Quickback for Supabase RLS

Quickback for Supabase RLS compiles the same defineTable() definitions into PostgreSQL Row Level Security policies for Supabase. You keep Supabase Auth, Storage, and Realtime — Quickback adds the database-level security layer.

Who this is for

You're already on Supabase (or want to be) and you want:

• Database-level security — RLS policies enforced even if a service role key leaks
• A type-safe DSL — write security rules in TypeScript, compile to SQL
• One source of truth — the same firewall and access config that powers a Quickback Hono API also generates RLS policies

What you don't get from this target: generated API routes, batch endpoints, OpenAPI spec, MCP server. Those live with Quickback for Hono API. For Supabase you bring your own application code (PostgREST, Edge Functions, or your own server) and the RLS policies enforce security beneath it.

What compiles to RLS

See Mappings for full examples and Limitations for what to handle in app code.

Quick start

import { defineConfig, defineRuntime, defineDatabase, defineAuth } from "@quickback/compiler";

export default defineConfig({
  name: "my-app",
  providers: {
    runtime: defineRuntime("supabase"),
    database: defineDatabase("supabase"),
    auth: defineAuth("supabase-auth"),
  },
});

quickback compile
supabase db push

The compiler emits RLS migrations under supabase/migrations/. See Setup for the full flow.

In this section

• Setup — Configure the target, compile, apply migrations
• Mappings — Which definitions become which RLS policies
• Limitations — What doesn't compile and how to handle it