tiennm99 164c6125c2 feat(auth): allowlist-gated admin bootstrap, rate limiting, audit log ...

- claim_first_admin: no-arg, inserts auth.uid(), gated on an email allowlist
  table so an arbitrary shared-pool principal can no longer claim admin
- revoke direct writes on app_users from authenticated (least privilege)
- rate-limit sign-in (by platform IP) and invite (by admin id); fail open
  on Redis outage so an outage cannot lock staff out
- audit_log table + SECURITY DEFINER log_audit writer, admin-only reads
- invite: map existing-email to a clear error, roll back orphaned auth row
- session: read role + full_name in one own-row query

2026-07-25 01:51:35 +07:00

..

supabase-bsk.ts

feat(auth): allowlist-gated admin bootstrap, rate limiting, audit log

2026-07-25 01:51:35 +07:00