Platform
Member sections: every client logs in to their own account, not a generic page
A login is only worth building if there is something behind it. GoGee's member area is a set of real account screens backed by real data ownership rules, not a welcome message with the customer's first name in it.
Because access is enforced in the database rather than in the interface, a customer cannot reach another customer's records by changing a URL.
GoGee feature series · 28 of 33
How it's actually built
- Auth
- Supabase authentication with profile records
- Account screens
- Orders, invoices, vouchers, addresses, saved baskets
- Business screens
- Business orders and delegated buyers
- Isolation
- Row-level security scoped to the authenticated user
- Delegate access
- Granted through database functions used inside RLS policies
- Roles
- Separate role records, not a column on the profile
- 01Input
Auth
Supabase authentication with profile records
- 02Deterministic
Account screens
Orders, invoices, vouchers, addresses, saved baskets
- 03Deterministic
Business screens
Business orders and delegated buyers
- 04Deterministic
Isolation
Row-level security scoped to the authenticated user
- 05Output
Delegate access
Granted through database functions used inside RLS policies
Member sections & client logins, data flow, generated from the shared GoGee feature diagram template.
What a logged-in customer actually gets
Order history, invoices, active vouchers, saved delivery addresses and saved baskets, each on its own screen. For business accounts there are additional views for orders placed on the account and for the delegates who may act on it.
For a trade or B2B site this is the difference between an ecommerce toy and a working account: a buyer can see what was ordered, by whom, and re-order from it.
- Invoices available without emailing the office
- Saved baskets and addresses speed up repeat ordering
- Business accounts see who placed each order
Security is in the database, not the interface
Every account table carries row-level security policies scoped to the authenticated user. Where a delegate needs broader reach, invoices and addresses on the owner's account, for example, that reach is granted by security-definer database functions referenced from the policy, so the rule is written once and applies to every query path.
Roles are held in their own table rather than as a field on the user profile. That is a deliberate security decision: a user cannot escalate their own privileges by updating their profile row.
Questions we get asked
Can one customer see another customer's orders?
No. Access is restricted by row-level security policies in the database, not by hiding links in the interface.
Can a company give an employee access to its account?
Yes, delegated buyers can be invited with viewer or purchaser permission.
Are invoices available in the portal?
Yes, alongside orders, vouchers, addresses and saved baskets.
Read next
Security
Role-based access control
GoGee stores roles in a dedicated table and checks them with security-definer functions inside row-level secur…
Ecommerce operations
Enterprise ecommerce ops
Inside GoGee's operational layer: capacity-based delivery slots, shipping zones and rate bands, business accou…
Marketing
Onsite loyalty engine
GoGee's native loyalty engine: configurable earning actions, a points ledger with a running balance, redemptio…