LeagueCaddie
LeagueCaddieGolf & Good TimesWeek 3 Open
RSCommissioner Security
Security & Access
A production-readiness map for roles, protected routes, tenant data rules, file storage, and audit expectations.
V1 authorization
Role Model
No league access
Can only reach sign-in or future marketing/onboarding pages.
League member
Can view league data, board posts, standings, results, and their own profile details.
League administrator
Can manage setup, players, weeks, scorecards, money, rules, and moderation.
Server-only automation
Reserved for extraction jobs, exports, and trusted server-side writes.
Required before web-facing launch
Production Gate
Authentication provider selected
Supabase Auth or another provider needs to become the source of user sessions.
Owner: securityTenant and role policies
Database RLS must enforce tenant_id, commissioner access, and player-owned content before public hosting.
Owner: securityActive rules profile
Golf & Good Times scoring, gross skins, and payout settings are represented in the active profile.
Owner: commissionerReal roster loaded
Active players, substitutes, and commissioner access are represented in mock data.
Owner: commissionerPrivate file storage
Scorecard images, avatars, and exports need private tenant-scoped storage buckets.
Owner: securityRoute access map
Protected Routes
| Route | Audience | Reason |
|---|---|---|
| /dashboard | authenticated | League home requires a signed-in player or commissioner. |
| /weeks/* | authenticated | Scores and results are league-member content. |
| /standings | authenticated | League standings are visible to signed-in league members. |
| /money | authenticated | Money visibility is role-aware after sign-in. |
| /board | authenticated | League discussion is member-only. |
| /players/* | authenticated | Profiles show league-member identity and stats. |
| /admin/* | commissioner | Setup, scoring, finance, and rules management are commissioner-only. |
| /admin/weeks/*/scorecards | commissioner | Printable scorecards are generated by commissioners. |
| /admin/weeks/*/scorecard-capture | commissioner | Uploaded scorecard review posts official scoring data. |
| /api/scorecard-extraction/* | service | Future extraction jobs should run with server-side service credentials only. |
RLS policy intent
Data Access Rules
League schedule, standings, score results, and board postspublic league
Players: Signed-in league members can read visible league records.
Commissioners: Commissioners can read and moderate all visible league records.
Player contact, profile, and avatar detailsown player
Players: Players can update their own avatar and limited contact details.
Commissioners: Commissioners can update player status, substitute flags, contact cleanup, and admin access.
Team identity and weekly participationteam member
Players: Either rostered player can update team logo/details and indicate substitute needs.
Commissioners: Commissioners can manage all teams and weekly assignments.
Financial transactionscommissioner only
Players: Golf & Good Times currently allows league-visible finance summaries, but player payment edits remain locked.
Commissioners: Commissioners can record payments, adjustments, skins opt-ins, and payouts.
Rules profiles, tenant feature flags, and audit logscommissioner only
Players: Players can read member-facing active rules only.
Commissioners: Commissioners can draft and activate tenant-scoped rules with audit history.
Private files
Storage Access Rules
scorecard-imagescommissioner only
Uploads: Commissioners only
Original scorecard uploads should be private, tenant-scoped, and linked from review/audit pages.
player-avatarsown player
Uploads: Owning player or commissioner
Images should be square-cropped and readable by signed-in league members.
team-logosteam member
Uploads: Rostered team member or commissioner
Either player on the team can update the logo; commissioner can moderate/remove.
exportscommissioner only
Uploads: Server-side export job
Generated PDFs should expire or be regenerated rather than stored publicly forever.
Trust layer