RBAC Session Auditor.
Every request is checked against a Supabase login and a Redis session whitelist. Three roles, instant revocation, and an audit log of everything that gets denied.
Scroll to explore ⌄How it works
01
Clean the path
Reject ../, double encoding and other tricks before anything else runs.
02
Verify the token
Check the Supabase JWT signature, issuer, audience and expiry.
03
Check the whitelist
The session has to exist in Redis. Revoked sessions stop here.
04
Check the role
The role is read from Redis, so a change applies on the next request.
Roles
Guest
/dashboardAny signed-in user. New accounts start here.
Engineer
/engineerEngineer role or higher.
Admin
/adminAudit log, role changes and session revocation.
Console · example output
17:02:11loginUser 3f2a9c1d signed in from 203.0.113.7
17:03:40deniedUser 3f2a9c1d (guest) tried to open /admin from 203.0.113.7 - access denied
17:05:02revokedAdmin 91be44a0 revoked 2 session(s) for user 3f2a9c1d
17:05:09deniedUser 3f2a9c1d used a revoked or expired session on /dashboard - access denied
Create an account, try opening /admin as a guest, and the attempt shows up in the real log.