10. Verified 58/58 tables and 118/118 RLS policies identical at baseline.

What we use

Capability	How QRSETU uses it
PostgreSQL + RLS	58 tables, 118 policies. RLS on every user-facing table.
Auth	JWT sessions; role from profiles.role (default 'user').
Edge Functions	Deno/TS, @supabase/supabase-js pinned 2.30.0. Writes/secrets/HTTP.
Storage	profile-pictures bucket (Prod only so far).
pg_cron	Drives the public_page_ops_* Type B functions (Prod only so far).

Client rules [ENFORCED]

• One canonical typed singleton: src/lib/supabaseClient.ts (createClient(VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY)).
• @/lib/customSupabaseClient (~50 importers) and src/shared/lib/supabaseClient.js re-export it.
• No createClient anywhere else. No hardcoded production-fallback URL.

CLI & config

• supabase/config.toml — per-function verify_jwt (Type A true, Type B public_page_ops_* false).
• npm run functions:deploy -- --project-ref <ref> — explicit ref, never supabase link state.
• Local stack via Docker Desktop; EF tests via Deno (npm run test:ef).

[TRANSITIONAL] — not yet replicated to Dev

• pg_cron job — hardcodes Prod's Edge Function URL; needs a project-URL-aware rewrite first.
• profile-pictures bucket — environment-specific data, not portable schema.

Gotcha: the deno.land/x/postgres pooler is incompatible in this setup — see the Edge Function standards memo / EDGE_FUNCTION_GUIDELINES.md.

See Database & RLS · Backend · Migrations.