feat: migrate auth + Kraal off D1 to Supabase identity.person

[bryanfawcett]

Why

Per direction "if we have Supabase we don't need D1" + "don't use the worker for auth — reduce the lift the worker is doing" + "build for the platform, not in isolation". First slices of a multi-stage D1 → Supabase migration. PRs in this stack are kept open until Supabase is fully adopted — nothing merges until D1 is gone.

Stacks on top of #33 (Supabase ↔ WorkOS access-token wiring + vitest @/ alias).

Design philosophy: nyuchi_platform_db is a knowledge graph

The audit revealed the platform DB is structured as a typed graph, not a relational DB:

• Domains as schemas — events, places, identity, circles, engagement, system, etc. — each is a node-type cluster
• Edges as context_schema + context_entity_type + context_entity_id — generic typed cross-schema references. Examples already in the wild:
  • identity.person_role.context_* (a role within an entity, circle, place, etc.)
  • engagement.review.item_reviewed_schema + item_reviewed_id (review on any entity)
  • places.place_relations (typed graph edges between places)
• Schema.org alignment is the contract — almost every table maps to a schema.org @type via column comments. events.check_in → CheckInAction, events.rsvp_action → RsvpAction, engagement.follow_action → FollowAction, etc.

Therefore: all new tables in this stack must use the same patterns — schema.org-aligned column names, knowledge-graph context edges, no nhimbe-specific schemas.

Corrected Supabase inventory (full audit)

I undercounted heavily before. The platform DB has 31 user schemas, not 2. Most of nhimbe's domain model already exists in Postgres:

events.* — full nhimbe events schema already exists

nhimbe D1 table	Already in Supabase as
events	events.event (52 cols, schema.org Event, RRULE/series/check-in/waitlist/visibility/owner_type already on the row)
registrations	events.rsvp_action (RsvpAction)
ticketing	events.ticket + events.ticket_tier (Offer)
attendance (QR)	events.check_in (CheckInAction)
waitlists	events.waitlist_entry (WaitAction)
event_reviews	engagement.review (cross-schema)
event_series	NOT a separate table — events.event already has rrule, series_parent_id, recurrence_end, series_occurrence
host roles	events.organiser (Role wrapper, can_* permission columns)
organiser→attendee	events.event_update (Message)
event comments	events.comment
event polls	events.poll + events.poll_vote
programme/agenda	events.programme_item
save event	events.save_action

identity.* — full role/permission system

• identity.person (2 rows) with role (text NOT NULL) on the row + active_roles array (denormalized)
• identity.role_type (40 rows): admin, moderator, platform_admin, circle_admin, circle_moderator, compliance_officer, creator, developer, employee, finance_officer, regulator, support, support_finance, user, data_researcher, …
• identity.role_permission (98), identity.platform_permission (43)
• identity.person_role — context-scoped role assignments
• identity.entity (97 rows, schema.org Organization umbrella, has workos_org_id)
• entity.membership (2 rows) — universal person ↔ entity join

→ Replaces the D1 users.role column. getAdminUser reads identity.person.role.

places.* — geography with real data

• places.places_geo (93 rows: cities/towns/districts) ← nhimbe cities source, not "derived from published events"
• places.places (2079 rows, schema.org Place — venues)
• places.place_category (129), places.countries (54), places.provinces (73)

engagement.*

• engagement.interest_category (40 rows) ← replaces D1 categories
• engagement.review ← replaces D1 event_reviews
• engagement.follow_action ← replaces D1 follows

system.*

• system.activity_logs + system.change_history ← replaces D1 audit_logs
• system.theme (5 rows, mineral palette) ← replaces D1 themes
• system.notifications, system.feature_flags, system.unified_submissions

service_bus.* (170 subs, 169 event types, 822 events logged)

service_bus.events (append-only log), event_types, subscriptions, dead_letter_queue, event_processing, service_health ← replaces Cloudflare ANALYTICS_QUEUE + EMAIL_QUEUE.

nyuchi_pay_db — separate Supabase project

Production-grade payment system (config, ledger w/ double-entry bookkeeping, provider, gateway, stream outbox, audit). worker/src/payments/paynow.ts and the D1 payments table both get deleted in a later slice.

Other social schemas already present

circles.* (Kraal), campfire.*, pulse.*, shamwari.* (AI), ubuntu.* (badges/missions/leaderboards), wallet.* (mit_token, NFTs, swaps, balance, payment_intents).

