Alumni Network platform
A private, verified professional network for school alumni. Each school (a tenant) gets its own branded space at <school>.alumninetwork.ca, and graduates can only see and contact their own school's alumni. Herzliah High School (Montreal) is the first tenant; the pilot targets 2026-12-01.
Stack: Next.js (App Router) · React · TypeScript · Supabase (Postgres, row-level security, Auth) · Vercel.
Getting started
Prerequisites
- Node.js 22
- Docker Desktop (WSL 2 backend on Windows), running
- Supabase CLI 2.121 or newer (
supabase --version)
First run
npm install # also installs the pre-commit hook
supabase start # local Postgres, Auth, Studio and Mailpit (first run pulls ~2-3 GB of images)
cp .env.example .env.local # then paste the publishable key from `supabase status -o env`
npm run dev
Open http://herzliah.localhost:3000. The subdomain selects the school: test-school.localhost:3000 is the second school, and plain localhost:3000 is the root site (the page for schools). A session belongs to one school's address, so signing in at one does not sign you in at the other.
supabase start applies supabase/migrations/* and then supabase/seed.sql. The seed contains fictional demo alumni for both schools plus local test accounts, listed below and at the top of supabase/seed.sql.
To sign in, enter one of those emails at /login: the 6-digit code arrives in Mailpit (http://127.0.0.1:54324). Or choose "Sign in with a password": every seed account has the local-only password LocalDev-Passw0rd (ADR 0015). Any account can set its own password at /account/password after signing in with a code.
The platform console is at http://localhost:3000/console (the root site has its own sign-in): sign in as [email protected] to list, create and suspend schools, invite their first school admin and open support access. On a PR preview, add ?tenant=root to reach it.
Local services
Everyday commands
supabase db reset # rebuild the local DB from migrations + seed
supabase migration new <name> # new schema change; never edit applied migrations
npm run db:types # regenerate lib/database.types.ts after a migration
npm run seed:perf # add 10,000 alumni per school (local only; db reset removes them)
npm run bench:directory # time the directory search (p50/p95) after seed:perf
npm run check # lint + typecheck + format check + unit tests
npm run test:db # pgTAP database tests (stack must be running)
npm run test:e2e # Playwright end-to-end + accessibility tests
supabase stop # stop the local stack
Current state
The database runs the v2 schema (data model): three migrations in supabase/migrations/ (schema, access rules, RPCs), with the legacy MVP migrations kept in supabase/legacy/ for history. The app is the V1–V4 MVP being rebuilt onto it, issue by issue. The directory already reads v2 through clients typed from the generated lib/database.types.ts. Sign-in is by emailed code; new people sign up at /join and wait on their account page until the school approves them. Onboarding, the profile editor and the admin pages still use the old tables through an untyped createLegacyClient(), and fail locally until their M2 issues rewire them (each file names its issue).
Local test accounts (sign in with a code from Mailpit). After sign-in each one lands on its own home page:
The seed also holds 200 published Herzliah alumni and 20 at the second school (fictional, @example.test).
Security
Never commit secrets: .env*.local is ignored, and only .env.example (no values) is tracked. The Supabase secret key must never be exposed to the browser. Report vulnerabilities privately (see .github/ISSUE_TEMPLATE/config.yml).
