feat: reorganize supabase config - flat db init structure, add edge functions, mcp, kong api config

2026-02-22 00:31:50 +00:00
parent 95af17c02d
commit 31ecf136f7
54 changed files with 4383 additions and 1106 deletions
@@ -0,0 +1,279 @@
+_format_version: '2.1'
+_transform: true
+
+###
+### Consumers / Users
+###
+consumers:
+  - username: DASHBOARD
+  - username: anon
+    keyauth_credentials:
+      - key: $SUPABASE_ANON_KEY
+  - username: service_role
+    keyauth_credentials:
+      - key: $SUPABASE_SERVICE_KEY
+
+###
+### Access Control List
+###
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+###
+### Dashboard credentials
+###
+basicauth_credentials:
+  - consumer: DASHBOARD
+    username: $DASHBOARD_USERNAME
+    password: $DASHBOARD_PASSWORD
+
+###
+### API Routes
+###
+services:
+  ## Open Auth routes
+  - name: auth-v1-open
+    url: http://auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  ## Secure Auth routes
+  - name: auth-v1
+    _comment: 'GoTrue: /auth/v1/* -> http://auth:9999/*'
+    url: http://auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure REST routes
+  - name: rest-v1
+    _comment: 'PostgREST: /rest/v1/* -> http://rest:3000/*'
+    url: http://rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure GraphQL routes
+  - name: graphql-v1
+    _comment: 'PostgREST: /graphql/v1/* -> http://rest:3000/rpc/graphql'
+    url: http://rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - Content-Profile:graphql_public
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure Realtime routes
+  - name: realtime-v1-ws
+    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+    url: http://realtime-dev.supabase-realtime:4000/socket
+    protocol: ws
+    routes:
+      - name: realtime-v1-ws
+        strip_path: true
+        paths:
+          - /realtime/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+  - name: realtime-v1-rest
+    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+    url: http://realtime-dev.supabase-realtime:4000/api
+    protocol: http
+    routes:
+      - name: realtime-v1-rest
+        strip_path: true
+        paths:
+          - /realtime/v1/api
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+  ## Storage routes: the storage server manages its own auth
+  - name: storage-v1
+    _comment: 'Storage: /storage/v1/* -> http://storage:5000/*'
+    url: http://storage:5000/
+    routes:
+      - name: storage-v1-all
+        strip_path: true
+        paths:
+          - /storage/v1/
+    plugins:
+      - name: cors
+
+  ## Edge Functions routes
+  - name: functions-v1
+    _comment: 'Edge Functions: /functions/v1/* -> http://functions:9000/*'
+    url: http://functions:9000/
+    routes:
+      - name: functions-v1-all
+        strip_path: true
+        paths:
+          - /functions/v1/
+    plugins:
+      - name: cors
+
+  ## Analytics routes
+  - name: analytics-v1
+    _comment: 'Analytics: /analytics/v1/* -> http://logflare:4000/*'
+    url: http://analytics:4000/
+    routes:
+      - name: analytics-v1-all
+        strip_path: true
+        paths:
+          - /analytics/v1/
+
+  ## Secure Database routes
+  - name: meta
+    _comment: 'pg-meta: /pg/* -> http://pg-meta:8080/*'
+    url: http://meta:8080/
+    routes:
+      - name: meta-all
+        strip_path: true
+        paths:
+          - /pg/
+    plugins:
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+
+  ## MCP Server routes - Model Context Protocol for AI integrations
+  ## Authentication is handled by the MCP server itself (JWT validation)
+  - name: mcp-v1
+    _comment: 'MCP Server: /mcp/v1/* -> http://mcp:3100/mcp'
+    url: http://mcp:3100
+    routes:
+      - name: mcp-v1-all
+        strip_path: true
+        paths:
+          - /mcp/v1/
+    plugins:
+      - name: request-transformer
+        config:
+          replace:
+            uri: /mcp
+      - name: cors
+        config:
+          origins:
+            - "http://localhost:3000"
+            - "http://127.0.0.1:3000"
+            - "http://192.168.0.94:50001"
+          methods:
+            - GET
+            - POST
+            - DELETE
+            - OPTIONS
+          headers:
+            - Accept
+            - Authorization
+            - Content-Type
+            - X-Client-Info
+            - apikey
+            - Mcp-Session-Id
+          exposed_headers:
+            - Mcp-Session-Id
+          credentials: true
+          max_age: 3600
+  
+  ## Protected Dashboard - catch all remaining routes
+  #- name: dashboard
+  #  _comment: 'Studio: /* -> http://studio:3000/*'
+  #  url: http://studio:3000/
+  #  routes:
+  #    - name: dashboard-all
+  #      strip_path: true
+  #      paths:
+  #        - /
+  #  plugins:
+  #    - name: cors
+  #    - name: basic-auth
+  #      config:
+  #        hide_credentials: true
@@ -0,0 +1,82 @@
+-- ============================================================
+-- Supabase Core Roles & Schemas Initialization
+-- Runs first (50-) to set up all roles required by later scripts
+-- ============================================================
+
+-- Create supabase_admin role
+DO
+$$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_admin') THEN
+    CREATE ROLE supabase_admin WITH LOGIN CREATEROLE REPLICATION BYPASSRLS PASSWORD 'siqt3T9iHjWpjATtKdlBjJKOifiLf0Oe';
+  END IF;
+END
+$$;
+
+-- Create ALL standard Supabase roles needed by subsequent init scripts
+-- (56-roles.sql will ALTER these, so they must pre-exist)
+DO
+$$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'anon') THEN
+    CREATE ROLE anon NOLOGIN NOINHERIT;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'authenticated') THEN
+    CREATE ROLE authenticated NOLOGIN NOINHERIT;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'service_role') THEN
+    CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'authenticator') THEN
+    CREATE ROLE authenticator WITH NOINHERIT LOGIN PASSWORD 'siqt3T9iHjWpjATtKdlBjJKOifiLf0Oe';
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'pgbouncer') THEN
+    CREATE ROLE pgbouncer WITH LOGIN PASSWORD 'siqt3T9iHjWpjATtKdlBjJKOifiLf0Oe';
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_auth_admin') THEN
+    CREATE ROLE supabase_auth_admin WITH NOINHERIT CREATEROLE LOGIN PASSWORD 'siqt3T9iHjWpjATtKdlBjJKOifiLf0Oe';
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_storage_admin') THEN
+    CREATE ROLE supabase_storage_admin WITH NOINHERIT CREATEROLE LOGIN PASSWORD 'siqt3T9iHjWpjATtKdlBjJKOifiLf0Oe';
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_functions_admin') THEN
+    CREATE ROLE supabase_functions_admin WITH NOINHERIT CREATEROLE LOGIN PASSWORD 'siqt3T9iHjWpjATtKdlBjJKOifiLf0Oe';
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_replication_admin') THEN
+    CREATE ROLE supabase_replication_admin LOGIN REPLICATION;
+  END IF;
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_read_only_user') THEN
+    CREATE ROLE supabase_read_only_user BYPASSRLS;
+  END IF;
+END
+$$;
+
+-- Grant pg_read_server_files to supabase_admin (required by pg_net extension)
+GRANT pg_read_server_files TO supabase_admin;
+
+-- Core grants
+GRANT ALL ON DATABASE postgres TO supabase_admin WITH GRANT OPTION;
+GRANT anon TO authenticator;
+GRANT authenticated TO authenticator;
+GRANT service_role TO authenticator;
+GRANT supabase_auth_admin TO supabase_admin;
+GRANT supabase_storage_admin TO supabase_admin;
+GRANT supabase_functions_admin TO supabase_admin;
+
+-- Create _supabase database for internal Supabase services
+CREATE DATABASE _supabase WITH OWNER supabase_admin;
+
+-- Create required schemas in postgres database
+CREATE SCHEMA IF NOT EXISTS _supabase AUTHORIZATION supabase_admin;
+CREATE SCHEMA IF NOT EXISTS extensions AUTHORIZATION supabase_admin;
+
+-- Stub schemas: auth/storage populated by GoTrue/Storage services at runtime
+-- but must exist for 61-core-schema.sql to pass validation
+CREATE SCHEMA IF NOT EXISTS auth;
+CREATE SCHEMA IF NOT EXISTS storage;
+GRANT USAGE ON SCHEMA auth TO supabase_admin, supabase_auth_admin;
+GRANT USAGE ON SCHEMA storage TO supabase_admin, supabase_storage_admin;
+
+-- Switch to _supabase database and create required schemas
+\connect _supabase
+CREATE SCHEMA IF NOT EXISTS _analytics AUTHORIZATION supabase_admin;
@@ -0,0 +1,123 @@
+-- Create pg_net extension outside transaction (cannot run inside BEGIN/COMMIT)
+CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+
+BEGIN;
+  -- Create pg_net extension
+  -- pg_net extension created above (outside transaction)
+  -- Create the supabase_functions schema
+  CREATE SCHEMA IF NOT EXISTS supabase_functions AUTHORIZATION supabase_admin;
+  GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+  -- supabase_functions.migrations definition
+  CREATE TABLE supabase_functions.migrations (
+    version text PRIMARY KEY,
+    inserted_at timestamptz NOT NULL DEFAULT NOW()
+  );
+  -- Initial supabase_functions migration
+  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+  -- supabase_functions.hooks definition
+  CREATE TABLE supabase_functions.hooks (
+    id bigserial PRIMARY KEY,
+    hook_table_id integer NOT NULL,
+    hook_name text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT NOW(),
+    request_id bigint
+  );
+  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  COMMENT ON TABLE supabase_functions.hooks IS 'Webhook request logs stored temporarily while awaiting the request.';
+  CREATE FUNCTION supabase_functions.http_request()
+  RETURNS trigger
+  LANGUAGE plpgsql
+  AS $func$
+  DECLARE
+    request_id bigint;
+    payload jsonb;
+    url text := TG_ARGV[0]::text;
+    method text := TG_ARGV[1]::text;
+    headers jsonb DEFAULT '{}'::jsonb;
+    params jsonb DEFAULT '{}'::jsonb;
+    timeout_ms integer DEFAULT 1000;
+  BEGIN
+    IF url IS NULL OR url = 'null' THEN
+      RAISE EXCEPTION 'url argument is missing';
+    END IF;
+
+    IF method IS NULL OR method = 'null' THEN
+      RAISE EXCEPTION 'method argument is missing';
+    END IF;
+
+    IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+      headers = '{}'::jsonb;
+    ELSE
+      headers = TG_ARGV[2]::jsonb;
+    END IF;
+
+    IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+      params = '{}'::jsonb;
+    ELSE
+      params = TG_ARGV[3]::jsonb;
+    END IF;
+
+    IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+      timeout_ms = 1000;
+    ELSE
+      timeout_ms = TG_ARGV[4]::integer;
+    END IF;
+
+    CASE
+      WHEN method = 'GET' THEN
+        SELECT http_get INTO request_id FROM net.http_get(
+          url,
+          params,
+          headers,
+          timeout_ms
+        );
+      WHEN method = 'POST' THEN
+        payload = jsonb_build_object(
+          'old_record', OLD,
+          'record', NEW,
+          'type', TG_OP,
+          'table', TG_TABLE_NAME,
+          'schema', TG_TABLE_SCHEMA
+        );
+
+        SELECT http_post INTO request_id FROM net.http_post(
+          url,
+          payload,
+          headers,
+          timeout_ms
+        );
+      ELSE
+        RAISE EXCEPTION 'method argument % is invalid', method;
+    END CASE;
+
+    INSERT INTO supabase_functions.hooks
+      (hook_table_id, hook_name, request_id)
+    VALUES
+      (TG_RELID, TG_NAME, request_id);
+
+    RETURN NEW;
+  END
+  $func$;
+  -- Supabase super admin
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT FROM pg_catalog.pg_roles
+      WHERE rolname = 'supabase_functions_admin'
+    ) THEN
+      CREATE ROLE supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+    END IF;
+  END
+  $$;
+  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  ALTER function supabase_functions.http_request() OWNER TO supabase_functions_admin;
+  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183942_update_grants');
+  ALTER ROLE supabase_functions_admin SET search_path = supabase_functions;
+COMMIT;
@@ -0,0 +1,5 @@
+\set jwt_secret `echo "$JWT_SECRET"`
+\set jwt_exp `echo "$JWT_EXP"`
+
+ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
+ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
@@ -0,0 +1,3 @@
+-- Create analytics/logs schema
+CREATE SCHEMA IF NOT EXISTS _analytics;
+ALTER SCHEMA _analytics OWNER TO supabase_admin;
@@ -0,0 +1,3 @@
+-- create realtime schema for Realtime RLS (already exists but just in case)
+CREATE SCHEMA IF NOT EXISTS _realtime;
