supabase

Supabase And Postgres

Focused rules for Supabase SQL, migrations, generated files, and security in docs.plus.

Project Guardrails

• Never edit apps/webapp/src/types/supabase.ts. It is generated CLI output. After relevant DB work, the developer runs bun run --filter @docs.plus/supabase_back types from the repo root with local Supabase and root .env.local.
• Never edit packages/supabase/seed.sql. Schema, RPC, and policy changes belong in packages/supabase/migrations/ and packages/supabase/scripts/.
• Keep Supabase architecture aligned with packages/supabase/CLAUDE.md: browser singleton, server/API clients, generated types, and migration workflow live there as project policy.
• Do not expose Supabase service_role or secret keys to public/browser code. NEXT_PUBLIC_* values are browser-visible.

SQL Style

• Write SQL keywords in lowercase.
• Use snake_case for schemas, tables, columns, functions, triggers, policies, indexes, and CTEs.
• Prefer plural table names and singular column names.
• Avoid reserved words, tbl_ prefixes, and vague names such as name when a domain-specific name is available.
• Use ISO 8601 timestamps for literal dates, for example '2026-05-05T12:00:00'.
• Use -- for short comments and /* ... */ for block comments.
• Keep simple statements compact; split larger queries by clause for readability.
• Use explicit as for aliases.
• Prefer readable CTEs for complex queries; add comments for non-obvious blocks.

with active_members as (
  select
    workspace_members.user_id,
    workspace_members.workspace_id
  from workspace_members
  where workspace_members.deleted_at is null
)
select active_members.user_id
from active_members
where active_members.workspace_id = p_workspace_id;

Schema Objects

• Create tables in public unless a private schema is intentionally required.
• Add comments for new tables and for complex or security-sensitive columns.
• Use the project-established ID shape. For new numeric surrogate keys, prefer bigint generated always as identity; use UUIDs when existing APIs, RPCs, or realtime paths require UUIDs.
• Foreign keys use {referenced_table_singular}_id, for example user_id for users.
• Name indexes by table and column/purpose, for example messages_channel_id_created_at_idx.
• Trigger and function names describe their action, for example set_updated_at.
• Function bodies should avoid hidden side effects unless the function name and comments make the behavior explicit.