GallaDev Workspace
CRM for reviewing, qualifying, and managing leads for asesorías y gestorías. Supabase (PostgreSQL) is the sole source of truth. The Notion runtime has been removed.
Formerly Leads_CRM. Production: https://workspace.galladev.com.
Live demo — open the login page and choose Entrar como visitante (fictional data only). The UI is available in Spanish (default) and English via the ES/EN control.
Quickstart
npm install
cp .env.example .env.local
# Set Supabase vars in .env.local (see below)
npm run dev
Open http://localhost:3000/leads. The app syncs on load; you can also press Sincronizar.
Demo
A passwordless visitor session shows the real UI with fictional leads only. It is off unless DEMO_MODE_ENABLED is true or 1, and it also needs DEMO_SESSION_SECRET (16+ characters). Then the login page shows Entrar como visitante. The signed cookie lasts 4 hours, never reads or writes Supabase, and blocks settings, automations, team, ingest, email, and live AI. Set DEMO_MODE_ENABLED=false (or unset it) to turn the button off without a code change. The live demo is active at https://workspace.galladev.com/login. The same page will also show a public ¿Qué es? / What is it? section (specified, not built yet): text and screenshots, no session, alongside the visitor button. Details: operations guide and what-it-is.md.
Minimal config:
LEADS_DB_PROVIDER=supabase
SUPABASE_URL=https://<project>.supabase.co
SUPABASE_PUBLISHABLE_KEY=<publishable-key>
SUPABASE_SECRET_KEY=<secret-key-never-commit>
# Browser client. Next inlines NEXT_PUBLIC_* at build time; use the same URL and publishable key.
NEXT_PUBLIC_SUPABASE_URL=https://<project>.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=<publishable-key>
AUTH_DISABLED=true
Sign-in is Supabase Auth (email + password). There is no self-signup: keep public sign-up disabled, and an Admin creates accounts in the Supabase Dashboard (Authentication → Users). The on_auth_user_created trigger inserts a profiles row with no role; the account sees a pending-access screen until an Admin assigns Admin, Seller, or Viewer in Settings → Equipo. AUTH_DISABLED=true skips login only when NODE_ENV is not production.
Documentation
Stack
Next.js App Router, React, TypeScript, Tailwind CSS, Lucide, TanStack Query, Zustand, Supabase (@supabase/ssr, @supabase/supabase-js), Resend, Groq.
Verification
npm run lint
npx tsc --noEmit
npm run test:unit
npm run test:component
npm run build
npm run test:e2e
See Testing and the roadmap and delivery context before assuming roadmap sections are complete.
Web ingest emails
After a successful POST /api/ingest/lead (created or deduped), the app sends with Resend:
- Receipt to the visitor (
email from the payload)
- Internal notice to
EMAIL_NOTIFY_TO
Fail-open: if the key is missing or Resend fails, the lead is still saved and the API answers 201/200.
Variables (names; values in Vercel, never in git): RESEND_API_KEY (full access — required to read inbound bodies via the Receiving API; sending_access alone yields empty bodies), EMAIL_FROM_CLIENTS, EMAIL_NOTIFY_TO, optional EMAIL_REPLY_TO. Company mailbox setup and the one-shot body backfill (POST /api/email/backfill-bodies, Admin only): company-email.md.
Not used for marketing or nurturing lists.
Contributing
See CONTRIBUTING.md (español) for branches, commits, tests, and the PR process. By participating you agree to our CODE_OF_CONDUCT.md (español); report vulnerabilities privately per SECURITY.md (español).