+ALTER SCHEMA _realtime OWNER TO supabase_admin;
@@ -0,0 +1,13 @@
+-- pgBouncer auth function
+CREATE OR REPLACE FUNCTION public.get_auth(p_usename TEXT) RETURNS TABLE(username TEXT, password TEXT) AS
+$$
+BEGIN
+    RAISE WARNING 'get_auth() called for user: %', p_usename;
+    RETURN QUERY
+    SELECT usename::TEXT, passwd::TEXT FROM pg_catalog.pg_shadow
+    WHERE usename = p_usename;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+REVOKE ALL ON FUNCTION public.get_auth(p_usename TEXT) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.get_auth(p_usename TEXT) TO pgbouncer;
@@ -0,0 +1,9 @@
+-- NOTE: change to your own passwords for production environments
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+
+ALTER USER supabase_admin WITH PASSWORD :'pgpass';
+ALTER USER authenticator WITH PASSWORD :'pgpass';
+ALTER USER pgbouncer WITH PASSWORD :'pgpass';
+ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
@@ -0,0 +1,345 @@
+--[ Database Schema Version ]--
+-- Version: 1.0.0
+-- Last Updated: 2024-02-24
+-- Description: Core schema setup for ClassConcepts with neoFS filesystem integration
+-- Dependencies: auth.users (Supabase Auth)
+
+--[ 1. Extensions ]--
+create extension if not exists "uuid-ossp";
+
+-- Create rpc schema if it doesn't exist
+create schema if not exists rpc;
+grant usage on schema rpc to anon, authenticated;
+
+-- Create exec_sql function for admin operations
+create or replace function exec_sql(query text)
+returns void as $$
+begin
+    execute query;
+end;
+$$ language plpgsql security definer;
+
+-- Create updated_at trigger function
+create or replace function public.handle_updated_at()
+returns trigger as $$
+begin
+    new.updated_at = timezone('utc'::text, now());
+    return new;
+end;
+$$ language plpgsql security definer;
+
+-- Create completed_at trigger function for document artefacts
+create or replace function public.set_completed_at()
+returns trigger as $$
+begin
+    if NEW.status = 'completed' and OLD.status != 'completed' then
+        NEW.completed_at = now();
+    end if;
+    return NEW;
+end;
+$$ language plpgsql security definer;
+
+--[ 5. Core Tables ]--
+-- Base user profiles
+create table if not exists public.profiles (
+    id uuid primary key references auth.users(id) on delete cascade,
+    email text not null unique,
+    user_type text not null check (
+        user_type in (
+            'teacher',
+            'student',
+            'email_teacher',
+            'email_student',
+            'developer',
+            'superadmin'
+        )
+    ),
+    username text not null unique,
+    full_name text,
+    display_name text,
+    metadata jsonb default '{}'::jsonb,
+    user_db_name text,
+    school_db_name text,
+    neo4j_sync_status text default 'pending' check (neo4j_sync_status in ('pending', 'ready', 'failed')),
+    neo4j_synced_at timestamp with time zone,
+    last_login timestamp with time zone,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.profiles is 'User profiles linked to Supabase auth.users';
+comment on column public.profiles.user_type is 'Type of user: teacher or student';
+
+-- Active institutes
+create table if not exists public.institutes (
+    id uuid primary key default uuid_generate_v4(),
+    name text not null,
+    urn text unique,
+    status text not null default 'active' check (status in ('active', 'inactive', 'pending')),
+    address jsonb default '{}'::jsonb,
+    website text,
+    metadata jsonb default '{}'::jsonb,
+    geo_coordinates jsonb default '{}'::jsonb,
+    neo4j_uuid_string text,
+    neo4j_public_sync_status text default 'pending' check (neo4j_public_sync_status in ('pending', 'synced', 'failed')),
+    neo4j_public_sync_at timestamp with time zone,
+    neo4j_private_sync_status text default 'not_started' check (neo4j_private_sync_status in ('not_started', 'pending', 'synced', 'failed')),
+    neo4j_private_sync_at timestamp with time zone,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.institutes is 'Active institutes in the system';
+comment on column public.institutes.geo_coordinates is 'Geospatial coordinates from OSM search (latitude, longitude, boundingbox)';
+
+--[ 6. neoFS Filesystem Tables ]--
+-- File cabinets for organizing files
+create table if not exists public.file_cabinets (
+    id uuid primary key default uuid_generate_v4(),
+    user_id uuid not null references public.profiles(id) on delete cascade,
+    name text not null,
+    created_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.file_cabinets is 'User file cabinets for organizing documents and files';
+
+-- Files stored in cabinets
+create table if not exists public.files (
+    id uuid primary key default uuid_generate_v4(),
+    cabinet_id uuid not null references public.file_cabinets(id) on delete cascade,
+    name text not null,
+    path text not null,
+    bucket text default 'file-cabinets' not null,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    mime_type text,
+    metadata jsonb default '{}'::jsonb,
+    size text,
+    category text generated always as (
+        case
+            when mime_type like 'image/%' then 'image'
+            when mime_type = 'application/pdf' then 'document'
+            when mime_type in ('application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document') then 'document'
+            when mime_type in ('application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet') then 'spreadsheet'
+            when mime_type in ('application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentationml.presentation') then 'presentation'
+            when mime_type like 'audio/%' then 'audio'
+            when mime_type like 'video/%' then 'video'
+            else 'other'
+        end
+    ) stored
+);
+comment on table public.files is 'Files stored in user cabinets with automatic categorization';
+comment on column public.files.category is 'Automatically determined file category based on MIME type';
+
+-- AI brains for processing files
+create table if not exists public.brains (
+    id uuid primary key default uuid_generate_v4(),
+    user_id uuid not null references public.profiles(id) on delete cascade,
+    name text not null,
+    purpose text,
+    created_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.brains is 'AI brains for processing and analyzing user files';
+
+-- Brain-file associations
+create table if not exists public.brain_files (
+    brain_id uuid not null references public.brains(id) on delete cascade,
+    file_id uuid not null references public.files(id) on delete cascade,
+    primary key (brain_id, file_id)
+);
+comment on table public.brain_files is 'Associations between AI brains and files for processing';
+
+-- Document artefacts from file processing
+create table if not exists public.document_artefacts (
+    id uuid primary key default uuid_generate_v4(),
+    file_id uuid references public.files(id) on delete cascade,
+    page_number integer default 0 not null,
+    type text not null,
+    rel_path text not null,
+    size_tag text,
+    language text,
+    chunk_index integer,
+    extra jsonb,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    status text default 'completed' not null check (status in ('pending', 'processing', 'completed', 'failed')),
+    started_at timestamp with time zone default timezone('utc'::text, now()),
+    completed_at timestamp with time zone,
+    error_message text
+);
+comment on table public.document_artefacts is 'Extracted artefacts from document processing';
+comment on column public.document_artefacts.status is 'Extraction status: pending, processing, completed, or failed';
+comment on column public.document_artefacts.started_at is 'Timestamp when extraction process started';
+comment on column public.document_artefacts.completed_at is 'Timestamp when extraction process completed (success or failure)';
+comment on column public.document_artefacts.error_message is 'Error details if extraction failed';
+
+-- Function execution logs
+create table if not exists public.function_logs (
+    id serial primary key,
+    file_id uuid references public.files(id) on delete cascade,
+    timestamp timestamp with time zone default timezone('utc'::text, now()),
+    step text,
+    message text,
+    data jsonb
+);
+comment on table public.function_logs is 'Logs of function executions and processing steps';
+
+--[ 7. Relationship Tables ]--
+-- Institute memberships
+create table if not exists public.institute_memberships (
+    id uuid primary key default uuid_generate_v4(),
+    profile_id uuid references public.profiles(id) on delete cascade,
+    institute_id uuid references public.institutes(id) on delete cascade,
+    role text not null check (role in ('teacher', 'student')),
+    tldraw_preferences jsonb default '{}'::jsonb,
+    metadata jsonb default '{}'::jsonb,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now()),
+    unique(profile_id, institute_id)
+);
+comment on table public.institute_memberships is 'Manages user roles and relationships with institutes';
+
+-- Membership requests
+create table if not exists public.institute_membership_requests (
+    id uuid primary key default uuid_generate_v4(),
+    profile_id uuid references public.profiles(id) on delete cascade,
+    institute_id uuid references public.institutes(id) on delete cascade,
+    requested_role text check (requested_role in ('teacher', 'student')),
+    status text default 'pending' check (status in ('pending', 'approved', 'rejected')),
+    metadata jsonb default '{}'::jsonb,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.institute_membership_requests is 'Tracks requests to join institutes';
+
+--[ 8. Audit Tables ]--
+-- System audit logs
+create table if not exists public.audit_logs (
+    id uuid primary key default uuid_generate_v4(),
+    profile_id uuid references public.profiles(id) on delete set null,
+    action_type text,
+    table_name text,
+    record_id uuid,
+    changes jsonb,
+    created_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.audit_logs is 'System-wide audit trail for important operations';
+
+--[ 9. Exam Specifications ]--
+create table if not exists public.eb_specifications (
+    id uuid primary key default uuid_generate_v4(),
+    spec_code text unique,
+    exam_board_code text,
+    award_code text,
+    subject_code text,
+    first_teach text,
+    spec_ver text,
+    
+    -- Document storage details
+    storage_loc text,
+    doc_type text check (doc_type in ('pdf', 'json', 'md', 'html', 'txt', 'doctags')),
+    doc_details jsonb default '{}'::jsonb, -- e.g. Tika extract
+    docling_docs jsonb default '{}'::jsonb, -- e.g. Docling extracts settings and storage locations
+    
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now())
+);
+
+comment on table public.eb_specifications is 'Exam board specifications and their primary document';
+comment on column public.eb_specifications.spec_code is 'Unique code for the specification, used for linking exams';
+comment on column public.eb_specifications.doc_details is 'Tika extract of the specification document';
+comment on column public.eb_specifications.docling_docs is 'Docling extracts settings and storage locations for the specification document';
+
+--[ 10. Exam Papers / Entries ]--
+create table if not exists public.eb_exams (
+    id uuid primary key default uuid_generate_v4(),
+    exam_code text unique,
+    spec_code text references public.eb_specifications(spec_code) on delete cascade,
+    paper_code text,
+    tier text,
+    session text,
+    type_code text,
+    
+    -- Document storage details
+    storage_loc text,
+    doc_type text check (doc_type in ('pdf', 'json', 'md', 'html', 'txt', 'doctags')),
+    doc_details jsonb default '{}'::jsonb, -- e.g. Tika extract
+    docling_docs jsonb default '{}'::jsonb, -- e.g. Docling extracts settings and storage locations
+    
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now())
+);
+
+comment on table public.eb_exams is 'Exam papers and related documents linked to specifications';
+comment on column public.eb_exams.exam_code is 'Unique code for the exam paper, used for linking questions';
+comment on column public.eb_exams.type_code is 'Type code for the exam document: Question Paper (QP), Mark Scheme (MS), Examiner Report (ER), Other (OT)';
