Supabase Configuration

Overview

Trazea uses Supabase as its backend platform, providing:

PostgreSQL database with 17 tables for inventory, solicitudes, guarantees, and more
Authentication with email/password and Google OAuth
Row Level Security (RLS) for multi-tenant access control
Storage for warranty photos and spare part images
Real-time subscriptions for notifications

Prerequisites

Supabase account (free tier available)
New Supabase project created
Project URL and anon key from project settings

Project Setup

1. Create Supabase Project

Create New Project

Go to Supabase Dashboard and click New Project

Configure Project

Name: Trazea (or your preferred name)
Database Password: Generate a strong password (save this securely)
Region: Choose closest to your users
Pricing Plan: Free tier is sufficient for development

Get API Credentials

Once created, navigate to Settings > API and copy:

Project URL: https://xxxxxxxxxxx.supabase.co
anon/public key: Your client-side API key

2. Configure Environment Variables

Add these credentials to your .env file:

.env

VITE_SUPABASE_URL=https://your-project.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-key-here

See Environment Setup for full details.

Authentication Configuration

Trazea supports two authentication methods:

Email/Password Authentication

Enabled by default in Supabase. Configuration:

Navigate to Auth Settings

Authentication > Providers > Email

Enable Email Provider

Ensure Email is enabled (on by default)

Configure Email Settings

Confirm email: Recommended for production
Secure email change: Enabled (requires confirmation)
Secure password change: Enabled

Customize Email Templates (Optional)

Go to Authentication > Email Templates to customize:

Confirmation email
Password reset email
Magic link email

Google OAuth

Trazea supports Google OAuth for single sign-on:

Create Google OAuth App

Go to Google Cloud Console
Create new project or select existing
Navigate to APIs & Services > Credentials
Click Create Credentials > OAuth 2.0 Client ID
Configure OAuth consent screen if prompted

Configure OAuth Client

Application type: Web application
Name: Trazea
Authorized redirect URIs: https://your-project.supabase.co/auth/v1/callback

Copy the Client ID and Client Secret

Enable in Supabase

Go to Authentication > Providers > Google
Enable the Google provider
Paste Client ID and Client Secret
Click Save

Users who sign in with Google OAuth will have their email automatically verified.

User Registration Flow

Trazea implements an approval-based registration system:

User registers via email/password or Google OAuth
User profile created in usuarios table with aprobado = false
Admin receives notification via admin_notifications table
Admin approves/rejects user in the admin panel
User gains access once approved

User Profile Schema

The usuarios table stores user profiles with these key fields:

CREATE TABLE usuarios (
  id UUID PRIMARY KEY REFERENCES auth.users(id),
  email TEXT UNIQUE NOT NULL,
  nombre_completo TEXT,
  rol_id UUID REFERENCES roles(id),
  aprobado BOOLEAN DEFAULT false,
  aprobado_por UUID REFERENCES usuarios(id),
  fecha_aprobacion TIMESTAMP,
  razon_rechazo TEXT,
  created_at TIMESTAMP DEFAULT NOW()
);

aprobado

boolean

default:"false"

User approval status. Must be set to true by an admin before user can access the system.

aprobado_por

uuid

Admin user who approved/rejected the registration.

razon_rechazo

text

Reason for rejection (if applicable).

Row Level Security (RLS)

RLS is critical for Trazea’s multi-tenant security model. It ensures users can only access data for their assigned locations.

Never deploy to production without RLS enabled on all tables. This would allow any user to access all data.

Enable RLS on All Tables

For each table in your database:

ALTER TABLE usuarios ENABLE ROW LEVEL SECURITY;
ALTER TABLE localizacion ENABLE ROW LEVEL SECURITY;
ALTER TABLE inventario ENABLE ROW LEVEL SECURITY;
ALTER TABLE repuestos ENABLE ROW LEVEL SECURITY;
ALTER TABLE solicitudes ENABLE ROW LEVEL SECURITY;
ALTER TABLE garantias ENABLE ROW LEVEL SECURITY;
-- ... repeat for all 17 tables

Example RLS Policies

Here are example policies for key tables:

-- Users can view their own profile
CREATE POLICY "Users can view own profile"
ON usuarios FOR SELECT
USING (auth.uid() = id);

-- Admins can view all profiles
CREATE POLICY "Admins can view all profiles"
ON usuarios FOR SELECT
USING (
  EXISTS (
    SELECT 1 FROM usuarios u
    JOIN roles r ON u.rol_id = r.id
    WHERE u.id = auth.uid()
    AND r.permisos->>'admin' = 'true'
  )
);

