supabase/schema.sql and can be applied directly in the Supabase SQL Editor.
Tables
profiles
Extends Supabase’s built-inauth.users table with application-specific user data. Each row is created at sign-up and tied to the authenticated user’s UUID.
levels
Static configuration table for each VIP tier. Rows are seeded at setup time and managed by admins. Users reference a level viaprofiles.level_id.
task_items
The pool of available tasks displayed on the Start page. Tasks can be filtered by level and toggled active or inactive by admins.user_tasks
Execution records linking a user to a specific task. Each row represents one task assignment within a set.referral_codes
Registry of all referral codes in the system. Each user gets one code on sign-up; the registry allows validation at registration time.transactions
Financial ledger recording every balance movement. All deposits, withdrawals, commission credits, and freeze/unfreeze events are written here.Row-level security policies
RLS is enabled on every table. Policies follow two patterns: users can only access their own rows, and users withrole = 'admin' can access all rows.
profiles
| Policy | Operation | Rule |
|---|---|---|
| Users can view own profile | SELECT | auth.uid() = id |
| Users can update own profile | UPDATE | auth.uid() = id |
| Enable insert for authenticated users | INSERT | auth.uid() = id |
| Admins can view all profiles | SELECT | Caller has role = 'admin' |
| Admins can update all profiles | UPDATE | Caller has role = 'admin' |
| Admins can delete profiles | DELETE | Caller has role = 'admin' |
levels
| Policy | Operation | Rule |
|---|---|---|
| Anyone can view levels | SELECT | Always true (public read) |
| Admins can manage levels | ALL | Caller has role = 'admin' |
task_items
| Policy | Operation | Rule |
|---|---|---|
| Anyone can view active tasks | SELECT | Always true (public read) |
| Admins can manage task items | ALL | Caller has role = 'admin' |
user_tasks
| Policy | Operation | Rule |
|---|---|---|
| Users can view own tasks | SELECT | auth.uid() = user_id |
| Users can insert own tasks | INSERT | auth.uid() = user_id |
| Users can update own tasks | UPDATE | auth.uid() = user_id |
| Admins can manage all user tasks | ALL | Caller has role = 'admin' |
referral_codes
| Policy | Operation | Rule |
|---|---|---|
| Anyone can view active referral codes | SELECT | is_active = true (public read for validation) |
| Users can manage own referral codes | ALL | auth.uid() = owner_id |
| Admins can manage all referral codes | ALL | Caller has role = 'admin' |
transactions
| Policy | Operation | Rule |
|---|---|---|
| Users can view own transactions | SELECT | auth.uid() = user_id |
| Admins can manage all transactions | ALL | Caller has role = 'admin' |
The
transactions table intentionally omits a user INSERT policy. All transaction rows are created server-side (via API routes using the service role key) to prevent users from writing arbitrary ledger entries.