Access Levels
Platform Premium is stored only at /. App paths use
basic, app_admin, vip, or vvip.
Workspace
Eatalyst Dashboard
Signed in workspace
User access
Applications
My Permissions
Application Access
Requests
Users
User Results
User Detail
Select a user to inspect permissions and resource usage.
Global Admin
Use App / platform user access for Basic, Premium, App Admin, VIP, and VVIP. Use Global admin role only for Eatalyst Admin delegation.
App Access
Global Admins
Access Requests
VIP Change Requests
Access Control Schema
Current model
One account identity, app-scoped permissions, strict admin audit.
Supabase Auth owns identity. Dashboard APIs read and write permission tables through server-side Pages Functions; browser clients do not directly access protected permission rows.
Identity
Supabase Auth
user id, email, username metadata
Server gate
Pages Functions
service role, RLS enabled, no direct client table writes
Dashboard
Admin Console
role checks, schema gate, audit-required mutations
Access
page_access_grants
user_id + path_prefix + access_level
Global admin
page_admin_grants
root-only senior_admin or eatalyst_admin
App requests
access_requests
requested app slug, status, reviewer metadata
VIP workflow
app_permission_change_requests
two-admin review for VIP changes
Audit
permission_audit_logs
actor, target, action, old and new levels
Usage
app_resource_usage
quota-aware app metrics per user
Workflow
HKU Timesheet Generator
/hku-timesheet-generator · app.eatalyst.com
Map analytics
Eatamap Shenzhen
/demo/shenzhen · map.eatalyst.com
Planning
Atrium HK
/apps/atrium-hk · hkadc.eatalyst.com
Admin Scope
Senior and Eatalyst Admins manage the platform. App Admins manage only their scoped app and can directly set Basic or No access.
HKU Timesheet Path
The canonical path is /hku-timesheet-generator. Legacy
hku-timesheet request slugs remain readable for old requests.
Data Protection
Permission tables have RLS enabled. Pages Functions use server secrets, return filtered rows, and log admin mutations before protected changes are accepted.