Auth & row-level security

Generated apps get end-user signup/login. Passwords live in the platform database; app tables use RLS so users only see their own rows.

End-user auth

• Routes under /__appbricx/auth/* (signup, login, session).
• Client helpers from @appbricx/data: db.auth.signup, login, getUser.
• First signup in a project can become admin (isAdmin flag).

RLS pattern

ALTER TABLE tasks ENABLE ROW LEVEL SECURITY;
CREATE POLICY tasks_owner ON tasks
  USING (created_by::text = current_setting('app.user_id', true))
  WITH CHECK (created_by::text = current_setting('app.user_id', true));

The data worker sets app.user_id from the app session on each query. Admin elevated reads require a signed admin session.

Shared waitlist / CRM tables

Some templates (waitlist, saas-leads) allow broader SELECT so an admin dashboard can list all signups. Prefer explicit policies over disabling RLS.

See also: Named queries · Data templates