Supabase architecture (Postgres, Auth, Storage, Realtime, Edge Functions) - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Supabase Auth Behavior

Which of the following best describes how Supabase Auth manages user sessions after login?

A Supabase Auth stores the session token only in memory and loses it on page reload.

B Supabase Auth stores a session token in local storage and automatically refreshes it using a refresh token.

C Supabase Auth requires the user to manually re-login every 30 minutes to maintain session.

D Supabase Auth uses cookies that expire immediately after login, requiring constant re-authentication.

💡 Hint

Think about how persistent login works in web apps.

Supabase Auth securely stores session tokens in local storage and uses refresh tokens to keep the session alive without user intervention.

❓ Architecture

intermediate

Supabase Storage Usage Scenario

You want to store user-uploaded images in Supabase Storage. Which statement correctly describes how Supabase Storage integrates with other Supabase services?

A Supabase Storage requires manual configuration of access rules outside of Supabase Auth.

B Supabase Storage is a separate service and does not integrate with Supabase Auth for access control.

C Supabase Storage automatically replicates files into the Postgres database for backup.

D Supabase Storage uses Supabase Auth to control access to files, allowing only authenticated users to upload or download files.

💡 Hint

Consider how access control is unified in Supabase.

Supabase Storage integrates with Supabase Auth to enforce access control, ensuring only authorized users can manage files.

❓ service_behavior

advanced

Realtime Updates with Supabase Realtime

Given a Supabase Realtime subscription to a Postgres table, what happens when a new row is inserted into that table?

A The client subscribed to the table immediately receives a realtime event with the new row data.

B Supabase Realtime only sends events for updates, not inserts.

C The new row is only visible after a manual refresh of the client application.

D The client must poll the database every few seconds to see new rows.

💡 Hint

Realtime means instant updates pushed to clients.

Supabase Realtime listens to Postgres changes and pushes insert, update, and delete events instantly to subscribed clients.

❓ Configuration

advanced

Edge Functions Deployment in Supabase

Which of the following is true about deploying Edge Functions in Supabase?

A Edge Functions are serverless functions deployed close to users for low latency and scale automatically.

B Edge Functions run on the client device and require manual scaling.

C Edge Functions must be deployed inside the Postgres database as stored procedures.

D Edge Functions only run during database migrations.

💡 Hint

Think about what 'edge' means in cloud computing.

Supabase Edge Functions are serverless, run near users geographically, and scale automatically without manual intervention.

❓ security

expert

Securing Supabase Postgres with Row Level Security (RLS)

You want to ensure users can only see their own data in a Supabase Postgres table. Which RLS policy correctly enforces this?

Supabase

CREATE POLICY "Users can view their own data" ON messages FOR SELECT USING (auth.uid() = user_id);

A The policy allows users to select rows where the Postgres user ID matches the user_id column.

B The policy allows all users to select all rows without restriction.

C The policy allows users to select rows where the Supabase auth.uid() matches the user_id column.

D The policy denies all SELECT operations on the messages table.

💡 Hint

auth.uid() returns the current logged-in user's ID.

This RLS policy uses Supabase's auth.uid() function to compare with the user_id column, restricting access to only the user's own rows.

Practice

1. Which Supabase component is responsible for managing user sign-ups and logins?

easy

A. Storage

B. Postgres

C. Realtime

D. Auth

Solution

1. Step 1: Understand Supabase components

   Supabase has several parts: Postgres for data, Auth for users, Storage for files, Realtime for live updates, and Edge Functions for custom code.

2. Step 2: Identify user management part

   The component that handles user sign-ups, logins, and authentication is called Auth.

3. Final Answer:

   Auth -> Option D

4. Quick Check:

   User management = Auth [OK]

Hint: Auth means user login and signup system [OK]

Common Mistakes:

• Confusing Postgres with user management
• Thinking Storage handles users
• Mixing Realtime with authentication

2. Which of the following is the correct way to initialize Supabase client in JavaScript?

easy

A. const supabase = Supabase.create('url', 'anon_key');

B. const supabase = createClient('url', 'anon_key');

C. const supabase = supabaseClient('url', 'anon_key');

D. const supabase = new Supabase('url', 'anon_key');

Solution

1. Step 1: Recall Supabase client initialization syntax

   Supabase uses the function createClient(url, key) to create a client instance.

