User role management? Custom claims apart from user metadata?

[development-vargamarcel]

1.Hello i would like to be able to change roles from the dashboard or be able to somehow manage roles via an api but i see that i can only change password and some other claims.

2.A I would like to be able to add some more claims in the root of the jwt.For now i can only play with the user_metadata claim.
2.B If not 2A,then maybe add some way to secure user_metadata update operation. For instance let only admins update user_metadata but prohibit users even from updating their own user_metadata.

3.possibility to have a list of roles per user instead of just one?

thx! Have a nice day!

[danielpox]

There is the app_metadata, which can only be edited by the service_role key (server-side, admin), but still accessed by the client in the jwt or user object of the session.

[GaryAustin1]

https://github.com/supabase-community/supabase-custom-claims This shows that being used.