Auth Flow
Session lifecycle, OAuth, and project roles.
Every request passes through middleware that refreshes the Supabase session cookie before route handlers run.
Session lifecycle
text
1. User visits protected route
2. middleware.ts → updateSession()
3. createServerClient reads/writes auth cookies
4. getUser() — if no user → redirect /login?next=...
5. If user on /login → redirect /projectsOAuth flow
- User clicks Google sign-in on
/login - Supabase redirects to Google, then back with
?code= - Middleware catches code and forwards to
/auth/callback - Callback exchanges code for session, redirects to
nextparam
Roles & RLS
Project members have roles: admin, editor, or viewer.
| Role | Typical permissions |
|---|---|
| admin | Invite members, delete project, full edit |
| editor | Upload assets, comment, vote, edit tasks |
| viewer | View and comment (read-heavy) |
Hub admins (org-wide) can access org-wide projects and dev tools.