# Row Level Security (RLS) Policies in the TCG Pocket Collection Tracker Supabase Backend

> Discover how to implement Row Level Security RLS policies in Supabase to protect your TCG Pocket Collection Tracker user data. Learn about secure access controls for your card collections.

- Repository: [Marcel Panse/tcg-pocket-collection-tracker](https://github.com/marcelpanse/tcg-pocket-collection-tracker)
- Tags: internals
- Published: 2026-03-06

---

**The TCG Pocket Collection Tracker repository does not contain the Row Level Security (RLS) policy definitions; these critical access controls are configured directly within the Supabase project dashboard and are not version-controlled in the public frontend codebase.**

The `marcelpanse/tcg-pocket-collection-tracker` is a Supabase-backed application for managing trading card collections. While the repository contains extensive frontend logic for interacting with user-specific data, the **Row Level Security (RLS) policies** that enforce access restrictions at the database level are notably absent from the source code.

## Where RLS Policies Are Typically Defined

In standard Supabase architectures, RLS policies are defined via SQL migrations stored in a `supabase/migrations/` directory or applied directly through the Supabase dashboard. These policies use `CREATE POLICY` statements with `USING` and `WITH CHECK` clauses to restrict rows based on the authenticated user's ID.

## Repository Structure Analysis

A comprehensive search of the `marcelpanse/tcg-pocket-collection-tracker` repository reveals no SQL policy definitions. The investigation covered:

- The `supabase/` directory for any `create policy` or `auth.uid()` references
- The `scripts/sql/` directory for migration files
- Global repository searches for `RLS`, `policy`, and `create policy` keywords

All searches returned **zero matches**, confirming that RLS logic is not version-controlled in this repository.

### Edge Functions vs. Database Policies

While the repository contains a `supabase/functions/` directory, it only houses serverless edge functions such as `stats-tracker`, `sso`, `manage-friend`, and `get-trading-partners`. These functions implement business logic but do not contain the `CREATE POLICY` SQL statements required to enforce row-level access controls on the underlying tables.

## Expected RLS Policies for Card Collection Data

Although the policies are not present in the repository, the frontend code interacts with tables that would typically require strict user isolation. Based on the service layer analysis, the Supabase project likely implements policies similar to:

```sql
-- Policy for the collection table
CREATE POLICY "Users can only access their own collection"
  ON collection
  USING (user_id = auth.uid());

-- Policy for card_amounts table
CREATE POLICY "Users can only modify their own card amounts"
  ON card_amounts
  FOR ALL
  USING (user_id = auth.uid())
  WITH CHECK (user_id = auth.uid());

-- Policy for accounts table
CREATE POLICY "Users can only view their own account"
  ON accounts
  USING (id = auth.uid());

```

These policies ensure that authenticated users can only read and modify rows where their `user_id` matches `auth.uid()`.

## Key Files Demonstrating Data Access Patterns

While the RLS definitions are absent, the following files demonstrate how the frontend expects the database to behave with user-scoped queries:

- [`frontend/src/lib/supabase.ts`](https://github.com/marcelpanse/tcg-pocket-collection-tracker/blob/main/frontend/src/lib/supabase.ts) – Initializes the Supabase client with authentication context
- [`frontend/src/services/collection/collectionService.ts`](https://github.com/marcelpanse/tcg-pocket-collection-tracker/blob/main/frontend/src/services/collection/collectionService.ts) – Performs CRUD operations on `collection` and `card_amounts` tables, implicitly expecting RLS to filter by authenticated user
- [`frontend/src/services/account/accountService.ts`](https://github.com/marcelpanse/tcg-pocket-collection-tracker/blob/main/frontend/src/services/account/accountService.ts) – Accesses the `accounts` table with user-specific queries

## Summary

- The `marcelpanse/tcg-pocket-collection-tracker` repository does not contain **Row Level Security (RLS) policies** in its version-controlled source code.
- Comprehensive searches of the `supabase/`, `scripts/sql/`, and function directories found no `CREATE POLICY` statements or `auth.uid()` references.
- The RLS policies are configured directly in the Supabase project dashboard or private migration folders, not in the public frontend repository.
- Based on the service layer code, the application likely enforces user isolation on tables such as `collection`, `card_amounts`, and `accounts` using standard `auth.uid()` comparisons.

## Frequently Asked Questions

### Why are the RLS policies not in the GitHub repository?

The repository is a frontend monorepo that focuses on the user interface and client-side logic. The database schema and security policies are managed separately within the Supabase project itself, either through the Supabase dashboard or private migration files that are not committed to the public repository for security reasons.

### How can I view the actual RLS policies for this application?

To inspect the active Row Level Security policies, you must have access to the Supabase project dashboard. Navigate to the **Database** section, select the relevant table (such as `collection` or `card_amounts`), and click on **Policies** to view the `CREATE POLICY` definitions that enforce user-specific access controls.

### Which tables likely have RLS policies enabled?

Based on the frontend service layer analysis, the following tables almost certainly have RLS policies restricting access to the authenticated user: the `collection` table (storing user collections), the `card_amounts` table (tracking card quantities), and the `accounts` table (storing user profile data). These policies typically compare a `user_id` column against `auth.uid()` to ensure isolation.

### What happens if RLS is disabled on these tables?

If Row Level Security were disabled, any authenticated user could potentially read, modify, or delete another user's card collection data by manipulating the frontend requests. The application relies on RLS as the primary security layer to enforce multi-tenancy at the database level, ensuring that users can only access rows where their user ID matches the record's owner.