Quick Start — Supabase

1. Create a Supabase Project

If you don’t have one, create a project at supabase.com. Note your project’s database connection string and service role key.

2. Generate and Apply the SQL

npx @smta/cli --adapter supabase # [--enable-graphql] Optional flag to keep GraphQL enabled

This writes SMTA-supabase-<timestamp>.sql to your current directory.

Caution

This script disables the pg_graphql extension within Supabase. This prevents core.* tables from being exposed in the auto-generated GraphQL schema, keeping all data access within the public.* RPC function layer.

You can keep GraphQL enabled by using the --enable-graphql flag.

RLS policies will still apply to GraphQL queries, but the table structure of core.* will be visible and queryable directly rather than through the RPC functions.

Open your Supabase project → SQL Editor → paste the contents of the generated file and run it.

Alternatively, apply via psql:

psql "$DATABASE_URL" -f SMTA-supabase-<timestamp>.sql

3. What the Supabase Adapter Provides

The Supabase deployment includes three adapter-specific files on top of @smta/core:

File	Purpose
auth_supabase_impl.sql	Implements core.get_current_user_id() using Supabase’s JWT (auth.uid())
secrets_supabase_impl.sql	Implements core.store_secret_impl() and core.delete_secret_impl() using Supabase Vault
constraints.sql	Implements foreign keys from SMTA tables to auth.users

4. Verify

In the SQL Editor, call a public function to confirm everything is working:

-- Should return an empty array (no orgs yet)
select public.list_my_organizations();

If the function exists and returns without error, SMTA is deployed.

5. Add Your App Schema

Create your app schema tables on top of SMTA. Each table needs an org_id or unit_id column to associate rows with a tenant — but membership validation is handled automatically by RLS. Your application queries need no explicit membership checks; Postgres enforces isolation before returning any rows.

create schema if not exists app;

-- Org-scoped table: any member of the org can access
create table app.projects (
  id         uuid primary key default gen_random_uuid(),
  org_id     uuid not null references core.organizations(id),
  name       text not null,
  created_at timestamptz default now()
);

alter table app.projects enable row level security;

create policy "org members" on app.projects
  for all using (core.is_org_member(org_id));


-- Unit-scoped table: only members assigned to that unit can access
create table app.shift_schedules (
  id        uuid primary key default gen_random_uuid(),
  unit_id   uuid not null references core.units(id),
  starts_at timestamptz not null,
  ends_at   timestamptz not null
);

alter table app.shift_schedules enable row level security;

-- Option A — only staff explicitly assigned to this unit
create policy "unit members" on app.shift_schedules
  for all using (core.is_unit_member(unit_id));

-- Option B — anyone in the parent org (e.g. managers across locations)
-- create policy "org members via unit" on app.shift_schedules
--   for all using (core.is_org_member_for_unit(unit_id));