How to Add Crowdsourced Map Updates to Your App (Copy-Paste Prompts Included)

Trigger a submission form on long-press (mobile) or right-click (web) on the map. Capture the coordinates from the tap event automatically — never ask users to type lat/lng. The form fields should be Title, Category, Description, and an optional Photo upload. On submit, call a Supabase Edge Function that runs duplicate detection, then inserts into map_contributions with status='pending'. The pin appears immediately on the submitter's map with a yellow pending badge.

Build an /admin/moderation page accessible only to users with a Supabase custom JWT claim of role='admin'. The page lists pending contributions in real time via a Supabase Realtime subscription. Admins approve (status='approved') or reject (status='rejected' with a required rejection_reason). Apply an RLS UPDATE policy that restricts status changes to admin JWT claims only — do not rely on route-level protection alone.

The pin's status is set to 'rejected' with the admin's rejection_reason stored in the database. It is removed from the approved_map_pins view and disappears from the public map. The submitter can still see it at /my-pins with the rejection reason clearly displayed. The pin is never silently deleted — the submitter always gets closure on why their contribution was not accepted.

Create a Supabase Edge Function that accepts the submission's lat, lng, and category as parameters. Inside the function, query the approved_map_pins view using PostGIS ST_DWithin with a radius of 50 metres and the same category filter. If any matching pins are found, return a warning message with the nearby pin's title. Call this function from the submission form before the insert and show a confirmation dialog if a duplicate is detected.

Yes — add a file input to the submission form that accepts image/jpeg, image/png, and image/webp only, with a 5MB maximum. Upload to a private Supabase Storage bucket and store the resulting URL in the map_contributions image_url column. Serve photos via signed URLs with a short expiry (1 hour) rather than permanent public URLs — this ensures photo access follows the same visibility rules as the pin data. Set file size and MIME type restrictions at the Supabase Storage bucket policy level, not just client-side.

Use Supabase custom claims. In the Supabase SQL editor, run a function that sets the role claim on the admin user's JWT: update auth.users set raw_app_meta_data = raw_app_meta_data || '{"role":"admin"}' where email = 'admin@yourdomain.com'. Then in your RLS UPDATE policy on map_contributions, check (auth.jwt() ->> 'role') = 'admin'. Also protect the /admin route in Next.js middleware or in Lovable's component render logic. Always test with a non-admin session to confirm access is blocked.

Pending pins have been submitted by a user but not yet reviewed by an admin. They are visible only to the submitter (in their /my-pins view) and to admins (in the moderation queue). Approved pins have been reviewed and accepted — they appear on the public map for all users. Rejected pins were reviewed and declined; they remain visible to the submitter with a rejection reason but are removed from the public map.

Create a contribution_edits table with columns contribution_id, edited_by, previous_data (jsonb), new_data (jsonb), and edited_at. Every time a submitter edits their approved pin, append a row to contribution_edits before applying the update to map_contributions. In the pin detail panel, fetch the edit history rows for that pin and display them as a compact timeline: 'Edited by [username] 3 days ago — changed title from X to Y'. This append-only log lets users see the full provenance of a pin.