+comment on column public.eb_exams.doc_details is 'Tika extract of the exam paper document';
+comment on column public.eb_exams.docling_docs is 'Docling extracts settings and storage locations for the exam paper document';
+
+--[ 11. Indexes ]--
+-- Index for geospatial queries
+create index if not exists idx_institutes_geo_coordinates on public.institutes using gin(geo_coordinates);
+create index if not exists idx_institutes_urn on public.institutes(urn); 
+
+-- Document artefacts indexes
+create index if not exists idx_document_artefacts_file_status on public.document_artefacts(file_id, status);
+create index if not exists idx_document_artefacts_file_type on public.document_artefacts(file_id, type);
+create index if not exists idx_document_artefacts_status on public.document_artefacts(status);
+
+-- File indexes
+create index if not exists idx_files_cabinet_id on public.files(cabinet_id);
+create index if not exists idx_files_mime_type on public.files(mime_type);
+create index if not exists idx_files_category on public.files(category);
+
+-- Brain indexes
+create index if not exists idx_brains_user_id on public.brains(user_id);
+
+-- Exam board indexes
+create index if not exists idx_eb_exams_exam_code on public.eb_exams(exam_code);
+create index if not exists idx_eb_exams_spec_code on public.eb_exams(spec_code);
+create index if not exists idx_eb_exams_paper_code on public.eb_exams(paper_code);
+create index if not exists idx_eb_exams_tier on public.eb_exams(tier);
+create index if not exists idx_eb_exams_session on public.eb_exams(session);
+create index if not exists idx_eb_exams_type_code on public.eb_exams(type_code);
+create index if not exists idx_eb_specifications_spec_code on public.eb_specifications(spec_code);
+create index if not exists idx_eb_specifications_exam_board_code on public.eb_specifications(exam_board_code);
+create index if not exists idx_eb_specifications_award_code on public.eb_specifications(award_code);
+create index if not exists idx_eb_specifications_subject_code on public.eb_specifications(subject_code);
+
+--[ 12. Triggers ]--
+-- Set completed_at when document artefact status changes to completed
+create trigger trigger_set_completed_at
+    before update on public.document_artefacts
+    for each row
+    execute function public.set_completed_at();
+
+-- Set updated_at on profile updates
+create trigger trigger_profiles_updated_at
+    before update on public.profiles
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on institute updates
+create trigger trigger_institutes_updated_at
+    before update on public.institutes
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on institute_memberships updates
+create trigger trigger_institute_memberships_updated_at
+    before update on public.institute_memberships
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on institute_membership_requests updates
+create trigger trigger_institute_membership_requests_updated_at
+    before update on public.institute_memberships
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on eb_specifications updates
+create trigger trigger_eb_specifications_updated_at
+    before update on public.eb_specifications
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on eb_exams updates
+create trigger trigger_eb_exams_updated_at
+    before update on public.eb_exams
+    for each row
+    execute function public.handle_updated_at();
@@ -0,0 +1,191 @@
+--[ 8. Auth Functions ]--
+-- Create a secure function to check admin status
+create or replace function public.is_admin()
+returns boolean as $$
+  select coalesce(
+    (select true
+     from public.profiles
+     where id = auth.uid()
+     and user_type = 'admin'),
+    false
+  );
+$$ language sql security definer;
+
+-- Create a secure function to check super admin status
+create or replace function public.is_super_admin()
+returns boolean as $$
+  select coalesce(
+    (select true
+     from public.profiles
+     where id = auth.uid()
+     and user_type = 'admin'),
+    false
+  );
+$$ language sql security definer;
+
+-- Create public wrapper functions
+-- Note: These are now the main implementation functions, not wrappers
+-- The original auth schema functions have been moved to public schema
+
+-- Grant execute permissions
+grant execute on function public.is_admin to authenticated;
+grant execute on function public.is_super_admin to authenticated;
+
+-- Initial admin setup function
+create or replace function public.setup_initial_admin(admin_email text)
+returns json
+language plpgsql
+security definer
+as $$
+declare
+    result json;
+begin
+    -- Only allow this to run as service role or superuser
+    if not (
+        current_user = 'service_role' 
+        or exists (
+            select 1 from pg_roles 
+            where rolname = current_user 
+            and rolsuper
+        )
+    ) then
+        raise exception 'Must be run as service_role or superuser';
+    end if;
+
+    -- Update user_type and username for admin
+    update public.profiles
+    set user_type = 'admin',
+        username = coalesce(username, 'superadmin'),
+        display_name = coalesce(display_name, 'Super Admin')
+    where email = admin_email
+    returning json_build_object(
+        'id', id,
+        'email', email,
+        'user_type', user_type,
+        'username', username,
+        'display_name', display_name
+    ) into result;
+
+    if result is null then
+        raise exception 'Admin user with email % not found', admin_email;
+    end if;
+
+    return result;
+end;
+$$;
+
+-- Grant execute permissions
+revoke execute on function public.setup_initial_admin from public;
+grant execute on function public.setup_initial_admin to authenticated, service_role;
+
+-- Create RPC wrapper for REST API access
+create or replace function rpc.setup_initial_admin(admin_email text)
+returns json
+language plpgsql
+security definer
+as $$
+begin
+    return public.setup_initial_admin(admin_email);
+end;
+$$;
+
+-- Grant execute permissions for RPC wrapper
+grant execute on function rpc.setup_initial_admin to authenticated, service_role;
+
+--[ 9. Utility Functions ]--
+-- Check if database is ready
+create or replace function check_db_ready()
+returns boolean
+language plpgsql
+security definer
+as $$
+begin
+    -- Check if essential schemas exist
+    if not exists (
+        select 1 
+        from information_schema.schemata 
+        where schema_name in ('auth', 'storage', 'public')
+    ) then
+        return false;
+    end if;
+
+    -- Check if essential tables exist
+    if not exists (
+        select 1 
+        from information_schema.tables 
+        where table_schema = 'auth' 
+        and table_name = 'users'
+    ) then
+        return false;
+    end if;
+
+    -- Check if RLS is enabled on public.profiles
+    if not exists (
+        select 1 
+        from pg_tables 
+        where schemaname = 'public' 
+        and tablename = 'profiles' 
+        and rowsecurity = true
+    ) then
+        return false;
+    end if;
+
+    return true;
+end;
+$$;
+
+-- Grant execute permission
+grant execute on function check_db_ready to anon, authenticated, service_role;
+
+-- Function to handle new user registration
+create or replace function public.handle_new_user()
+returns trigger
+language plpgsql
+security definer set search_path = public
+as $$
+declare
+    default_user_type text := 'email_student';
+    default_username text;
+begin
+    -- Generate username from email
+    default_username := split_part(new.email, '@', 1);
+    
+    insert into public.profiles (
+        id,
+        email,
+        user_type,
+        username,
+        display_name
+    )
+    values (
+        new.id,
+        new.email,
+        coalesce(new.raw_user_meta_data->>'user_type', default_user_type),
+        coalesce(new.raw_user_meta_data->>'username', default_username),
+        coalesce(new.raw_user_meta_data->>'display_name', default_username)
+    );
+    return new;
+end;
+$$;
+
+-- Trigger for new user creation
+drop trigger if exists on_auth_user_created on auth.users;
+create trigger on_auth_user_created
+    after insert on auth.users
+    for each row execute procedure public.handle_new_user();
+
+--[ 11. Database Triggers ]--
+drop trigger if exists handle_profiles_updated_at on public.profiles;
+create trigger handle_profiles_updated_at
+    before update on public.profiles
+    for each row execute function public.handle_updated_at();
+
+drop trigger if exists handle_institute_memberships_updated_at on public.institute_memberships;
+create trigger handle_institute_memberships_updated_at
+    before update on public.institute_memberships
+    for each row execute function public.handle_updated_at();
+
+drop trigger if exists handle_membership_requests_updated_at on public.institute_membership_requests;
+create trigger handle_membership_requests_updated_at
+    before update on public.institute_membership_requests
+    for each row execute function public.handle_updated_at(); 
@@ -0,0 +1,20 @@
+-- Storage policies configuration for Supabase
+-- Note: Storage bucket policies are managed by Supabase internally
+-- This file provides guidance on what should be configured
+
+-- Storage bucket policies should be configured through:
+-- 1. Supabase Dashboard > Storage > Policies
+-- 2. Or via SQL with proper permissions (requires service_role or owner access)
+
+-- Recommended policies for storage.buckets:
+-- - Super admin has full access to buckets
+-- - Users can create their own buckets  
+-- - Users can view their own buckets or public buckets
+
+-- Recommended policies for storage.objects:
+-- - Users can upload to buckets they own
+-- - Users can view objects in public buckets
+-- - Users can manage objects in buckets they own
+
+-- Note: These policies require the service_role or appropriate permissions
+-- to be applied to the storage schema tables 
@@ -0,0 +1,20 @@
+-- Initial admin setup for ClassroomCopilot
+-- This file handles basic database setup and permissions
+
+-- Ensure uuid-ossp extension is enabled
+create extension if not exists "uuid-ossp" schema extensions;
+
+-- Grant basic permissions to authenticated users for public schema
+-- Note: These permissions are granted to allow users to work with the application
+grant usage on schema public to authenticated;
+grant all on all tables in schema public to authenticated;
+grant all on all sequences in schema public to authenticated;
+grant all on all functions in schema public to authenticated;
+
+-- Set default privileges for future objects
+alter default privileges in schema public grant all on tables to authenticated;
+alter default privileges in schema public grant all on sequences to authenticated;
+alter default privileges in schema public grant all on functions to authenticated;
+
+-- Note: The setup_initial_admin function is defined in 62-functions-triggers.sql
+-- and should be called with an admin email parameter when needed 
@@ -0,0 +1,95 @@
+-- Files table augments and storage GC hooks
+
+-- 1) Add columns to files if missing
+do $$
+begin
+    if not exists (
+        select 1 from information_schema.columns
+        where table_schema='public' and table_name='files' and column_name='uploaded_by'
+    ) then
+        alter table public.files add column uploaded_by uuid references public.profiles(id);
+    end if;
+    if not exists (
+        select 1 from information_schema.columns
+        where table_schema='public' and table_name='files' and column_name='size_bytes'
+    ) then
+        alter table public.files add column size_bytes bigint;
+    end if;
+    if not exists (
+        select 1 from information_schema.columns
+        where table_schema='public' and table_name='files' and column_name='source'
+    ) then
+        alter table public.files add column source text default 'uploader-web';
+    end if;
+end $$;
+
+-- 2) Unique index for cabinet/path combo
+create unique index if not exists uq_files_cabinet_path on public.files(cabinet_id, path);
+
+-- 3) Storage GC helpers (ported from neoFS with storage schema)
+create or replace function public._delete_storage_objects(p_bucket text, p_path text)
+returns void
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+begin
+  if p_bucket is null or p_path is null then
