EventureOS

The operating system for event businesses.

Enquiry → Customer → Event → Quote → Acceptance → Calendar → Delivery → Invoice → Payment — in one place.

What's in this build (Phase 1, part 1)

Area	Status
Multi-tenant database with Row Level Security	✅
Sign in / sign up / create organisation	✅
App shell: navigation, global search (⌘K), organisation switcher, notifications, quick-create	✅
Dashboard: KPIs, attention centre, upcoming events, 7-day calendar, tasks, outstanding payments, communication, activity	✅
Enquiries inbox + enquiry workspace + Convert to event	✅
Events list + event workspace (9 tabs, journey timeline, audit-logged edits)	✅
Clients list + basic client page	✅
Full CRM record, Quote builder, Customer portal, Calendar, Integrations screen	Next build
Gmail, Google Calendar (Phase 2) · Xero (Phase 3) · AI classification (Phase 4)	Later

Stack

Next.js 15 (App Router, Server Actions) · Supabase (Postgres, Auth, RLS) · Tailwind CSS · deployed on Vercel.

Environment variables (Vercel → Settings → Environment Variables)

NEXT_PUBLIC_SUPABASE_URL=https://hrarethuqwfmtewxngxt.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_…   (see .env.example)

Both values are public by design; the data is protected by Row Level Security in Postgres.

Tenant security model

• Every tenant table has organisation_id. RLS policies allow access only when the signed-in user is an active member of that organisation (is_org_staff, is_org_manager helpers).
• Relationships use composite foreign keys (id, organisation_id), so a record can never point at another tenant's customer, event or quote — even with a crafted request.
• Customers (portal role) cannot read staff data. Only managers and above can delete. The audit log is append-only.
• Published quote versions are immutable (enforced by a database trigger).
• Integration tokens live in integration_credentials, which no client role can read.

Database

Migrations are in supabase/migrations and have been applied to the eventureos Supabase project. Demo data: supabase/seed/seed.sql (generated by generate_seed.py, dates relative to today). Re-running it wipes and recreates only the two demo organisations and demo users.

Demo logins (password EventureDemo!2026)

Email	Access
[email protected]	Owner of Bean Culture, admin of Copper & Tonic (shows the org switcher)
[email protected]	Manager, Bean Culture
[email protected]	Staff, Bean Culture
[email protected]	Owner, Copper & Tonic only (proves isolation)