Deleted a user in Supabase but they're still logged in and can use the app

His browser still holds a valid access token (a signed JWT, valid up to 1 hour by default). RLS checks auth.uid() from that token without asking the auth server whether the user still exists. So until it expires, requests work. The refresh will fail, then he's out.

To cut it off immediately:

• In RLS on the tables that matter, also require the user to have a profile row (which you delete, or mark banned):

using (exists (select 1 from profiles p where p.id = auth.uid() and not p.banned))

That's checked on every query, so a ban is instant.

• For the future, use the ban option (ban_duration via the admin API) instead of deleting. You keep his data for reference and he can't sign up again with the same account.

You can also shorten the access token lifetime in the Auth settings (JWT expiry). Default is 3600 seconds; 10-15 minutes is reasonable if you need faster revocation. Costs a few more refresh calls, nothing noticeable.