2. Step 2: Match correct syntax

   const supabase = createClient('url', 'anon_key'); matches the exact syntax: const supabase = createClient('url', 'anon_key');

3. Final Answer:

   const supabase = createClient('url', 'anon_key'); -> Option B

4. Quick Check:

   Use createClient() to initialize Supabase [OK]

Hint: Use createClient() function to start Supabase [OK]

Common Mistakes:

• Using new keyword with Supabase
• Calling wrong function names
• Mixing class and function syntax

3. Given this code snippet, what will be logged if a new row is inserted into the 'messages' table?

const subscription = supabase
  .from('messages')
  .on('INSERT', payload => {
    console.log('New message:', payload.new.text);
  })
  .subscribe();

medium

A. New message: [text of inserted row]

B. New message: undefined

C. Error: .subscribe() is not a function

D. No output, subscription does not listen to INSERT

Solution

1. Step 1: Understand Realtime subscription

   The code listens for INSERT events on the 'messages' table and logs the new row's text field.

2. Step 2: Analyze the callback behavior

   When a new row is inserted, payload.new contains the new row data, so payload.new.text is the inserted message text.

3. Final Answer:

   New message: [text of inserted row] -> Option A

4. Quick Check:

   Realtime INSERT event logs new row text [OK]

Hint: INSERT event payload.new has new row data [OK]

Common Mistakes:

• Expecting payload.old instead of payload.new
• Thinking .subscribe() is invalid
• Assuming no output on INSERT

4. You wrote this Edge Function to upload a file to Supabase Storage but it fails with a permission error. What is the likely cause?

export async function POST(request) {
  const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
  const data = await request.formData();
  const file = data.get('file');
  const { error } = await supabase.storage.from('avatars').upload(file.name, file);
  if (error) return new Response(error.message, { status: 400 });
  return new Response('Upload successful');
}

medium

A. Storage upload requires user session, missing auth

B. The 'avatars' bucket does not exist

C. File object is not properly extracted from formData

D. Using SERVICE_ROLE_KEY in Edge Function is insecure and disabled

Solution

1. Step 1: Check authentication context for storage upload

   Storage upload requires a user session or proper auth context; using service role key alone in Edge Functions does not provide user session.

2. Step 2: Identify missing user session

   Without user session, storage upload is denied due to permission error.

3. Final Answer:

   Storage upload requires user session, missing auth -> Option A

4. Quick Check:

   Storage upload needs user auth session [OK]

Hint: Storage upload needs user session, not just service key [OK]

Common Mistakes:

• Assuming service role key works for storage upload
• Ignoring bucket existence
• Not checking file extraction from formData

5. You want to build a chat app using Supabase that updates messages live and stores user avatars. Which combination of Supabase components should you use?

hard

A. Auth for messages, Edge Functions for avatars, Storage for live updates

B. Realtime for messages and avatars, Postgres for user login

C. Postgres for messages, Storage for avatars, Realtime for live updates, Auth for user login

D. Storage for messages, Postgres for avatars, Edge Functions for live updates

Solution

1. Step 1: Identify storage needs

   Messages are structured data best stored in Postgres; avatars are files stored in Storage.

2. Step 2: Identify live update and user management

   Realtime provides live updates for messages; Auth manages user login.

3. Final Answer:

   Postgres for messages, Storage for avatars, Realtime for live updates, Auth for user login -> Option C

4. Quick Check:

   Use Postgres, Storage, Realtime, Auth together [OK]

Hint: Messages in Postgres, avatars in Storage, live with Realtime [OK]

Common Mistakes:

• Mixing Storage with live updates
• Using Realtime for file storage
• Confusing Auth with data storage