Backend & Supabase
The Supabase backend — Edge Functions, database migrations and setup.
The entire backend runs on Supabase: PostgreSQL with Row-Level Security, Auth, Storage, and a set of Edge Functions that keep secrets off the device and wrap external APIs. The website and the app share the same project.
Edge Functions
Server-side logic lives in supabase/functions/. Each function is a small Deno
handler:
| Function | What it does |
|---|---|
gemini | Proxies calls to Google Gemini so the API key never ships in the app. |
fatsecret | Wraps FatSecret's OAuth so food search / barcode lookups stay secure. |
send-email | Sends transactional email (OTP codes) over SMTP. |
delete-account | Deletes a user and all their data on request. |
stripe-checkout | Creates a Stripe Checkout session for Premium. |
stripe-webhook | Receives Stripe events and updates subscription state. |
Moving these to the server means the client never holds the Gemini, FatSecret or Stripe secrets, and gives a single place to enforce rules.
Database migrations
The schema is built incrementally through thirteen migrations (001–013) plus a
base setup_supabase.sql:
| Migration | Adds |
|---|---|
001_add_diet_and_weight_tables | Diet plans and weight history. |
002_pantry_items_self_contained | Self-contained pantry items. |
003_water_log | Daily hydration log. |
004_shopping_list | Shopping list. |
005_meal_slots_and_shopping_check | Custom meal slots + shopping check-off. |
006_users_rls_and_ensure_rpc | User RLS policies and an ensure-user RPC. |
007_pantry_fat_secret_id | FatSecret id on pantry items. |
008_rename_fat_secret_id_to_food_ref_id | Renames it to the canonical food_ref_id. |
009_avatars_storage_bucket | Storage bucket for avatars. |
010_add_missing_users_columns | Extra user columns. |
011_premium_subscription | Premium-subscription columns. |
012_stripe_columns | Stripe customer / subscription columns. |
013_meal_items_unidade | Unit field on meal items. |
The tables and their relationships are documented in
Data model. The food_ref_id (migration 008)
is the canonical food identifier used across the Pantry, Diet and Foods.
Security
Every table is protected by Row-Level Security (user_id = auth.uid()), so a user
can only ever read their own rows. Passwords use bcrypt, transport uses TLS 1.3, and
data at rest is AES-256. Full detail in Security.
Setup
Provisioning a backend means: create a Supabase project, run setup_supabase.sql, then
apply migrations 001–013, deploy the Edge Functions, and set the function secrets
(Gemini, FatSecret, SMTP, Stripe). See the app repo's docs/ for the Stripe and
GitHub Actions setup guides.