User accounts use Supabase Auth for email or OAuth sign-in, session cookies, and row-level security on history and feed configuration. The Astro site validates sessions on protected routes before rendering dashboard HTML or API mutations.
Session lifecycle
- User signs in via Supabase client or server exchange.
- Session cookie scoped to site domain; HttpOnly where configured.
- Server routes read session and query Postgres with user context.
What auth protects
- Feed URLs and probe labels—temperature feeds.
- History rows—history browsing.
- CSV export—subscription gating.
- Admin tools—admin features.
Security notes
Never expose service role keys to the browser. Relay security for public JSON: relay security.