Real owner control room
This page keeps the stable User Management controls and folds in the tested simple account-delete queue. Profile management still uses sb_owner_manage_profile. Account deletion uses the real sb_account_deletion_requests queue and the server-side sb-account-delete Edge Function for spare normal users only.
Checking...
Rows RLS allows this verified owner/admin to see.
Current managed profile.
Rows from the real request queue.
- Role admin/user
- can_submit
- account_status
- admin_level
- plan_key
- permissions_json
Delete requests now live here. Select request, click the right button, type DELETE, done. No ID field. No email field.
Admin/owner/platform-owner targets never show the delete path. They can only be declined/cancelled.
User management writes stay in RPC. Real Auth deletion stays in the Edge Function.
Users
Manage selected user
Set the intended values, then open Confirm Real Update. Leave fields as “keep” to avoid changing them.
Account deletion requests
This is the tested simple delete system. Admin/owner requests can only be declined/cancelled. Spare normal accounts can be deleted server-side after typing DELETE.
Audit log
Safety locks
This page loads stream-bandit-protected-page-v7-12-273.js and uses the shared route map.
User reads, profile writes and delete queue actions stop unless the signed-in profile is owner/admin/platform_owner.
The browser uses only the publishable Supabase client and the signed-in user token.
The UI blocks protected targets, and the Edge Function blocks them again server-side.
Profile writes go through sb_owner_manage_profile.
Only sb-account-delete can remove a spare normal Auth user.