Genuinely missing — needs new platform-wide schemas

New schema: device.* — generic device pairing/sessions for the whole platform

Used by nhimbe (kiosk + signage), mukoko bushtrade (POS), mukoko lingo (classroom display), mukoko news (newsroom screens) — anyone needing a paired display/terminal.

CREATE SCHEMA device;

-- Knowledge graph node — a registered device
-- schema.org: Product (additionalType = mukoko:Device, mukoko:Kiosk, mukoko:POS, etc.)
CREATE TABLE device.device (
  id uuid PRIMARY KEY DEFAULT system.uuidv7(),
  name text NOT NULL,                    -- schema:name
  device_type text NOT NULL,             -- schema:additionalType: kiosk | signage | pos | classroom_display | …
  model text,                            -- schema:model
  manufacturer text,                     -- schema:manufacturer
  serial_number text,                    -- schema:serialNumber

  -- Knowledge graph edge to whatever the device is bound to
  context_schema text,                   -- 'events' | 'commerce' | 'lingo' | 'news' | …
  context_entity_type text,              -- 'events.event' | 'commerce.outlet' | …
  context_entity_id uuid,

  owner_person_id uuid REFERENCES identity.person(id),
  owner_entity_id uuid REFERENCES identity.entity(id),

  status text NOT NULL DEFAULT 'active', -- active | idle | revoked | retired
  registered_at timestamptz DEFAULT now(),
  last_seen_at timestamptz,
  metadata jsonb DEFAULT '{}'::jsonb,
  created_at timestamptz DEFAULT now(),
  updated_at timestamptz DEFAULT now()
);

-- Pairing flow — schema.org RegisterAction
-- agent = the operator generating the code, instrument = the code,
-- result = the device that gets registered
CREATE TABLE device.pairing (
  id uuid PRIMARY KEY DEFAULT system.uuidv7(),
  code text NOT NULL UNIQUE,             -- schema:identifier (6-char short)

  -- Where the device is being paired (graph edge)
  context_schema text NOT NULL,          -- 'events'
  context_entity_type text NOT NULL,     -- 'events.event'
  context_entity_id uuid NOT NULL,
  intended_device_type text NOT NULL,    -- kiosk | signage | pos | …

  initiated_by_person_id uuid NOT NULL REFERENCES identity.person(id),

  claimed_at timestamptz,
  claimed_by_device_id uuid REFERENCES device.device(id),

  status text NOT NULL DEFAULT 'pending', -- pending | claimed | expired | revoked
  expires_at timestamptz NOT NULL,
  created_at timestamptz DEFAULT now()
);
CREATE INDEX device_pairing_code_pending_idx ON device.pairing(code) WHERE status = 'pending';
CREATE INDEX device_pairing_context_idx ON device.pairing(context_schema, context_entity_id);

-- Active sessions (post-pairing). Token hash, not raw token.
CREATE TABLE device.session (
  id uuid PRIMARY KEY DEFAULT system.uuidv7(),
  device_id uuid NOT NULL REFERENCES device.device(id) ON DELETE CASCADE,
  token_hash text NOT NULL UNIQUE,
  started_at timestamptz NOT NULL DEFAULT now(),
  expires_at timestamptz NOT NULL,
  last_activity_at timestamptz NOT NULL DEFAULT now(),
  revoked_at timestamptz,
  ip_address inet,
  user_agent text,
  created_at timestamptz DEFAULT now()
);
CREATE INDEX device_session_device_active_idx ON device.session(device_id) WHERE revoked_at IS NULL;

This deletes the D1 kiosk_pairings table. Nhimbe kiosk/signage become consumers of device.* with context_schema='events', context_entity_type='events.event'.

New table: engagement.referral — generic cross-schema referrals

Used by events (referrer→event), circles (referrer→circle), commerce (referrer→outlet), etc.

CREATE TABLE engagement.referral (
  id uuid PRIMARY KEY DEFAULT system.uuidv7(),

  referrer_person_id uuid NOT NULL REFERENCES identity.person(id),
  referred_person_id uuid REFERENCES identity.person(id),  -- null until conversion

  code text NOT NULL UNIQUE,             -- schema:identifier
  share_url text,                        -- schema:url

  -- Knowledge graph edge — what's being referred to
  target_schema text NOT NULL,           -- 'events' | 'circles' | 'commerce' | …
  target_entity_type text NOT NULL,      -- 'events.event' | 'circles.circle' | …
  target_entity_id uuid NOT NULL,

  status text NOT NULL DEFAULT 'pending', -- pending | converted | expired
  converted_at timestamptz,

  created_at timestamptz DEFAULT now()
);
CREATE INDEX referral_code_idx ON engagement.referral(code);
CREATE INDEX referral_referrer_idx ON engagement.referral(referrer_person_id);
CREATE INDEX referral_target_idx ON engagement.referral(target_schema, target_entity_id);

This deletes the D1 referrals and user_referral_codes tables.

