Orbit Docs
Get Started
Deployment
Architecture
Architecture Overview
Shared Packages
Database
Database Schema
Triggers & Functions
Features
Spaces
Posts
Comments
Follows
Notifications
Feeds
Roles
Roles & Permissions
Api
Admin Api
Users
Roles
Site Configuration
Content Moderation — Posts
Content Moderation — Spaces
Hub Api
Spaces
Posts
Comments
Reactions
Memberships
Follows
Feeds
Uploads
Views
Other Api
Profile
Public Profiles
Notifications
Leaderboard
About
OG Metadata
User Search
Sponsored
Aveiro
aveiro.app
TrademarkTrademark
Ctrl k
Search...
Sign up
Orbit Docs
Get Started
Deployment
Architecture
Architecture Overview
Shared Packages
Database
Database Schema
Triggers & Functions
Features
Spaces
Posts
Comments
Follows
Notifications
Feeds
Roles
Roles & Permissions
Api
Admin Api
Users
Roles
Site Configuration
Content Moderation — Posts
Content Moderation — Spaces
Hub Api
Spaces
Posts
Comments
Reactions
Memberships
Follows
Feeds
Uploads
Views
Other Api
Profile
Public Profiles
Notifications
Leaderboard
About
OG Metadata
User Search
Sponsored
orbit.dopler.app
Sponsored
orbit.dopler.app
Sponsored
Aveiro
aveiro.app
TrademarkTrademark
OrbitSupa Social by Dopler
© Dopler. All rights reserved.
Built with Aveiro

Architecture Overview

How the apps and shared packages fit together in the Supa Hub monorepo.
Updated 11d ago
Shared Packages
Supa Hub is structured as a pnpm monorepo managed by Turborepo. The two apps share logic through nine internal packages.

Apps

Hub (apps/hub)

The main community application. Handles spaces, posts, comments, reactions, feeds, follows, notifications, leaderboard, and user profiles. Runs on Next.js 15 with Once UI. Key responsibilities:
  • Rendering all community pages (home feed, spaces, posts, user profiles)
  • 35+ API routes that delegate to shared handlers in packages/api-handlers
  • Middleware with Upstash rate limiting and Supabase session refresh
  • File uploads to Supabase Storage
Pages:
Route
Description
/Home feed (global or personalized)
/discoverBrowse all spaces
/leaderboardTop users by engagement
/rulesSite rules (editable by moderators)
/newCreate a new post
/s/newCreate a new space
/s/[space]Space page with post feed
/s/[space]/[post]Single post with comments
/s/[space]/newCreate post in a space
/u/[user]User profile page with follows
/settingsUser settings

Auth (apps/auth)

Centralized authentication and administration service. Runs on Next.js 15 with Once UI. Key responsibilities:
  • Login, signup, and password reset flows via Supabase Auth
  • OAuth callback handling (/api/auth/callback)
  • Profile management (username, bio, avatar, cover, handle)
  • Admin panel for user management, role assignment, site configuration, and content moderation
  • Shares cookies with the hub app across subdomains
Pages:
Route
Description
/Login / signup
/profileEdit profile
/update-passwordPassword reset
/adminAdmin dashboard (user management, role assignment)
/admin/configSite configuration (space creation permissions, etc.)
/admin/postsContent moderation for posts
/admin/spacesContent moderation for spaces
/privacy-policyPrivacy policy
/terms-of-useTerms of use

Documentation

This site. It lives outside the monorepo and is hosted on Aveiro, so documentation changes ship independently of the apps.

Request Flow

  • The middleware (proxy.ts in hub) runs on every request. It rate-limits via Upstash Redis and refreshes the Supabase session cookie.
  • API routes in apps/hub/src/app/api/ are thin wrappers that import and call handler functions from @supa-hub/api-handlers.
  • Handler functions authenticate via authenticateRequest() (session cookies), then use the Supabase admin client (service role key) to bypass RLS and perform database operations.
  • Client components fetch data from these API routes and render using Once UI components.

Authentication Flow

Both apps use packages/sb to create Supabase clients that read/write cookies scoped to the parent domain (.yourdomain.com), enabling seamless cross-subdomain authentication.

Security

  • CSRF protection — All mutation API routes verify the request origin via authenticateRequest(), which includes a same-origin check
  • XSS prevention — User-submitted MDX content blocks JavaScript execution
  • SVG sanitization — Uploaded SVGs are scanned for scripts, event handlers, and foreign objects
  • Server-side auth — All permissions are verified server-side from session cookies, never trusting client-passed role ranks
Browser → Vercel Edge → Next.js Middleware (rate limit + session refresh) → API Route → @supa-hub/api-handlers → Supabase (via service role client) → Response
Hub (yourdomain.com)           Auth (auth.yourdomain.com)
│                                │
│  User clicks "Sign in"         │
│ ─────────────────────────────► │
│                                │  Supabase Auth (OAuth / email)
│                                │ ◄────────────────────────────
│                                │  /api/auth/callback
│                                │  Sets cookie on .yourdomain.com
│  Redirect back to hub          │
│ ◄───────────────────────────── │
│  Cookie is readable            │
│  (shared domain)               │