+    return;
+  end if;
+  delete from storage.objects where bucket_id = p_bucket and name = p_path;
+  delete from storage.objects where bucket_id = p_bucket and name like p_path || '/%';
+end
+$$;
+
+create or replace function public._storage_gc_sql()
+returns trigger
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+begin
+  if tg_op = 'DELETE' then
+    perform public._delete_storage_objects(old.bucket, old.path);
+  elsif tg_op = 'UPDATE' then
+    if (old.bucket is distinct from new.bucket) or (old.path is distinct from new.path) then
+      perform public._delete_storage_objects(old.bucket, old.path);
+    end if;
+  end if;
+  return null;
+end
+$$;
+
+-- 4) Attach GC trigger to files bucket/path changes
+drop trigger if exists trg_files_gc on public.files;
+create trigger trg_files_gc
+after delete or update of bucket, path on public.files
+for each row execute function public._storage_gc_sql();
+
+-- 5) Document artefacts GC: remove artefact objects from storage when rows change/delete
+create or replace function public._artefact_gc_sql()
+returns trigger
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+declare
+  v_bucket text;
+begin
+  if tg_op = 'DELETE' then
+    select f.bucket into v_bucket from public.files f where f.id = old.file_id;
+    perform public._delete_storage_objects(v_bucket, old.rel_path);
+    return old;
+  elsif tg_op = 'UPDATE' then
+    if (old.rel_path is distinct from new.rel_path) or (old.file_id is distinct from new.file_id) then
+      select f.bucket into v_bucket from public.files f where f.id = old.file_id;
+      perform public._delete_storage_objects(v_bucket, old.rel_path);
+    end if;
+    return new;
+  end if;
+end
+$$;
+
+drop trigger if exists trg_document_artefacts_gc on public.document_artefacts;
+create trigger trg_document_artefacts_gc
+before delete or update of file_id, rel_path on public.document_artefacts
+for each row execute function public._artefact_gc_sql();
+
+
@@ -0,0 +1,84 @@
+-- Enable RLS and define policies for filesystem tables
+
+-- 1) Enable RLS
+alter table if exists public.file_cabinets enable row level security;
+alter table if exists public.files enable row level security;
+alter table if exists public.brain_files enable row level security;
+alter table if exists public.document_artefacts enable row level security;
+
+drop policy if exists "User can access own cabinets" on public.file_cabinets;
+create policy "User can access own cabinets" on public.file_cabinets
+using (user_id = auth.uid())
+with check (user_id = auth.uid());
+
+drop policy if exists "User can access files in own cabinet" on public.files;
+create policy "User can access files in own cabinet" on public.files
+using (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+))
+with check (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "User can insert files into own cabinet" on public.files;
+create policy "User can insert files into own cabinet" on public.files for insert to authenticated
+with check (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "User can update files in own cabinet" on public.files;
+create policy "User can update files in own cabinet" on public.files for update to authenticated
+using (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+))
+with check (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "User can delete files from own cabinet" on public.files;
+create policy "User can delete files from own cabinet" on public.files for delete
+using (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+-- 4) Brain-files: allow linking owned files to owned brains
+drop policy if exists "User can link files they own to their brains" on public.brain_files;
+create policy "User can link files they own to their brains" on public.brain_files
+using (
+  exists (select 1 from public.brains b where b.id = brain_files.brain_id and b.user_id = auth.uid())
+  and exists (
+    select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+    where f.id = brain_files.file_id and c.user_id = auth.uid()
+  )
+)
+with check (true);
+
+-- 5) Document artefacts: allow reads to owners via file cabinet, writes via service_role
+drop policy if exists "artefacts_read_by_owner" on public.document_artefacts;
+create policy "artefacts_read_by_owner" on public.document_artefacts for select to authenticated
+using (exists (
+  select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+  where f.id = document_artefacts.file_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "artefacts_rw_service" on public.document_artefacts;
+create policy "artefacts_rw_service" on public.document_artefacts to service_role
+using (true) with check (true);
+
+-- Allow owners to delete their artefacts (needed for cascades under RLS)
+drop policy if exists "artefacts_delete_by_owner" on public.document_artefacts;
+create policy "artefacts_delete_by_owner" on public.document_artefacts for delete to authenticated
+using (exists (
+  select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+  where f.id = document_artefacts.file_id and c.user_id = auth.uid()
+));
+
+-- File vectors RLS and policies are defined in 67-vectors.sql after the table is created
+
+
@@ -0,0 +1,79 @@
+-- Vectors: file_vectors table and similarity search function
+
+-- 1) Ensure pgvector extension is available
+create extension if not exists vector;
+
+-- 2) File vectors table
+create table if not exists public.file_vectors (
+    id bigint generated by default as identity primary key,
+    created_at timestamp with time zone default now() not null,
+    embedding public.vector,
+    metadata jsonb,
+    content text
+);
+
+-- 3) ANN index (skipped until embedding dimension is fixed)
+-- To enable: set column type to public.vector(<dim>) and uncomment:
+-- create index if not exists file_vectors_embedding_idx
+-- on public.file_vectors using ivfflat (embedding public.vector_cosine_ops)
+-- with (lists='100');
+
+-- 3b) Enable RLS and set policies (moved here to avoid ordering issues)
+alter table if exists public.file_vectors enable row level security;
+
+drop policy if exists "vectors_read_by_owner" on public.file_vectors;
+create policy "vectors_read_by_owner" on public.file_vectors for select to authenticated
+using (coalesce((metadata->>'file_id')::uuid, null) is null or exists (
+  select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+  where f.id = (metadata->>'file_id')::uuid and c.user_id = auth.uid()
+));
+
+drop policy if exists "vectors_rw_service" on public.file_vectors;
+create policy "vectors_rw_service" on public.file_vectors to service_role
+using (true) with check (true);
+
+-- 4) Match function mirrored from neoFS (generic metadata mapping)
+create or replace function public.match_file_vectors(
+    filter jsonb,
+    match_count integer,
+    query_embedding public.vector
+)
+returns table (
+    id bigint,
+    file_id uuid,
+    cabinet_id uuid,
+    artefact_type text,
+    artefact_is text,
+    original_path_prefix text,
+    original_filename text,
+    content text,
+    metadata jsonb,
+    similarity double precision
+)
+language sql stable as $$
+  select
+    fv.id,
+    nullif(fv.metadata->>'file_id','')::uuid              as file_id,
+    nullif(fv.metadata->>'cabinet_id','')::uuid           as cabinet_id,
+    nullif(fv.metadata->>'artefact_type','')              as artefact_type,
+    nullif(fv.metadata->>'artefact_is','')                as artefact_is,
+    nullif(fv.metadata->>'original_path_prefix','')       as original_path_prefix,
+    nullif(fv.metadata->>'original_filename','')          as original_filename,
+    fv.content,
+    fv.metadata,
+    1 - (fv.embedding <=> query_embedding)                as similarity
+  from public.file_vectors fv
+  where
+    (coalesce(filter ? 'file_id', false)                = false or (fv.metadata->>'file_id')::uuid              = (filter->>'file_id')::uuid)
+    and (coalesce(filter ? 'cabinet_id', false)         = false or (fv.metadata->>'cabinet_id')::uuid           = (filter->>'cabinet_id')::uuid)
+    and (coalesce(filter ? 'artefact_type', false)      = false or (fv.metadata->>'artefact_type')              = (filter->>'artefact_type'))
+    and (coalesce(filter ? 'artefact_id', false)        = false or (fv.metadata->>'artefact_id')                = (filter->>'artefact_id'))
+    and (coalesce(filter ? 'original_path_prefix', false)     = false or (fv.metadata->>'original_path_prefix') like  (filter->>'original_path_prefix') || '%')
+    and (coalesce(filter ? 'original_path_prefix_ilike', false)= false or (fv.metadata->>'original_path_prefix') ilike (filter->>'original_path_prefix_ilike') || '%')
+    and (coalesce(filter ? 'original_filename', false)   = false or (fv.metadata->>'original_filename')         = (filter->>'original_filename'))
+    and (coalesce(filter ? 'original_filename_ilike', false)= false or (fv.metadata->>'original_filename') ilike (filter->>'original_filename_ilike'))
+  order by fv.embedding <=> query_embedding
+  limit greatest(coalesce(match_count, 10), 1)
+$$;
+
+
@@ -0,0 +1,73 @@
+-- Cabinet memberships for sharing access
+
+create table if not exists public.cabinet_memberships (
+    id uuid default uuid_generate_v4() primary key,
+    cabinet_id uuid not null references public.file_cabinets(id) on delete cascade,
+    profile_id uuid not null references public.profiles(id) on delete cascade,
+    role text not null check (role in ('owner','editor','viewer')),
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now()),
+    unique(cabinet_id, profile_id)
+);
+
+create index if not exists idx_cabinet_memberships_cabinet on public.cabinet_memberships(cabinet_id);
+create index if not exists idx_cabinet_memberships_profile on public.cabinet_memberships(profile_id);
+
+-- Updated at trigger
+drop trigger if exists trg_cabinet_memberships_updated_at on public.cabinet_memberships;
+create trigger trg_cabinet_memberships_updated_at
+    before update on public.cabinet_memberships
+    for each row execute function public.handle_updated_at();
+
+-- RLS and policies
+alter table if exists public.cabinet_memberships enable row level security;
+
+-- Members can select their own memberships; cabinet owners can also see memberships
+drop policy if exists cm_read_self_or_owner on public.cabinet_memberships;
+create policy cm_read_self_or_owner on public.cabinet_memberships for select to authenticated
+using (
+  profile_id = auth.uid() or exists (
+    select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+  )
+);
+
+-- Cabinet owners can insert memberships
+drop policy if exists cm_insert_by_owner on public.cabinet_memberships;
+create policy cm_insert_by_owner on public.cabinet_memberships for insert to authenticated
+with check (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+));
+
+-- Cabinet owners can update memberships (e.g., role)
+drop policy if exists cm_update_by_owner on public.cabinet_memberships;
+create policy cm_update_by_owner on public.cabinet_memberships for update to authenticated
+using (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+))
+with check (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+));
+
+-- Cabinet owners can delete memberships
+drop policy if exists cm_delete_by_owner on public.cabinet_memberships;
+create policy cm_delete_by_owner on public.cabinet_memberships for delete to authenticated
+using (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+));
+
+-- Extend access to cabinets/files for members (after table exists)
+drop policy if exists "User can access cabinets via membership" on public.file_cabinets;
+create policy "User can access cabinets via membership" on public.file_cabinets for select to authenticated
+using (exists (
+  select 1 from public.cabinet_memberships m
+  where m.cabinet_id = file_cabinets.id and m.profile_id = auth.uid()
+));
+
+drop policy if exists "User can access files via membership" on public.files;
+create policy "User can access files via membership" on public.files for select to authenticated
+using (exists (
+  select 1 from public.cabinet_memberships m
+  where m.cabinet_id = files.cabinet_id and m.profile_id = auth.uid()
+));
+
+
@@ -0,0 +1,48 @@
+-- Ensure storage objects for all artefacts are removed when a file is deleted
+-- by deleting the entire "cabinet_id/file_id" directory prefix in Storage.
