medya-a-e

# CMS — andrereza.site Private content management system for [andrereza.site](https://andrereza.site). ## Setup ### 1. Environment ```bash cp .env.example .env.local ``` Fill in your Supabase credentials in `.env.local`: - `NEXT_PUBLIC_SUPABASE_URL` — your project URL - `NEXT_PUBLIC_SUPABASE_ANON_KEY` — your public anon key ### 2. Database Run the schema in Supabase Dashboard → SQL Editor: ``` supabase/schema.sql ``` ### 3. Auth In Supabase Dashboard → Authentication → Users, create your account. The CMS uses email + password. Add yourself as a user manually. ### 4. Run ```bash npm install npm run dev # → http://localhost:3001 ``` ## Architecture ``` cms/ ├── app/ │ ├── (auth)/login/ ← Login page │ ├── (dashboard)/ ← Protected route group │ │ ├── page.tsx ← Dashboard │ │ ├── projects/ ← Project CRUD │ │ ├── experiments/ ← Planned │ │ ├── notes/ ← Planned │ │ ├── media/ ← Planned │ │ └── profile/ ← Planned │ └── api/auth/callback/ ← Supabase auth callback ├── components/ │ ├── auth/ ← LoginForm, LogoutButton │ ├── layout/ ← Sidebar, Topbar │ ├── projects/ ← ProjectForm, FormSection, SlugField, TagsField │ └── ui/ ← StatusBadge, ComingSoon ├── lib/ │ └── supabase/ │ ├── client.ts ← Browser client │ ├── server.ts ← Server component client │ └── middleware.ts ← Session refresh + auth guard ├── supabase/ │ └── schema.sql ← Database schema + RLS ├── middleware.ts ← Route protection └── .env.example ← Required env vars ``` ## Security - All routes require authentication (middleware + layout double-check) - RLS enforced at database level — auth cannot be bypassed by API calls - Service role key never used in this application - Public anon key only — all access governed by RLS policies ## Deployment Separate Vercel project from the public website. Target domain: `cms.andrereza.site` Add environment variables in Vercel dashboard — never in source code. Update `NEXT_PUBLIC_CMS_URL` to `https://cms.andrereza.site` in production.