Core Tables:

1. artworks stores art information, media urls and references lens and address table.
2. When user visits the website a unique id is stored in his browser’s cookies.
3. We create offers for merchantswhich acts as All notifications. Then user subscribes to a notification (unlocking the reward) if they have scanned the AR art for required duration.

Security & Access

• Row Level Security (RLS): Strictly enforced. Clients can only read their own notifications or insert scans tied to their authenticated user_id.
• Server-Side Mutations: All critical state changes (claiming a prize, registering a scan) are processed server-side to prevent client-side request spoofing.
• We are using Supabase Storage buckets to host and manage all large, unstructured media files like audio, images, video.

Admin Bypass (Service Role):

• I use a Supabase Admin client (service_role key) on the server to safely bypass Row Level Security (RLS).
• Why it's needed: RLS strictly prevents clients from creating user records or modifying reward states. The Admin client allows secure server actions to insert new anonymous users and manage their notifications (subscriptions/rewards) without ever exposing those permissions to the frontend.

Content Management:

• /admin/dashboard route is used for managing and inserting new artworks, merchants, and offers into the database.