Use when working with Supabase auth, pgvector, RLS, settings tables, or JWT verification. Covers Orcanos-specific Supabase patterns including allowlist auth, live settings, and vector search.
auth.py)auth.pyAUTH_DISABLED=true skips token verification (mock admin user)auth.users.id → public.users.auth_idCreate the user row in public.users table first — the auth hook blocks any Google login not pre-registered.
settings.py)rag_settings Supabase tableGET /settingsanswer_temperature, router_temperature, fuzzy_match_threshold, chat_model, embedding_model, top_k_chunks, similarity_threshold, chunk_size, chunk_overlap, enable_debug_logging
pgvector with cosine similaritytext-embedding-3-small → 1536 dimensionsrepository_id (multi-tenant isolation)search_documents_by_name() — used by router Stage 2search_chunks_hybrid() — used by RAG pipelinerepository_idowner/editor/viewer)repository_members tablesupabase_client.py)All DB operations centralized here:
insert_document() — upsert into documentsinsert_chunks() — bulk insert into doc_chunksupdate_doc_name_vector() — update name embedding for routersearch_chunks_hybrid() — hybrid vector + FTS searchsearch_documents_by_name() — router name search RPCSUPABASE_URL=https://xxx.supabase.co
SUPABASE_SERVICE_KEY=...
SUPABASE_JWT_SECRET=... # for local JWT verification
Never commit these. Use substitution variables in Cloud Build trigger for production.