-- Users can update their own profile
CREATE POLICY "Users can update own profile"
ON usuarios FOR UPDATE
USING (auth.uid() = id);

RLS Policy Patterns

Common patterns used across Trazea:

Location-Based Access

Most tables filter by usuarios_localizacion to ensure users only see data for their assigned locations:

localizacion_id IN (
  SELECT localizacion_id
  FROM usuarios_localizacion
  WHERE usuario_id = auth.uid()
)

Permission-Based Access

Actions check role permissions stored in the permisos JSON field:

EXISTS (
  SELECT 1 FROM usuarios u
  JOIN roles r ON u.rol_id = r.id
  WHERE u.id = auth.uid()
  AND (r.permisos->>'action_name')::boolean = true
)

Owner-Based Access

Some tables allow users to access their own records:

usuario_id = auth.uid()
-- or
created_by = auth.uid()

Admin Override

Admin users often bypass restrictions:

EXISTS (
  SELECT 1 FROM usuarios u
  JOIN roles r ON u.rol_id = r.id
  WHERE u.id = auth.uid()
  AND r.permisos->>'admin' = 'true'
)

Database Schema

Trazea uses 17 primary tables organized into these domains:

Core Tables

Table	Purpose
`usuarios`	User profiles, approval status, roles
`roles`	Role definitions with JSON permissions
`usuarios_localizacion`	User-to-location assignments (many-to-many)
`localizacion`	Physical locations/warehouses
`admin_notifications`	Admin alert subscriptions

Inventory Domain

Table	Purpose
`repuestos`	Spare parts catalog (reference, name, type, brand)
`inventario`	Stock quantities by location
`logs_inventario`	Audit trail for all inventory changes
`movimientos_tecnicos`	Technician spare part movements (load/unload)

Solicitudes (Requests) Domain

Table	Purpose
`carrito_solicitudes`	Shopping cart for multi-item requests
`solicitudes`	Transfer requests between locations
`detalles_solicitudes`	Line items with quantities requested/dispatched/received
`trazabilidad_solicitudes`	Complete audit trail of status changes

Guarantees Domain

Table	Purpose
`garantias`	Warranty claims with photos, km, failure reasons

Audit/Counting Domain

Table	Purpose
`registro_conteo`	Physical inventory count sessions
`detalles_conteo`	Count details (system qty vs physical qty)

Orders Domain

Table	Purpose
`scooter_types`	Catalog of scooter models
`order_follow`	Customer order tracking (levels 1-3)

For the complete schema with all columns and relationships, see the Database Model.

Storage Configuration

Trazea uses Supabase Storage for images:

Create Storage Buckets

Navigate to Storage

Storage > Buckets in Supabase dashboard

Create Buckets

Create these buckets:

repuestos-images: Spare part photos
garantias-images: Warranty claim evidence photos
avatares: User profile pictures (optional)

Configure Bucket Policies

For garantias-images and repuestos-images:

-- Allow authenticated users to upload
CREATE POLICY "Authenticated users can upload"
ON storage.objects FOR INSERT
WITH CHECK (
  bucket_id = 'garantias-images'
  AND auth.role() = 'authenticated'
);

-- Allow public read access
CREATE POLICY "Public read access"
ON storage.objects FOR SELECT
USING (bucket_id = 'garantias-images');

CORS Configuration

Configure CORS to allow requests from your frontend domain:

Navigate to API Settings

Settings > API > CORS

Add Allowed Origins

Add your frontend domains:

http://localhost:5173
https://trazea.vercel.app
https://your-custom-domain.com

Save Changes

Click Save to apply CORS configuration

Do not use * (wildcard) for CORS in production. Always specify exact domains.

Real-Time Subscriptions

Trazea uses real-time subscriptions for notifications. Enable for these tables:

-- Enable realtime for notifications table
ALTER PUBLICATION supabase_realtime ADD TABLE notificaciones;

-- Enable for other tables as needed
ALTER PUBLICATION supabase_realtime ADD TABLE solicitudes;
ALTER PUBLICATION supabase_realtime ADD TABLE trazabilidad_solicitudes;

Subscriptions in code (example):

import { supabase } from '@/shared/api/supabase';

supabase
  .channel('notifications')
  .on(
    'postgres_changes',
    {
      event: 'INSERT',
      schema: 'public',
      table: 'notificaciones',
      filter: `usuario_id=eq.${userId}`,
    },
    (payload) => {
      // Handle new notification
      console.log('New notification:', payload.new);
    }
  )
  .subscribe();

Production Checklist

Authentication

✓ Email confirmation enabled for production✓ Google OAuth configured with correct redirect URIs✓ Email templates customized