+
+-- Helper to delete all objects under a prefix
+create or replace function public._delete_storage_prefix(p_bucket text, p_prefix text)
+returns void
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+begin
+  if p_bucket is null or p_prefix is null then
+    return;
+  end if;
+  -- Delete any objects whose name starts with the prefix + '/'
+  delete from storage.objects where bucket_id = p_bucket and name like p_prefix || '/%';
+  -- In case an object exists exactly at the prefix (rare but safe)
+  delete from storage.objects where bucket_id = p_bucket and name = p_prefix;
+end
+$$;
+
+-- Update file-level GC to also delete the parent directory prefix (cabinet_id/file_id)
+create or replace function public._storage_gc_sql()
+returns trigger
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+declare
+  v_prefix text;
+begin
+  -- Derive directory prefix from the file path by removing the last segment (filename)
+  -- Example: 'cabinet_id/file_id/filename.ext' -> 'cabinet_id/file_id'
+  v_prefix := regexp_replace(old.path, '/[^/]+$', '');
+
+  if tg_op = 'DELETE' then
+    -- Delete the original object and any artefacts under the file's directory
+    perform public._delete_storage_objects(old.bucket, old.path);
+    perform public._delete_storage_prefix(old.bucket, v_prefix);
+  elsif tg_op = 'UPDATE' then
+    if (old.bucket is distinct from new.bucket) or (old.path is distinct from new.path) then
+      perform public._delete_storage_objects(old.bucket, old.path);
+      perform public._delete_storage_prefix(old.bucket, v_prefix);
+    end if;
+  end if;
+  return null;
+end
+$$;
+
+
@@ -0,0 +1,41 @@
+-- Add directory support to files table
+-- Migration: Add directory support for folder uploads
+
+-- Add new columns to files table
+ALTER TABLE files 
+ADD COLUMN IF NOT EXISTS is_directory BOOLEAN DEFAULT FALSE,
+ADD COLUMN IF NOT EXISTS parent_directory_id UUID REFERENCES files(id) ON DELETE CASCADE,
+ADD COLUMN IF NOT EXISTS relative_path TEXT,
+ADD COLUMN IF NOT EXISTS directory_manifest JSONB,
+ADD COLUMN IF NOT EXISTS upload_session_id UUID,
+ADD COLUMN IF NOT EXISTS processing_status TEXT DEFAULT 'uploaded' CHECK (processing_status IN ('uploaded', 'processing', 'completed', 'failed', 'queued'));
+
+-- Create index for efficient directory queries
+CREATE INDEX IF NOT EXISTS idx_files_parent_directory ON files(parent_directory_id);
+CREATE INDEX IF NOT EXISTS idx_files_upload_session ON files(upload_session_id);
+CREATE INDEX IF NOT EXISTS idx_files_processing_status ON files(processing_status);
+CREATE INDEX IF NOT EXISTS idx_files_is_directory ON files(is_directory);
+
+-- Create directory manifest structure
+COMMENT ON COLUMN files.is_directory IS 'True if this record represents a directory/folder';
+COMMENT ON COLUMN files.parent_directory_id IS 'ID of parent directory if this file is inside an uploaded folder';
+COMMENT ON COLUMN files.relative_path IS 'Relative path within the uploaded directory structure';
+COMMENT ON COLUMN files.directory_manifest IS 'JSON manifest of directory contents including file count, total size, structure';
+COMMENT ON COLUMN files.upload_session_id IS 'Groups files uploaded together in a single directory upload session';
+COMMENT ON COLUMN files.processing_status IS 'Simple status tracking without auto-processing';
+
+-- Example directory_manifest structure:
+-- {
+--   "total_files": 15,
+--   "total_size_bytes": 12345678,
+--   "directory_structure": {
+--     "documents/": {
+--       "file1.pdf": {"size": 123456, "mime_type": "application/pdf"},
+--       "subdirectory/": {
+--         "file2.docx": {"size": 234567, "mime_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document"}
+--       }
+--     }
+--   },
+--   "upload_timestamp": "2024-09-23T12:00:00Z",
+--   "upload_method": "directory_picker"
+-- }
@@ -0,0 +1,16 @@
+# Supabase Edge Functions
+
+This document describes the available Edge Functions in this self-hosted Supabase instance.
+
+## institute-geocoder
+
+Institute address geocoding using SearXNG/OpenStreetMap
+
+**Endpoints:**
+- `/functions/v1/institute-geocoder`
+- `/functions/v1/institute-geocoder/batch`
+
+**Usage:** POST with institute_id and optional address data
+
+**Dependencies:** SearXNG service, OpenStreetMap data
+
@@ -0,0 +1,16 @@
+// Follow this setup guide to integrate the Deno language server with your editor:
+// https://deno.land/manual/getting_started/setup_your_environment
+// This enables autocomplete, go to definition, etc.
+
+import { serve } from "https://deno.land/[email protected]/http/server.ts"
+
+serve(async () => {
+  return new Response(
+    `"Hello from Edge Functions!"`,
+    { headers: { "Content-Type": "application/json" } },
+  )
+})
+
+// To invoke:
+// curl 'http://localhost:<KONG_HTTP_PORT>/functions/v1/hello' \
+//   --header 'Authorization: Bearer <anon/service_role API key>'
@@ -0,0 +1,391 @@
+import { serve } from 'https://deno.land/[email protected]/http/server.ts'
+import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
+
+const corsHeaders = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
+}
+
+interface BatchGeocodingRequest {
+  limit?: number
+  force_refresh?: boolean
+  institute_ids?: string[]
+}
+
+interface GeocodingResult {
+  institute_id: string
+  success: boolean
+  message: string
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }
+  error?: string
+}
+
+serve(async (req: Request) => {
+  // Handle CORS preflight requests
+  if (req.method === 'OPTIONS') {
+    return new Response('ok', { headers: corsHeaders })
+  }
+
+  try {
+    // Get environment variables
+    const supabaseUrl = Deno.env.get('SUPABASE_URL')
+    const supabaseServiceKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')
+    const searxngUrl = Deno.env.get('SEARXNG_URL') || 'https://search.kevlarai.com'
+
+    if (!supabaseUrl || !supabaseServiceKey) {
+      throw new Error('Missing required environment variables')
+    }
+
+    // Create Supabase client
+    const supabase = createClient(supabaseUrl, supabaseServiceKey)
+
+    // Parse request body
+    const body: BatchGeocodingRequest = await req.json()
+    const limit = body.limit || 10
+    const forceRefresh = body.force_refresh || false
+
+    // Get institutes that need geocoding
+    let query = supabase
+      .from('institutes')
+      .select('id, name, address, geo_coordinates')
+      .not('import_id', 'is', null)
+
+    if (!forceRefresh) {
+      // Only get institutes without coordinates or with empty coordinates
+      query = query.or('geo_coordinates.is.null,geo_coordinates.eq.{}')
+    }
+
+    if (body.institute_ids && body.institute_ids.length > 0) {
+      query = query.in('id', body.institute_ids)
+    }
+
+    const { data: institutes, error: fetchError } = await query.limit(limit)
+
+    if (fetchError) {
+      throw new Error(`Failed to fetch institutes: ${fetchError.message}`)
+    }
+
+    if (!institutes || institutes.length === 0) {
+      return new Response(
+        JSON.stringify({
+          success: true,
+          message: 'No institutes found that need geocoding',
+          processed: 0
+        }),
+        { 
+          status: 200, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      )
+    }
+
+    console.log(`Processing ${institutes.length} institutes for geocoding`)
+
+    const results: GeocodingResult[] = []
+    let successCount = 0
+    let errorCount = 0
+
+    // Process institutes sequentially to avoid overwhelming the SearXNG service
+    let processedCount = 0
+    for (const institute of institutes) {
+      try {
+        const address = institute.address as any
+        if (!address) {
+          results.push({
+            institute_id: institute.id,
+            success: false,
+            message: 'No address information available',
+            error: 'Missing address data'
+          })
+          errorCount++
+          processedCount++
+          continue
+        }
+
+        // Build search query from address components
+        const addressParts = [
+          address.street,
+          address.town,
+          address.county,
+          address.postcode,
+          address.country
+        ].filter(Boolean)
+
+        if (addressParts.length === 0) {
+          results.push({
+            institute_id: institute.id,
+            success: false,
+            message: 'No valid address components found',
+            error: 'Empty address parts'
+          })
+          errorCount++
+          processedCount++
+          continue
+        }
+
+        const searchQuery = addressParts.join(', ')
+        console.log(`Geocoding institute ${institute.id}: ${searchQuery}`)
+
+        // Query SearXNG for geocoding with fallback strategy
+        const geocodingResult = await geocodeAddressWithFallback(address, searxngUrl)
+
+        if (geocodingResult.success && geocodingResult.coordinates) {
+          // Update institute with geospatial coordinates
+          const { error: updateError } = await supabase
+            .from('institutes')
+            .update({
+              geo_coordinates: {
+                latitude: geocodingResult.coordinates.latitude,
+                longitude: geocodingResult.coordinates.longitude,
+                boundingbox: geocodingResult.coordinates.boundingbox,
+                geojson: geocodingResult.coordinates.geojson,
+                osm: geocodingResult.coordinates.osm,
+                search_query: searchQuery,
+                geocoded_at: new Date().toISOString()
+              }
+            })
+            .eq('id', institute.id)
+
+          if (updateError) {
+            throw new Error(`Failed to update institute: ${updateError.message}`)
+          }
+
+          results.push({
+            institute_id: institute.id,
+            success: true,
+            message: 'Successfully geocoded',
+            coordinates: geocodingResult.coordinates
+          })
+          successCount++
+
+          // Log the successful geocoding
+          await supabase
+            .from('function_logs')
+            .insert({
+              file_id: null,
+              step: 'batch_geocoding',
+              message: 'Successfully geocoded institute address in batch',
+              data: {
+                institute_id: institute.id,
+                search_query: searchQuery,
+                coordinates: geocodingResult.coordinates
+              }
+            })
+
+        } else {
+          results.push({
+            institute_id: institute.id,
+            success: false,
+            message: 'Geocoding failed',
+            error: geocodingResult.error || 'Unknown error'
+          })
+          errorCount++
+        }
+
+        processedCount++
+
+        // Add a small delay between requests to be respectful to the SearXNG service
+        // Optimize delay based on batch size for better performance
+        if (processedCount < institutes.length) {  // Don't delay after the last institute
+          const delay = institutes.length > 200 ? 50 : 100;  // Faster processing for large batches
+          await new Promise(resolve => setTimeout(resolve, delay))
+        }
+
+      } catch (error) {
+        console.error(`Error processing institute ${institute.id}:`, error)
+        results.push({
+          institute_id: institute.id,
+          success: false,
+          message: 'Processing error',
+          error: error.message
+        })
+        errorCount++
+      }
+    }
+
+    // Log the batch operation
+    await supabase
+      .from('function_logs')
+      .insert({
+        file_id: null,
+        step: 'batch_geocoding_complete',
+        message: 'Batch geocoding operation completed',
+        data: {
+          total_processed: institutes.length,
+          successful: successCount,
+          failed: errorCount,
+          results: results
+        }
+      })
+
+    return new Response(
+      JSON.stringify({
+        success: true,
+        message: 'Batch geocoding completed',
+        summary: {
+          total_processed: institutes.length,
+          successful: successCount,
+          failed: errorCount
+        },
+        results: results
+      }),
+      { 
+        status: 200, 
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+      }
+    )
+
+  } catch (error) {
+    console.error('Error in batch institute geocoder:', error)
+    
+    return new Response(
+      JSON.stringify({ 
+        error: 'Internal server error', 
+        details: error.message 
+      }),
+      { 
+        status: 500, 
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+      }
+    )
+  }
+})
+
+async function geocodeAddress(searchQuery: string, searxngUrl: string): Promise<{
+  success: boolean
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }
+  error?: string
+}> {
+  try {
