In progressSoftware

CourseMate

Study groups for Waterloo students taking the same courses.

Next.js
Supabase
PostgreSQL
Vercel

Built

Email sign-in with Supabase Auth
Postgres model: profiles, courses, groups, memberships
Row-level security guards every row

Architecture

Browser
Next.js UI
Supabase Auth
email sign-in
PostgreSQL
profiles · courses · groups · memberships
RLS policies
who may see which rows

Data model and request path

Insight

Put security where the data lives. RLS checks every query inside Postgres, so the UI never has to be trusted.

Challenge

ProblemClient-side permission checks can be bypassed.

FixMoved authorization into PostgreSQL RLS policies keyed on auth.uid().

Code

sqlIllustrative sketch — not copied from the project

alter table groups enable row level security;-- Members can read the groups they belong tocreate policy "members read their groups" on groups  for select using (    exists (select 1 from memberships m            where m.group_id = groups.id              and m.user_id = auth.uid())  );

The pattern an RLS policy follows — written to explain the design, not copied from the CourseMate code.

Status

Done

In progress — the code isn't public yet.

Sign in with email
Find or start a study group for a course you're taking