Row Level Security (RLS) Policies in the TCG Pocket Collection Tracker Supabase Backend

The TCG Pocket Collection Tracker repository does not contain the Row Level Security (RLS) policy definitions; these critical access controls are configured directly within the Supabase project dashboard and are not version-controlled in the public frontend codebase.

The marcelpanse/tcg-pocket-collection-tracker is a Supabase-backed application for managing trading card collections. While the repository contains extensive frontend logic for interacting with user-specific data, the Row Level Security (RLS) policies that enforce access restrictions at the database level are notably absent from the source code.

Where RLS Policies Are Typically Defined

In standard Supabase architectures, RLS policies are defined via SQL migrations stored in a supabase/migrations/ directory or applied directly through the Supabase dashboard. These policies use CREATE POLICY statements with USING and WITH CHECK clauses to restrict rows based on the authenticated user's ID.

Repository Structure Analysis

A comprehensive search of the marcelpanse/tcg-pocket-collection-tracker repository reveals no SQL policy definitions. The investigation covered:

• The supabase/ directory for any create policy or auth.uid() references
• The scripts/sql/ directory for migration files
• Global repository searches for RLS, policy, and create policy keywords

All searches returned zero matches, confirming that RLS logic is not version-controlled in this repository.

Edge Functions vs. Database Policies

While the repository contains a supabase/functions/ directory, it only houses serverless edge functions such as stats-tracker, sso, manage-friend, and get-trading-partners. These functions implement business logic but do not contain the CREATE POLICY SQL statements required to enforce row-level access controls on the underlying tables.

Expected RLS Policies for Card Collection Data

Although the policies are not present in the repository, the frontend code interacts with tables that would typically require strict user isolation. Based on the service layer analysis, the Supabase project likely implements policies similar to:

-- Policy for the collection table
CREATE POLICY "Users can only access their own collection"
  ON collection
  USING (user_id = auth.uid());

-- Policy for card_amounts table
CREATE POLICY "Users can only modify their own card amounts"
  ON card_amounts
  FOR ALL
  USING (user_id = auth.uid())
  WITH CHECK (user_id = auth.uid());

-- Policy for accounts table
CREATE POLICY "Users can only view their own account"
  ON accounts
  USING (id = auth.uid());

These policies ensure that authenticated users can only read and modify rows where their user_id matches auth.uid().

Key Files Demonstrating Data Access Patterns

While the RLS definitions are absent, the following files demonstrate how the frontend expects the database to behave with user-scoped queries:

• frontend/src/lib/supabase.ts – Initializes the Supabase client with authentication context
• frontend/src/services/collection/collectionService.ts – Performs CRUD operations on collection and card_amounts tables, implicitly expecting RLS to filter by authenticated user
• frontend/src/services/account/accountService.ts – Accesses the accounts table with user-specific queries

Summary

• The marcelpanse/tcg-pocket-collection-tracker repository does not contain Row Level Security (RLS) policies in its version-controlled source code.
• Comprehensive searches of the supabase/, scripts/sql/, and function directories found no CREATE POLICY statements or auth.uid() references.
• The RLS policies are configured directly in the Supabase project dashboard or private migration folders, not in the public frontend repository.
• Based on the service layer code, the application likely enforces user isolation on tables such as collection, card_amounts, and accounts using standard auth.uid() comparisons.

Frequently Asked Questions

Why are the RLS policies not in the GitHub repository?

The repository is a frontend monorepo that focuses on the user interface and client-side logic. The database schema and security policies are managed separately within the Supabase project itself, either through the Supabase dashboard or private migration files that are not committed to the public repository for security reasons.

How can I view the actual RLS policies for this application?

To inspect the active Row Level Security policies, you must have access to the Supabase project dashboard. Navigate to the Database section, select the relevant table (such as collection or card_amounts), and click on Policies to view the CREATE POLICY definitions that enforce user-specific access controls.

Which tables likely have RLS policies enabled?

Based on the frontend service layer analysis, the following tables almost certainly have RLS policies restricting access to the authenticated user: the collection table (storing user collections), the card_amounts table (tracking card quantities), and the accounts table (storing user profile data). These policies typically compare a user_id column against auth.uid() to ensure isolation.

What happens if RLS is disabled on these tables?

If Row Level Security were disabled, any authenticated user could potentially read, modify, or delete another user's card collection data by manipulating the frontend requests. The application relies on RLS as the primary security layer to enforce multi-tenancy at the database level, ensuring that users can only access rows where their user ID matches the record's owner.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}