Row Level Security

✓ RLS enabled on ALL tables✓ Policies tested for each user role✓ Admin users cannot bypass RLS without explicit policy

Storage

✓ Storage buckets created✓ Bucket policies configured✓ File size limits set (10 MB recommended)

CORS & Security

✓ CORS configured with exact domains (no wildcards)✓ Database password strong and stored securely✓ API keys rotated if exposed

Monitoring

✓ Database logs enabled✓ Alert rules configured for:

High CPU usage
Connection pool exhaustion
Storage quota warnings

Migration and Backups

Database Migrations

For schema changes, use Supabase CLI:

# Install Supabase CLI
npm install -g supabase

# Link to your project
supabase link --project-ref your-project-ref

# Create new migration
supabase migration new add_new_table

# Edit the migration file in supabase/migrations/
# Then push to database
supabase db push

Automated Backups

Supabase Pro and Team plans include:

Daily automated backups (retained for 7 days)
Point-in-time recovery (PITR) for accidental data loss

For Free tier:

Export database regularly: Database > Backups > Export
Store exports securely offsite

Troubleshooting

Authentication Not Working

Verify environment variables are correct
Check that Supabase URL includes https:// protocol
Ensure email provider is enabled in Supabase Auth settings
For Google OAuth, verify redirect URI matches exactly

RLS Policy Errors

If users see “permission denied” errors:

Check policy syntax in Database > Policies
Test query in SQL Editor as that user: SET LOCAL ROLE authenticated; SET LOCAL request.jwt.claim.sub = 'user-uuid';
Verify usuarios_localizacion assignments are correct
Ensure user has aprobado = true in usuarios table

CORS Errors

If seeing “CORS policy blocked” errors:

Add your frontend domain to Settings > API > CORS
Ensure protocol matches (http vs https)
Remove trailing slashes from origins
Wait ~1 minute for CORS changes to propagate

Storage Upload Failures

Check bucket exists and is public/private as intended
Verify storage policies allow the operation
Ensure file size is under limit (default 50 MB)
Check file type is allowed (configure in bucket settings)

Next Steps

Environment Setup

Configure environment variables for local and production

Deploy to Vercel

Deploy your Trazea instance to Vercel

Get Started

Core Features

Architecture

Guides

Deployment

Supabase Configuration

Overview

Prerequisites

Project Setup

1. Create Supabase Project

2. Configure Environment Variables

Authentication Configuration

Email/Password Authentication

Google OAuth

User Registration Flow

User Profile Schema

Row Level Security (RLS)

Enable RLS on All Tables

Example RLS Policies

RLS Policy Patterns

Database Schema

Core Tables

Inventory Domain

Solicitudes (Requests) Domain

Guarantees Domain

Audit/Counting Domain

Orders Domain

Storage Configuration

Create Storage Buckets

CORS Configuration

Real-Time Subscriptions

Production Checklist

Migration and Backups

Database Migrations

Automated Backups

Troubleshooting

Next Steps

Environment Setup

Deploy to Vercel

Build docs developers (and LLMs) love

Get Started

Core Features

Architecture

Guides

Deployment

​Overview

​Prerequisites

​Project Setup

​1. Create Supabase Project

​2. Configure Environment Variables

​Authentication Configuration

​Email/Password Authentication

​Google OAuth

​User Registration Flow

​User Profile Schema

​Row Level Security (RLS)

​Enable RLS on All Tables

​Example RLS Policies

​RLS Policy Patterns

​Database Schema

​Core Tables

​Inventory Domain

​Solicitudes (Requests) Domain

​Guarantees Domain

​Audit/Counting Domain

​Orders Domain

​Storage Configuration

​Create Storage Buckets

​CORS Configuration

​Real-Time Subscriptions

​Production Checklist

​Migration and Backups

​Database Migrations

​Automated Backups

​Troubleshooting

​Next Steps

Environment Setup

Deploy to Vercel

Build docs developers (and LLMs) love

Overview

Prerequisites

Project Setup

1. Create Supabase Project

2. Configure Environment Variables

Authentication Configuration

Email/Password Authentication

Google OAuth

User Registration Flow

User Profile Schema

Row Level Security (RLS)

Enable RLS on All Tables

Example RLS Policies

RLS Policy Patterns

Database Schema

Core Tables

Inventory Domain

Solicitudes (Requests) Domain

Guarantees Domain

Audit/Counting Domain

Orders Domain

Storage Configuration

Create Storage Buckets

CORS Configuration

Real-Time Subscriptions

Production Checklist

Migration and Backups

Database Migrations

Automated Backups

Troubleshooting

Next Steps