neta/docs/database/0010-internal-auth-user-creation.md

0010 - Internal Auth User Creation

SQL file:

supabase/migrations/0010_allow_internal_auth_user_creation.sql

Purpose

Allows Neta's trusted server-side flows to create Auth users after public registration is locked.

This is required for client portal accounts. Public signup remains blocked after the first admin account, but the application can create internal users through the service role key.

Changes

• Adds neta_internal.internal_auth_creations.
• Adds public.request_internal_auth_creation(target_email, target_reason).
• Grants that RPC only to service_role.
• Updates public.handle_new_user() so it accepts a short-lived internal creation request.
• Reloads the PostgREST schema cache.

Operational Notes

The application calls the RPC immediately before calling the Supabase Auth Admin API. The pending request expires after two minutes and is consumed by the Auth user trigger.