+    // Format search query for OSM
+    const osmQuery = `!osm ${searchQuery}`
+    const searchUrl = `${searxngUrl}/search?q=${encodeURIComponent(osmQuery)}&format=json`
+
+    const response = await fetch(searchUrl, {
+      method: 'GET',
+      headers: {
+        'Accept': 'application/json',
+        'User-Agent': 'ClassroomCopilot-BatchGeocoder/1.0'
+      }
+    })
+
+    if (!response.ok) {
+      throw new Error(`SearXNG request failed: ${response.status} ${response.statusText}`)
+    }
+
+    const data = await response.json()
+
+    // Check if we have results - the number_of_results field might be unreliable
+    // so we check the results array directly
+    if (!data.results || data.results.length === 0) {
+      return {
+        success: false,
+        error: 'No results returned from SearXNG'
+      }
+    }
+
+    const result = data.results[0]
+    
+    if (!result.latitude || !result.longitude) {
+      return {
+        success: false,
+        error: 'Missing latitude or longitude in SearXNG response'
+      }
+    }
+
+    return {
+      success: true,
+      coordinates: {
+        latitude: parseFloat(result.latitude),
+        longitude: parseFloat(result.longitude),
+        boundingbox: result.boundingbox || [],
+        geojson: result.geojson,
+        osm: result.osm
+      }
+    }
+
+  } catch (error) {
+    console.error('Geocoding error:', error)
+    return {
+      success: false,
+      error: error.message
+    }
+  }
+}
+
+async function geocodeAddressWithFallback(address: any, searxngUrl: string): Promise<{
+  success: boolean
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }
+  error?: string
+}> {
+  // Strategy 1: Try full address (street + town + county + postcode)
+  if (address.street && address.town && address.county && address.postcode) {
+    const fullQuery = `${address.street}, ${address.town}, ${address.county}, ${address.postcode}`
+    console.log(`Trying full address: ${fullQuery}`)
+    
+    const result = await geocodeAddress(fullQuery, searxngUrl)
+    if (result.success && result.coordinates) {
+      console.log('Full address geocoding successful')
+      return result
+    }
+  }
+  
+  // Strategy 2: Try town + county + postcode
+  if (address.town && address.county && address.postcode) {
+    const mediumQuery = `${address.town}, ${address.county}, ${address.postcode}`
+    console.log(`Trying medium address: ${mediumQuery}`)
+    
+    const result = await geocodeAddress(mediumQuery, searxngUrl)
+    if (result.success && result.coordinates) {
+      console.log('Medium address geocoding successful')
+      return result
+    }
+  }
+  
+  // Strategy 3: Try just postcode
+  if (address.postcode) {
+    console.log(`Trying postcode only: ${address.postcode}`)
+    
+    const result = await geocodeAddress(address.postcode, searxngUrl)
+    if (result.success && result.coordinates) {
+      console.log('Postcode geocoding successful')
+      return result
+    }
+  }
+  
+  // Strategy 4: Try town + postcode
+  if (address.town && address.postcode) {
+    const simpleQuery = `${address.town}, ${address.postcode}`
+    console.log(`Trying simple address: ${simpleQuery}`)
+    
+    const result = await geocodeAddress(simpleQuery, searxngUrl)
+    if (result.success && result.coordinates) {
+      console.log('Simple address geocoding successful')
+      return result
+    }
+  }
+  
+  // All strategies failed
+  return {
+    success: false,
+    error: 'No coordinates found with any address combination'
+  }
+}
@@ -0,0 +1,317 @@
+import { serve } from 'https://deno.land/[email protected]/http/server.ts'
+import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
+
+const corsHeaders = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
+}
+
+interface BatchGeocodingRequest {
+  limit?: number
+  force_refresh?: boolean
+  institute_ids?: string[]
+}
+
+interface GeocodingResult {
+  institute_id: string
+  success: boolean
+  message: string
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }
+  error?: string
+}
+
+serve(async (req: Request) => {
+  // Handle CORS preflight requests
+  if (req.method === 'OPTIONS') {
+    return new Response('ok', { headers: corsHeaders })
+  }
+
+  try {
+    // Get environment variables
+    const supabaseUrl = Deno.env.get('SUPABASE_URL')
+    const supabaseServiceKey = Deno.env.get('SUPABASE_SERVICE_RATE_KEY')
+    const searxngUrl = Deno.env.get('SEARXNG_URL') || 'https://search.kevlarai.com'
+
+    if (!supabaseUrl || !supabaseServiceKey) {
+      throw new Error('Missing required environment variables')
+    }
+
+    // Create Supabase client
+    const supabase = createClient(supabaseUrl, supabaseServiceKey)
+
+    // Parse request body
+    const body: BatchGeocodingRequest = await req.json()
+    const limit = body.limit || 10
+    const forceRefresh = body.force_refresh || false
+
+    // Get institutes that need geocoding
+    let query = supabase
+      .from('institutes')
+      .select('id, name, address, geo_coordinates')
+      .not('import_id', 'is', null)
+
+    if (!forceRefresh) {
+      // Only get institutes without coordinates or with empty coordinates
+      query = query.or('geo_coordinates.is.null,geo_coordinates.eq.{}')
+    }
+
+    if (body.institute_ids && body.institute_ids.length > 0) {
+      query = query.in('id', body.institute_ids)
+    }
+
+    const { data: institutes, error: fetchError } = await query.limit(limit)
+
+    if (fetchError) {
+      throw new Error(`Failed to fetch institutes: ${fetchError.message}`)
+    }
+
+    if (!institutes || institutes.length === 0) {
+      return new Response(
+        JSON.stringify({
+          success: true,
+          message: 'No institutes found that need geocoding',
+          processed: 0
+        }),
+        { 
+          status: 200, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      )
+    }
+
+    console.log(`Processing ${institutes.length} institutes for geocoding`)
+
+    const results: GeocodingResult[] = []
+    let successCount = 0
+    let errorCount = 0
+
+    // Process institutes sequentially to avoid overwhelming the SearXNG service
+    for (const institute of institutes) {
+      try {
+        const address = institute.address as any
+        if (!address) {
+          results.push({
+            institute_id: institute.id,
+            success: false,
+            message: 'No address information available',
+            error: 'Missing address data'
+          })
+          errorCount++
+          continue
+        }
+
+        // Build search query from address components
+        const addressParts = [
+          address.street,
+          address.town,
+          address.county,
+          address.postcode,
+          address.country
+        ].filter(Boolean)
+
+        if (addressParts.length === 0) {
+          results.push({
+            institute_id: institute.id,
+            success: false,
+            message: 'No valid address components found',
+            error: 'Empty address parts'
+          })
+          errorCount++
+          continue
+        }
+
+        const searchQuery = addressParts.join(', ')
+        console.log(`Geocoding institute ${institute.id}: ${searchQuery}`)
+
+        // Query SearXNG for geocoding
+        const geocodingResult = await geocodeAddress(searchQuery, searxngUrl)
+
+        if (geocodingResult.success && geocodingResult.coordinates) {
+          // Update institute with geospatial coordinates
+          const { error: updateError } = await supabase
+            .from('institutes')
+            .update({
+              geo_coordinates: {
+                latitude: geocodingResult.coordinates.latitude,
+                longitude: geocodingResult.coordinates.longitude,
+                boundingbox: geocodingResult.coordinates.boundingbox,
+                geojson: geocodingResult.coordinates.geojson,
+                osm: geocodingResult.coordinates.osm,
+                search_query: searchQuery,
+                geocoded_at: new Date().toISOString()
+              }
+            })
+            .eq('id', institute.id)
+
+          if (updateError) {
+            throw new Error(`Failed to update institute: ${updateError.message}`)
+          }
+
+          results.push({
+            institute_id: institute.id,
+            success: true,
+            message: 'Successfully geocoded',
+            coordinates: geocodingResult.coordinates
+          })
+          successCount++
+
+          // Log the successful geocoding
+          await supabase
+            .from('function_logs')
+            .insert({
+              file_id: null,
+              step: 'batch_geocoding',
+              message: 'Successfully geocoded institute address in batch',
+              data: {
+                institute_id: institute.id,
+                search_query: searchQuery,
+                coordinates: geocodingResult.coordinates
+              }
+            })
+
+        } else {
+          results.push({
+            institute_id: institute.id,
+            success: false,
+            message: 'Geocoding failed',
+            error: geocodingResult.error || 'Unknown error'
+          })
+          errorCount++
+        }
+
+        // Add a small delay between requests to be respectful to the SearXNG service
+        await new Promise(resolve => setTimeout(resolve, 100))
+
+      } catch (error) {
+        console.error(`Error processing institute ${institute.id}:`, error)
+        results.push({
+          institute_id: institute.id,
+          success: false,
+          message: 'Processing error',
+          error: error.message
+        })
+        errorCount++
+      }
+    }
+
+    // Log the batch operation
+    await supabase
+      .from('function_logs')
+      .insert({
+        file_id: null,
+        step: 'batch_geocoding_complete',
+        message: 'Batch geocoding operation completed',
+        data: {
+          total_processed: institutes.length,
+          successful: successCount,
+          failed: errorCount,
+          results: results
+        }
+      })
+
+    return new Response(
+      JSON.stringify({
+        success: true,
+        message: 'Batch geocoding completed',
+        summary: {
+          total_processed: institutes.length,
+          successful: successCount,
+          failed: errorCount
+        },
+        results: results
+      }),
+      { 
+        status: 200, 
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+      }
+    )
+
+  } catch (error) {
+    console.error('Error in batch institute geocoder:', error)
+    
+    return new Response(
+      JSON.stringify({ 
+        error: 'Internal server error', 
+        details: error.message 
+      }),
+      { 
+        status: 500, 
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+      }
+    )
+  }
+})
+
+async function geocodeAddress(searchQuery: string, searxngUrl: string): Promise<{
+  success: boolean
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }
+  error?: string
+}> {
+  try {
+    // Format search query for OSM
+    const osmQuery = `!osm ${searchQuery}`
+    const searchUrl = `${searxngUrl}/search?q=${encodeURIComponent(osmQuery)}&format=json`
+
+    const response = await fetch(searchUrl, {
+      method: 'GET',
+      headers: {
+        'Accept': 'application/json',
+        'User-Agent': 'ClassroomCopilot-BatchGeocoder/1.0'
+      }
+    })
+
+    if (!response.ok) {
+      throw new Error(`SearXNG request failed: ${response.status} ${response.statusText}`)
+    }
+
+    const data = await response.json()
+
+    // Check if we have results - the number_of_results field might be unreliable
+    // so we check the results array directly
+    if (!data.results || data.results.length === 0) {
+      return {
+        success: false,
+        error: 'No results returned from SearXNG'
+      }
+    }
+
+    const result = data.results[0]
+    
+    if (!result.latitude || !result.longitude) {
+      return {
+        success: false,
+        error: 'Missing latitude or longitude in SearXNG response'
+      }
+    }
+
+    return {
+      success: true,
+      coordinates: {
+        latitude: parseFloat(result.latitude),
+        longitude: parseFloat(result.longitude),
+        boundingbox: result.boundingbox || [],
+        geojson: result.geojson,
+        osm: result.osm
+      }
+    }
+
+  } catch (error) {
+    console.error('Geocoding error:', error)
+    return {
+      success: false,
+      error: error.message
+    }
+  }
+}
@@ -0,0 +1,315 @@
+// Example usage of Institute Geocoder functions
+// This file demonstrates how to integrate the geocoding functions in your frontend
+
+import { createClient } from '@supabase/supabase-js'
+
+// Initialize Supabase client
+const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!