Analytics → emit as service_bus.events

D1 event_views, search_queries become events on the bus. No new tables.

RLS advisories the platform_db owners should fix

-- nyuchi_platform_db: 4 sync.* tables have RLS disabled
ALTER TABLE sync.reference_data_version ENABLE ROW LEVEL SECURITY;
ALTER TABLE sync.outbound_log           ENABLE ROW LEVEL SECURITY;
ALTER TABLE sync.satellite_config       ENABLE ROW LEVEL SECURITY;
ALTER TABLE sync.inbound_log            ENABLE ROW LEVEL SECURITY;
-- (Followed by service-role-only policies — sync tables are infra.)

-- nyuchi_pay_db: 8 tables have RLS disabled
ALTER TABLE gateway.usage_log_2026_04        ENABLE ROW LEVEL SECURITY;
ALTER TABLE gateway.usage_log_2026_05        ENABLE ROW LEVEL SECURITY;
ALTER TABLE gateway.usage_log_2026_06        ENABLE ROW LEVEL SECURITY;
ALTER TABLE gateway.usage_log_2026_07        ENABLE ROW LEVEL SECURITY;
ALTER TABLE gateway.usage_log_2026_08        ENABLE ROW LEVEL SECURITY;
ALTER TABLE system.verification_tier         ENABLE ROW LEVEL SECURITY;
ALTER TABLE system.verification_subject_type ENABLE ROW LEVEL SECURITY;
ALTER TABLE system.trust_score_weights       ENABLE ROW LEVEL SECURITY;

What this PR does (incremental commits — no merge until D1 is gone)

1. Frontend Supabase auth migration (commits a-c, landed)

• src/lib/supabase/api.ts: getPersonByWorkosId, getPersonByEmail, upsertPersonFromWorkos, updatePersonProfile
• auth-context.tsx: removed fetch(/api/auth/sync) — now upserts identity.person directly
• updateProfile() rewritten to call updatePersonProfile() against identity.person. Signature changed: (sessionJwt, fields) → (personId, fields). All 4 callers updated.

2. Worker auth routes deleted (commit d, landed)

• worker/src/routes/auth.ts removed entirely (POST /sync, GET /me, PATCH /profile)

3. Two prod Kraal bugs fixed

• circles.post_reaction.reaction_type (was wrongly reaction)
• identity.person.name/givenname/familyname columns (was wrongly display_name/given_name/family_name) — every Kraal author label was rendering "Member" in prod

Coming next in this PR

• getAdminUser → identity.person.role (no more D1 users read)
• worker/src/db/supabase.ts REST helper using SERVICE_ROLE_KEY
• Apply migrations: device.* (3 tables) + engagement.referral

Coming in follow-up PRs

• Events writes → events.* directly from frontend (RLS-protected)
• Reviews → engagement.review; cities → places.places_geo; categories → engagement.interest_category
• Themes → system.theme; audit logs → system.activity_logs
• Kiosk routes (worker/src/routes/kiosk.ts) → device.* REST/edge function
• Payments → nyuchi_pay_db (delete worker/src/payments/paynow.ts)
• Queues → service_bus.events (delete Cloudflare Queue bindings)
• Drop DB binding from wrangler.toml + delete D1 schema/migrations + delete worker/src/db/

Worker eventually keeps only: AI inference (Workers AI), R2 image uploads, Vectorize search.

Verified so far

npm run lint            # 0 errors
npm run test:run        # 160 / 160
cd worker && npx vitest run   # 279 / 279
cd worker && npx tsc --noEmit # clean
npm run build           # clean

https://claude.ai/code/session_01Dp6YFZCHz1HjL9svPWmso2

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nhimbe	Ready	Preview, Comment	May 8, 2026 1:16pm

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	mukoko-nhimbe-api	bf24dc3	Commit Preview URL Branch Preview URL	May 08 2026, 01:15 PM