Group membership model

How default, member, and admin groups gate CSV export, admin tools, and feature flags in Supabase.

Users belong to one or more groups stored in Supabase—typically default registered users, paying members with CSV access, and admins who review contact submissions. Server routes check group membership before unlocking CSV export or admin dashboard tools rather than scattering email allowlists in code.

User account linked to member and admin group nodes with feature flags
Supabase group rows determine CSV export, billing features, and admin route access.

Common groups

  • default — signed-in feeds and history browsing.
  • member — active Stripe subscription for CSV.
  • admin — user lookup and contact review.

Enforcement points

Check groups in Astro middleware and API handlers—middleware patterns. Webhooks add member group on successful checkout; cancellations remove it. Never trust client-side group claims.

Auth foundation

Registration flow in Supabase auth assigns default group. Session cookies carry JWT claims read during session lifecycle.