+const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
+const supabase = createClient(supabaseUrl, supabaseAnonKey)
+
+// Types for institute data
+interface Institute {
+  id: string
+  name: string
+  address: {
+    street?: string
+    town?: string
+    county?: string
+    postcode?: string
+    country?: string
+  }
+  geo_coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    search_query: string
+    geocoded_at: string
+  }
+}
+
+interface GeocodingResult {
+  success: boolean
+  message: string
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+  }
+  error?: string
+}
+
+// 1. Geocode a single institute
+export async function geocodeInstitute(instituteId: string): Promise<GeocodingResult> {
+  try {
+    const { data, error } = await supabase.functions.invoke('institute-geocoder', {
+      body: { institute_id: instituteId }
+    })
+
+    if (error) {
+      throw new Error(error.message)
+    }
+
+    return data
+  } catch (error) {
+    console.error('Geocoding failed:', error)
+    return {
+      success: false,
+      message: 'Geocoding failed',
+      error: error instanceof Error ? error.message : 'Unknown error'
+    }
+  }
+}
+
+// 2. Batch geocode multiple institutes
+export async function batchGeocodeInstitutes(
+  limit: number = 10,
+  forceRefresh: boolean = false
+): Promise<any> {
+  try {
+    const { data, error } = await supabase.functions.invoke('institute-geocoder/batch', {
+      body: { 
+        limit,
+        force_refresh: forceRefresh
+      }
+    })
+
+    if (error) {
+      throw new Error(error.message)
+    }
+
+    return data
+  } catch (error) {
+    console.error('Batch geocoding failed:', error)
+    throw error
+  }
+}
+
+// 3. Get institutes that need geocoding
+export async function getInstitutesNeedingGeocoding(): Promise<Institute[]> {
+  try {
+    const { data, error } = await supabase
+      .from('institutes')
+      .select('id, name, address, geo_coordinates')
+      .or('geo_coordinates.is.null,geo_coordinates.eq.{}')
+      .not('import_id', 'is', null)
+
+    if (error) {
+      throw new Error(error.message)
+    }
+
+    return data || []
+  } catch (error) {
+    console.error('Failed to fetch institutes:', error)
+    return []
+  }
+}
+
+// 4. Display institute on a map (example with Leaflet)
+export function displayInstituteOnMap(
+  institute: Institute,
+  mapElement: HTMLElement
+): void {
+  if (!institute.geo_coordinates) {
+    console.warn('Institute has no coordinates:', institute.name)
+    return
+  }
+
+  // This is a placeholder - you'd need to implement actual map rendering
+  // For example, using Leaflet, Mapbox, or Google Maps
+  const { latitude, longitude } = institute.geo_coordinates
+  
+  console.log(`Displaying ${institute.name} at ${latitude}, ${longitude}`)
+  
+  // Example map implementation:
+  // const map = L.map(mapElement).setView([latitude, longitude], 13)
+  // L.marker([latitude, longitude]).addTo(map).bindPopup(institute.name)
+}
+
+// 5. React component example
+export function InstituteGeocoder() {
+  const [institutes, setInstitutes] = useState<Institute[]>([])
+  const [loading, setLoading] = useState(false)
+  const [geocodingProgress, setGeocodingProgress] = useState(0)
+
+  // Load institutes that need geocoding
+  useEffect(() => {
+    loadInstitutes()
+  }, [])
+
+  async function loadInstitutes() {
+    const data = await getInstitutesNeedingGeocoding()
+    setInstitutes(data)
+  }
+
+  // Geocode all institutes
+  async function geocodeAllInstitutes() {
+    setLoading(true)
+    setGeocodingProgress(0)
+
+    try {
+      const result = await batchGeocodeInstitutes(institutes.length, false)
+      
+      if (result.success) {
+        setGeocodingProgress(100)
+        // Reload institutes to show updated coordinates
+        await loadInstitutes()
+      }
+    } catch (error) {
+      console.error('Batch geocoding failed:', error)
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  // Geocode single institute
+  async function geocodeSingleInstitute(instituteId: string) {
+    try {
+      const result = await geocodeInstitute(instituteId)
+      if (result.success) {
+        // Reload institutes to show updated coordinates
+        await loadInstitutes()
+      }
+    } catch (error) {
+      console.error('Single geocoding failed:', error)
+    }
+  }
+
+  return (
+    <div className="institute-geocoder">
+      <h2>Institute Geocoding</h2>
+      
+      <div className="controls">
+        <button 
+          onClick={geocodeAllInstitutes}
+          disabled={loading || institutes.length === 0}
+        >
+          {loading ? 'Geocoding...' : `Geocode All (${institutes.length})`}
+        </button>
+        
+        {loading && (
+          <div className="progress">
+            <div 
+              className="progress-bar" 
+              style={{ width: `${geocodingProgress}%` }}
+            />
+          </div>
+        )}
+      </div>
+
+      <div className="institutes-list">
+        {institutes.map(institute => (
+          <div key={institute.id} className="institute-item">
+            <h3>{institute.name}</h3>
+            <p>
+              {institute.address.street && `${institute.address.street}, `}
+              {institute.address.town && `${institute.address.town}, `}
+              {institute.address.county && `${institute.address.county}, `}
+              {institute.address.postcode}
+            </p>
+            
+            {institute.geo_coordinates ? (
+              <div className="coordinates">
+                <span>📍 {institute.geo_coordinates.latitude}, {institute.geo_coordinates.longitude}</span>
+                <span>Geocoded: {new Date(institute.geo_coordinates.geocoded_at).toLocaleDateString()}</span>
+              </div>
+            ) : (
+              <button 
+                onClick={() => geocodeSingleInstitute(institute.id)}
+                disabled={loading}
+              >
+                Geocode
+              </button>
+            )}
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}
+
+// 6. Utility functions for working with coordinates
+export class CoordinateUtils {
+  // Calculate distance between two points (Haversine formula)
+  static calculateDistance(
+    lat1: number, 
+    lon1: number, 
+    lat2: number, 
+    lon2: number
+  ): number {
+    const R = 6371 // Earth's radius in kilometers
+    const dLat = this.toRadians(lat2 - lat1)
+    const dLon = this.toRadians(lon2 - lon1)
+    
+    const a = 
+      Math.sin(dLat / 2) * Math.sin(dLat / 2) +
+      Math.cos(this.toRadians(lat1)) * Math.cos(this.toRadians(lat2)) *
+      Math.sin(dLon / 2) * Math.sin(dLon / 2)
+    
+    const c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a))
+    return R * c
+  }
+
+  // Convert degrees to radians
+  private static toRadians(degrees: number): number {
+    return degrees * (Math.PI / 180)
+  }
+
+  // Check if coordinates are within a bounding box
+  static isWithinBounds(
+    lat: number,
+    lon: number,
+    bounds: [number, number, number, number] // [minLat, maxLat, minLon, maxLon]
+  ): boolean {
+    return lat >= bounds[0] && lat <= bounds[1] && 
+           lon >= bounds[2] && lon <= bounds[3]
+  }
+
+  // Format coordinates for display
+  static formatCoordinates(lat: number, lon: number): string {
+    const latDir = lat >= 0 ? 'N' : 'S'
+    const lonDir = lon >= 0 ? 'E' : 'W'
+    return `${Math.abs(lat).toFixed(6)}°${latDir}, ${Math.abs(lon).toFixed(6)}°${lonDir}`
+  }
+}
+
+// 7. Example of using coordinates in Neo4j queries
+export const neo4jQueries = {
+  // Create institute node with location
+  createInstituteWithLocation: `
+    CREATE (i:Institute {
+      id: $institute_id,
+      name: $name,
+      location: point({latitude: $latitude, longitude: $longitude})
+    })
+    RETURN i
+  `,
+
+  // Find institutes within radius
+  findInstitutesWithinRadius: `
+    MATCH (i:Institute)
+    WHERE distance(i.location, point({latitude: $centerLat, longitude: $centerLon})) < $radiusMeters
+    RETURN i, distance(i.location, point({latitude: $centerLat, longitude: $centerLon})) as distance
+    ORDER BY distance
+  `,
+
+  // Find institutes in bounding box
+  findInstitutesInBounds: `
+    MATCH (i:Institute)
+    WHERE i.location.latitude >= $minLat 
+      AND i.location.latitude <= $maxLat
+      AND i.location.longitude >= $minLon 
+      AND i.location.longitude <= $maxLon
+    RETURN i
+  `
+}
+
+export default {
+  geocodeInstitute,
+  batchGeocodeInstitutes,
+  getInstitutesNeedingGeocoding,
+  displayInstituteOnMap,
+  InstituteGeocoder,
+  CoordinateUtils,
+  neo4jQueries
+}
@@ -0,0 +1,325 @@
+import { serve } from 'https://deno.land/[email protected]/http/server.ts'
+import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
+
+const corsHeaders = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
+}
+
+interface GeocodingRequest {
+  institute_id: string
+  address?: string
+  street?: string
+  town?: string
+  county?: string
+  postcode?: string
+  country?: string
+}
+
+interface SearXNGResponse {
+  query: string
+  number_of_results: number
+  results: Array<{
+    title: string
+    longitude: string
+    latitude: string
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }>
+}
+
+interface GeocodingResult {
+  success: boolean
+  message: string
+  coordinates?: {
+    latitude: number
+    longitude: number
+    boundingbox: string[]
+    geojson?: any
+    osm?: any
+  }
+  error?: string
+}
+
+serve(async (req: Request) => {
+  // Handle CORS preflight requests
+  if (req.method === 'OPTIONS') {
+    return new Response('ok', { headers: corsHeaders })
+  }
+
+  try {
+    // Get environment variables
+    const supabaseUrl = Deno.env.get('SUPABASE_URL')
+    const supabaseServiceKey = Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')
+    const searxngUrl = Deno.env.get('SEARXNG_URL') || 'https://search.kevlarai.com'
+
+    if (!supabaseUrl || !supabaseServiceKey) {
+      throw new Error('Missing required environment variables')
+    }
+
+    // Create Supabase client
+    const supabase = createClient(supabaseUrl, supabaseServiceKey)
+
+    // Parse request body
+    const body: GeocodingRequest = await req.json()
+    
+    if (!body.institute_id) {
+      return new Response(
+        JSON.stringify({ error: 'institute_id is required' }),
+        { 
+          status: 400, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      )
+    }
+
+    // Get institute data from database
+    const { data: institute, error: fetchError } = await supabase
+      .from('institutes')
+      .select('*')
+      .eq('id', body.institute_id)
+      .single()
+
+    if (fetchError || !institute) {
+      return new Response(
+        JSON.stringify({ error: 'Institute not found' }),
+        { 
+          status: 404, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      )
+    }
+
+    // Build search query from address components
+    let searchQuery = ''
+    if (body.address) {
+      searchQuery = body.address
+    } else {
+      const addressParts = [
+        body.street,
+        body.town,
+        body.county,
+        body.postcode,
+        body.country
+      ].filter(Boolean)
+      searchQuery = addressParts.join(', ')
+    }
+
+    // If no search query provided, try to build from institute data
+    if (!searchQuery && institute.address) {
+      const address = institute.address as any
+      const addressParts = [
+        address.street,
+        address.town,
+        address.county,
+        address.postcode,
+        address.country
+      ].filter(Boolean)
+      searchQuery = addressParts.join(', ')
+    }
+
+    if (!searchQuery) {
+      return new Response(
+        JSON.stringify({ error: 'No address information available for geocoding' }),
+        { 
+          status: 400, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      )
+    }
+
+    // Query SearXNG for geocoding
+    const geocodingResult = await geocodeAddressWithFallback(institute.address, searxngUrl)
+
+    if (!geocodingResult.success) {
+      return new Response(
+        JSON.stringify({ 
+          error: 'Geocoding failed', 
+          details: geocodingResult.error 
+        }),
+        { 
+          status: 500, 
+          headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+        }
+      )
+    }
+
+    // Update institute with geospatial coordinates
+    const { error: updateError } = await supabase
+      .from('institutes')
+      .update({
+        geo_coordinates: {
+          latitude: geocodingResult.coordinates!.latitude,
+          longitude: geocodingResult.coordinates!.longitude,
+          boundingbox: geocodingResult.coordinates!.boundingbox,
+          geojson: geocodingResult.coordinates!.geojson,
+          osm: geocodingResult.coordinates!.osm,
+          search_query: searchQuery,
+          geocoded_at: new Date().toISOString()
+        }
+      })
+      .eq('id', body.institute_id)
+
