IOTA Watch: an optional-auth device watchlist backed by Supabase RLS

[molimao]

I maintain IOTA Watch, an MIT-licensed training/mining monitor. Supabase stores the optional IOTA device watchlist, while mining/training readings come from separate public upstream APIs.

An account is optional: an anonymous visitor can keep three IOTA Miner IDs in the current browser. Google login through the current Lovable OAuth integration enables a cloud watchlist intended for up to ten devices, including labels and add times.

The small schema was the useful implementation detail for me:

• user_devices holds user_id, the public Miner ID (hotkey), a label and timestamp, with a unique (user_id, hotkey) constraint.
• Authenticated reads and writes rely on the table policy using auth.uid() = user_id in both USING and WITH CHECK.
• The insert trigger checks the device limit. The client maps duplicate and limit errors to specific messages instead of reporting a successful save.
• The XID and Quantus address lists remain browser-local; the site does not claim that those lists sync through the IOTA account.

Open source and setup notes include the schema and RLS migration and watchlist operations. Independent hosting needs a separate Supabase project and OAuth configuration.

The browser tool is read-only with respect to mining: no wallet connection, private keys, seed phrases or reward withdrawals. The public FAQ explains the project and data boundaries.

Sharing this as a small real application of optional auth plus an account-owned watchlist. I would welcome suggestions on keeping the database model simple as the device list evolves.

[elijahbrownsk-png]

One case to design for as the model grows is the anonymous visitor who saved three IDs in the browser and then signs in with Google. Merging that local list into user_devices with an upsert that ignores conflicts on (user_id, hotkey) makes the merge safe to repeat, so signing in again or from a second tab doesn't throw duplicate-key errors at the user. Trimming the hotkey before insert is worth it too, since an ID pasted with a trailing space would otherwise get past the unique constraint as a different device.