How to restrict access based on many-to-many relationship - Supabase