+    if (updateError) {
+      throw new Error(`Failed to update institute: ${updateError.message}`)
+    }
+
+    // Log the geocoding operation
+    await supabase
+      .from('function_logs')
+      .insert({
+        file_id: null,
+        step: 'geocoding',
+        message: 'Successfully geocoded institute address',
+        data: {
+          institute_id: body.institute_id,
+          search_query: searchQuery,
+          coordinates: geocodingResult.coordinates
+        }
+      })
+
+    return new Response(
+      JSON.stringify({
+        success: true,
+        message: 'Institute geocoded successfully',
+        institute_id: body.institute_id,
+        coordinates: geocodingResult.coordinates
+      }),
+      { 
+        status: 200, 
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+      }
+    )
+
+  } catch (error) {
+    console.error('Error in institute geocoder:', error)
+    
+    return new Response(
+      JSON.stringify({ 
+        error: 'Internal server error', 
+        details: error.message 
+      }),
+      { 
+        status: 500, 
+        headers: { ...corsHeaders, 'Content-Type': 'application/json' } 
+      }
+    )
+  }
+})
+
+async function geocodeAddress(searchQuery: string, searxngUrl: string): Promise<GeocodingResult> {
+  try {
+    console.log(`Geocoding address: ${searchQuery}`)
+    
+    // Build the SearXNG query
+    const query = `!osm ${searchQuery}`
+    const url = `${searxngUrl}/search?q=${encodeURIComponent(query)}&format=json`
+    
+    console.log(`SearXNG URL: ${url}`)
+    
+    const response = await fetch(url)
+    if (!response.ok) {
+      throw new Error(`SearXNG request failed: ${response.status} ${response.statusText}`)
+    }
+    
+    const data: SearXNGResponse = await response.json()
+    console.log(`SearXNG response: ${JSON.stringify(data, null, 2)}`)
+    
+    // Check if we have results
+    if (!data.results || data.results.length === 0) {
+      return {
+        success: false,
+        message: 'No results returned from SearXNG',
+        error: 'No results returned from SearXNG'
+      }
+    }
+    
+    // Get the best result (first one)
+    const bestResult = data.results[0]
+    
+    if (!bestResult.latitude || !bestResult.longitude) {
+      return {
+        success: false,
+        message: 'Result missing coordinates',
+        error: 'Result missing coordinates'
+      }
+    }
+    
+    return {
+      success: true,
+      message: 'Geocoding successful',
+      coordinates: {
+        latitude: parseFloat(bestResult.latitude),
+        longitude: parseFloat(bestResult.longitude),
+        boundingbox: bestResult.boundingbox || [],
+        geojson: bestResult.geojson || null,
+        osm: bestResult.osm || null
+      }
+    }
+    
+  } catch (error) {
+    console.error('Error in geocodeAddress:', error)
+    return {
+      success: false,
+      message: 'Geocoding failed',
+      error: error.message
+    }
+  }
+}
+
+async function geocodeAddressWithFallback(address: any, searxngUrl: string): Promise<GeocodingResult> {
+  // Strategy 1: Try full address (street + town + county + postcode)
+  if (address.street && address.town && address.county && address.postcode) {
+    const fullQuery = `${address.street}, ${address.town}, ${address.county}, ${address.postcode}`
+    console.log(`Trying full address: ${fullQuery}`)
+    
+    const result = await geocodeAddress(fullQuery, searxngUrl)
+    if (result.success) {
+      console.log('Full address geocoding successful')
+      return result
+    }
+  }
+  
+  // Strategy 2: Try town + county + postcode
+  if (address.town && address.county && address.postcode) {
+    const mediumQuery = `${address.town}, ${address.county}, ${address.postcode}`
+    console.log(`Trying medium address: ${mediumQuery}`)
+    
+    const result = await geocodeAddress(mediumQuery, searxngUrl)
+    if (result.success) {
+      console.log('Medium address geocoding successful')
+      return result
+    }
+  }
+  
+  // Strategy 3: Try just postcode
+  if (address.postcode) {
+    console.log(`Trying postcode only: ${address.postcode}`)
+    
+    const result = await geocodeAddress(address.postcode, searxngUrl)
+    if (result.success) {
+      console.log('Postcode geocoding successful')
+      return result
+    }
+  }
+  
+  // Strategy 4: Try town + postcode
+  if (address.town && address.postcode) {
+    const simpleQuery = `${address.town}, ${address.postcode}`
+    console.log(`Trying simple address: ${simpleQuery}`)
+    
+    const result = await geocodeAddress(simpleQuery, searxngUrl)
+    if (result.success) {
+      console.log('Simple address geocoding successful')
+      return result
+    }
+  }
+  
+  // All strategies failed
+  return {
+    success: false,
+    message: 'All geocoding strategies failed',
+    error: 'No coordinates found with any address combination'
+  }
+}
@@ -0,0 +1,142 @@
+// Test script for institute geocoder functions
+// This can be run in the browser console or as a standalone test
+
+interface TestCase {
+  name: string
+  address: string
+  expected_coords?: {
+    latitude: number
+    longitude: number
+  }
+}
+
+const testCases: TestCase[] = [
+  {
+    name: "10 Downing Street, London",
+    address: "10 Downing Street, London",
+    expected_coords: {
+      latitude: 51.5034878,
+      longitude: -0.1276965
+    }
+  },
+  {
+    name: "Buckingham Palace, London",
+    address: "Buckingham Palace, London",
+    expected_coords: {
+      latitude: 51.501364,
+      longitude: -0.124432
+    }
+  },
+  {
+    name: "Big Ben, London",
+    address: "Big Ben, London",
+    expected_coords: {
+      latitude: 51.499479,
+      longitude: -0.124809
+    }
+  }
+]
+
+async function testGeocoding() {
+  console.log("🧪 Starting Institute Geocoder Tests...")
+  
+  for (const testCase of testCases) {
+    console.log(`\n📍 Testing: ${testCase.name}`)
+    
+    try {
+      // Test the SearXNG service directly
+      const searchQuery = `!osm ${testCase.address}`
+      const searchUrl = `https://search.kevlarai.com/search?q=${encodeURIComponent(searchQuery)}&format=json`
+      
+      console.log(`🔍 Searching: ${searchUrl}`)
+      
+      const response = await fetch(searchUrl)
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}: ${response.statusText}`)
+      }
+      
+      const data = await response.json()
+      console.log(`📊 Results: ${data.number_of_results} found`)
+      
+      if (data.results && data.results.length > 0) {
+        const result = data.results[0]
+        const coords = {
+          latitude: parseFloat(result.latitude),
+          longitude: parseFloat(result.longitude)
+        }
+        
+        console.log(`✅ Coordinates: ${coords.latitude}, ${coords.longitude}`)
+        
+        if (testCase.expected_coords) {
+          const latDiff = Math.abs(coords.latitude - testCase.expected_coords.latitude)
+          const lonDiff = Math.abs(coords.longitude - testCase.expected_coords.longitude)
+          
+          if (latDiff < 0.01 && lonDiff < 0.01) {
+            console.log(`🎯 Accuracy: High (within 0.01 degrees)`)
+          } else if (latDiff < 0.1 && lonDiff < 0.1) {
+            console.log(`🎯 Accuracy: Medium (within 0.1 degrees)`)
+          } else {
+            console.log(`⚠️  Accuracy: Low (difference > 0.1 degrees)`)
+          }
+        }
+        
+        if (result.boundingbox) {
+          console.log(`🗺️  Bounding Box: ${result.boundingbox.join(', ')}`)
+        }
+        
+        if (result.geojson) {
+          console.log(`🗺️  GeoJSON: ${result.geojson.type} with ${result.geojson.coordinates?.[0]?.length || 0} points`)
+        }
+        
+      } else {
+        console.log(`❌ No results found`)
+      }
+      
+    } catch (error) {
+      console.error(`❌ Test failed: ${error.message}`)
+    }
+  }
+  
+  console.log("\n🏁 Testing completed!")
+}
+
+// Test address parsing function
+function testAddressParsing() {
+  console.log("\n🔧 Testing Address Parsing...")
+  
+  const testAddresses = [
+    {
+      street: "10 Downing Street",
+      town: "London",
+      county: "Greater London",
+      postcode: "SW1A 2AA",
+      country: "United Kingdom"
+    },
+    {
+      street: "Buckingham Palace",
+      town: "London",
+      county: "Greater London",
+      postcode: "SW1A 1AA",
+      country: "United Kingdom"
+    }
+  ]
+  
+  for (const addr of testAddresses) {
+    const parts = [addr.street, addr.town, addr.county, addr.postcode, addr.country].filter(Boolean)
+    const searchQuery = parts.join(', ')
+    console.log(`📍 Address: ${searchQuery}`)
+  }
+}
+
+// Run tests if this script is executed directly
+if (typeof window !== 'undefined') {
+  // Browser environment
+  window.testGeocoding = testGeocoding
+  window.testAddressParsing = testAddressParsing
+  console.log("🧪 Institute Geocoder tests loaded. Run testGeocoding() or testAddressParsing() to test.")
+} else {
+  // Node.js environment
+  console.log("🧪 Institute Geocoder tests loaded.")
+}
+
+export { testGeocoding, testAddressParsing }
@@ -0,0 +1,94 @@
+import { serve } from 'https://deno.land/[email protected]/http/server.ts'
+import * as jose from 'https://deno.land/x/[email protected]/index.ts'
+
+console.log('main function started')
+
+const JWT_SECRET = Deno.env.get('JWT_SECRET')
+const VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'
+
+function getAuthToken(req: Request) {
+  const authHeader = req.headers.get('authorization')
+  if (!authHeader) {
+    throw new Error('Missing authorization header')
+  }
+  const [bearer, token] = authHeader.split(' ')
+  if (bearer !== 'Bearer') {
+    throw new Error(`Auth header is not 'Bearer {token}'`)
+  }
+  return token
+}
+
+async function verifyJWT(jwt: string): Promise<boolean> {
+  const encoder = new TextEncoder()
+  const secretKey = encoder.encode(JWT_SECRET)
+  try {
+    await jose.jwtVerify(jwt, secretKey)
+  } catch (err) {
+    console.error(err)
+    return false
+  }
+  return true
+}
+
+serve(async (req: Request) => {
+  if (req.method !== 'OPTIONS' && VERIFY_JWT) {
+    try {
+      const token = getAuthToken(req)
+      const isValidJWT = await verifyJWT(token)
+
+      if (!isValidJWT) {
+        return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {
+          status: 401,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+    } catch (e) {
+      console.error(e)
+      return new Response(JSON.stringify({ msg: e.toString() }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+  }
+
+  const url = new URL(req.url)
+  const { pathname } = url
+  const path_parts = pathname.split('/')
+  const service_name = path_parts[1]
+
+  if (!service_name || service_name === '') {
+    const error = { msg: 'missing function name in request' }
+    return new Response(JSON.stringify(error), {
+      status: 400,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  const servicePath = `/home/deno/functions/${service_name}`
+  console.error(`serving the request with ${servicePath}`)
+
+  const memoryLimitMb = 150
+  const workerTimeoutMs = 1 * 60 * 1000
+  const noModuleCache = false
+  const importMapPath = null
+  const envVarsObj = Deno.env.toObject()
+  const envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])
+
+  try {
+    const worker = await EdgeRuntime.userWorkers.create({
+      servicePath,
+      memoryLimitMb,
+      workerTimeoutMs,
+      noModuleCache,
+      importMapPath,
+      envVars,
+    })
+    return await worker.fetch(req)
+  } catch (e) {
+    const error = { msg: e.toString() }
+    return new Response(JSON.stringify(error), {
+      status: 500,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+})
@@ -0,0 +1,3 @@
+volumes/db/data
+volumes/storage
+volumes/logs
@@ -0,0 +1,51 @@
+# Dockerfile for selfhosted-supabase-mcp HTTP mode
+# Multi-stage build using Bun runtime for self-hosted Supabase
+
+FROM oven/bun:1.1-alpine AS builder
+
+WORKDIR /app
+
+# Copy package files from submodule
+COPY selfhosted-supabase-mcp/package.json selfhosted-supabase-mcp/bun.lock* ./
+
+# Install dependencies
+RUN bun install --frozen-lockfile || bun install
+
+# Copy source code
+COPY selfhosted-supabase-mcp/src ./src
+COPY selfhosted-supabase-mcp/tsconfig.json ./
+
+# Build the application
+RUN bun build src/index.ts --outdir dist --target bun
+
+# Production stage
+FROM oven/bun:1.1-alpine AS runner
+
+WORKDIR /app
+
+# Create non-root user for security
+RUN addgroup --system --gid 1001 mcp && \
+    adduser --system --uid 1001 --ingroup mcp mcp
+
+# Copy built application from builder
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./
+
+# Set ownership
+RUN chown -R mcp:mcp /app
+
+USER mcp
+
+# Default environment variables
+ENV NODE_ENV=production
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget --no-verbose --tries=1 --spider http://localhost:3100/health || exit 1
+
+# Expose HTTP port
+EXPOSE 3100
+
+# Start the MCP server in HTTP mode
+CMD ["bun", "run", "dist/index.js"]