Customer orders

Team access

Add a helper email after that person has created an account. They can then sign in, view orders and submit products for your approval.

Connect your database

Run this SQL once in Supabase → SQL Editor:

-- QuickOrder team roles + product approval. Run in Supabase SQL Editor.
create table if not exists public.products (
  id bigint generated by default as identity primary key,
  name text not null, description text default '', active boolean default true,
  status text not null default 'approved' check (status in ('pending','approved','rejected')),
  submitted_by uuid references auth.users(id), created_at timestamptz default now()
);
alter table public.products add column if not exists status text not null default 'approved';
alter table public.products add column if not exists submitted_by uuid references auth.users(id);
create table if not exists public.orders (
  id bigint generated by default as identity primary key, customer_name text not null,
  teacher text not null, items jsonb not null, notes text default '', created_at timestamptz default now()
);
create table if not exists public.team_members (email text primary key, role text not null default 'helper' check (role='helper'), created_at timestamptz default now());
alter table public.products enable row level security;
alter table public.orders enable row level security;
alter table public.team_members enable row level security;
-- Remove old policies so the new role rules are not accidentally bypassed.
drop policy if exists "Anyone can view active products" on public.products;
drop policy if exists "Admins manage products" on public.products;
drop policy if exists "Anyone can submit orders" on public.orders;
drop policy if exists "Admins view orders" on public.orders;
drop policy if exists "Public can view approved products" on public.products;
drop policy if exists "Owner manages products" on public.products;
drop policy if exists "Helpers submit pending products" on public.products;
drop policy if exists "Owner and helpers view orders" on public.orders;
drop policy if exists "Owner manages team" on public.team_members;
drop policy if exists "Members view own team record" on public.team_members;
create or replace function public.quickorder_is_helper() returns boolean
language sql security definer set search_path = public stable as $$
  select exists (select 1 from public.team_members tm where lower(tm.email)=lower(auth.jwt()->>'email') and tm.role='helper');
$$;
create policy "Public can view approved products" on public.products for select to anon, authenticated using (active=true and status='approved');
create policy "Owner manages products" on public.products for all to authenticated using ((auth.jwt()->>'email')='discordbot@coolsite.net') with check ((auth.jwt()->>'email')='discordbot@coolsite.net');
create policy "Helpers submit pending products" on public.products for insert to authenticated with check (public.quickorder_is_helper() and status='pending' and submitted_by=auth.uid());
create policy "Helpers view own pending products" on public.products for select to authenticated using (public.quickorder_is_helper() and submitted_by=auth.uid());
create policy "Anyone can submit orders" on public.orders for insert to anon, authenticated with check (true);
create policy "Owner and helpers view orders" on public.orders for select to authenticated using ((auth.jwt()->>'email')='discordbot@coolsite.net' or public.quickorder_is_helper());
create policy "Owner manages team" on public.team_members for all to authenticated using ((auth.jwt()->>'email')='discordbot@coolsite.net') with check ((auth.jwt()->>'email')='discordbot@coolsite.net');
create policy "Members view own team record" on public.team_members for select to authenticated using (lower(email)=lower(auth.jwt()->>'email'));
-- Add the starter products only if they are not already present.
insert into public.products (name,description,status) select 'Chicken','Chicken order.','approved' where not exists (select 1 from public.products where lower(name)='chicken');
insert into public.products (name,description,status) select 'Konjac','Konjac order.','approved' where not exists (select 1 from public.products where lower(name)='konjac');

Keep your owner account as discordbot@coolsite.net. Helpers create their own account using Create helper account, then you approve their email in Admin → Team. Run the updated SQL above once. Keep the publishable key in CONFIG; never use a service-role key in this HTML.