Supabase Database & Security Model

PostgreSQL Schema#

LaterBox data is partitioned by auth.uid() in Supabase PostgreSQL:

• `items` table: Core entity storing id, user_id, url, title, description, content, media_type, preview_image, is_starred, is_archived, created_at, updated_at.
• `collections` table: User-defined collections with custom colors and icons.
• `item_collections` table: Many-to-many join table for collection memberships.
• `tags` table: Granular categorization tags.

Row Level Security (RLS) Policies#

All tables strictly enforce PostgreSQL Row-Level Security:

-- Users can only view their own items
CREATE POLICY "Users can view own items"
  ON public.items FOR SELECT
  USING (auth.uid() = user_id);

-- Users can only insert items belonging to their auth UID
CREATE POLICY "Users can insert own items"
  ON public.items FOR INSERT
  WITH CHECK (auth.uid() = user_id);

-- Users can only update their own items
CREATE POLICY "Users can update own items"
  ON public.items FOR UPDATE
  USING (auth.uid() = user_id);

-- Users can only delete their own items
CREATE POLICY "Users can delete own items"
  ON public.items FOR DELETE
  USING (auth.uid() = user_id);

Account Deletion & Data Purge#

When a user deletes their account via Settings > Danger Zone:

1. The delete_user_account() PostgreSQL RPC executes with SECURITY DEFINER.
2. All records in items, collections, and tags are cascaded and deleted.
3. User files in Supabase Storage buckets are purged.
4. The auth.users record is deleted via admin Supabase service role API, guaranteeing zero leftover residual data.