Chen (Ryan) Liu

Chen (Ryan) Liu

PhD student in Accounting and Finance at the University of Glasgow Adam Smith Business School.

PaperMove user onboarding and isolation check

PaperMove user onboarding and isolation check

PaperMove uses one Supabase project, but every authenticated user receives a separate database row and a separate Storage folder. Users must never receive Supabase Dashboard access, a secret key, or a database password.

One-time Auth configuration

In Authentication > URL Configuration:

  • Set the Site URL to https://chen-liu.com/papermove/.
  • Add https://chen-liu.com/papermove/** to Redirect URLs.
  • During local testing, also allow http://127.0.0.1:4174/papermove/**.

Invite a user

  1. Open Authentication > Users.
  2. Select Add user > Send invitation.
  3. Enter the user’s email and send the invitation.
  4. The user opens the invitation, sets a password of at least 12 characters, and enrolls a TOTP authenticator.
  5. After AAL2 verification, PaperMove automatically creates an empty workspace owned by that user’s Supabase UUID.

If an invitation expires, send a new one. Do not create or share a common PaperMove password.

Second-account isolation test

Use a second email address that you control:

  1. Invite the second address and complete password and MFA setup.
  2. In the second account, create a project named SECOND ACCOUNT TEST and upload one harmless test file.
  3. Sign out completely.
  4. Sign in as the original owner and verify that the test project and test file are absent.
  5. Create a harmless owner-only project or file, sign out, and sign back in as the second account. Verify the owner-only item is absent.
  6. Run both SQL files in the SQL Editor:
    • supabase/tests/papermove_rls_isolation.sql
    • supabase/tests/papermove_storage_isolation.sql
  7. Delete the harmless test data after the check.

Passing both the real two-account test and the SQL tests confirms that AAL2 users cannot read or change another user’s workspace or private files.

File-box limits

Each account may store at most 30 files, and each file may be at most 20 MiB. The website checks the limit before uploading. The Storage INSERT policy must also include private.papermove_has_file_capacity() so a modified client cannot bypass the limit.