MaVeFaCo Marketplace

Mayon Vegetable Farmers Agriculture Cooperative (MaVeFaCo) — an online marketplace that lets the cooperative's member farmers in Albay sell fresh produce directly to customers, while cooperative staff manage listings, orders, members, and content.

Live: https://mavefaco-sys.vercel.app

---

Contents

• Features
• Tech stack
• Getting started
• Testing
• Project structure
• Security
• Deployment
• Documentation

Features

The app has four roles, from most to least privileged: Admin, Manager, Farmer, and Customer.

Role	What they can do
Customer	Browse the home page's shelf for each category and "This week's harvest" board; search and filter the shop, including out-of-stock produce marked "coming soon" with its expected harvest; view farmer profiles; keep a cart; check out (cash on delivery, or GCash paid straight to the farmer, who confirms the reference number; pickup, or delivery to a spot pinned on a map within Tabaco City and its bordering towns); track, cancel, and confirm orders; review products from delivered orders; message farmers
Farmer	Verify their identity with a government ID (front, back and a selfie holding it, taken with the in-app camera); list products (each reviewed by staff before going live); fix and resubmit, or delete, a listing staff suspended; manage stock and prices; fulfil orders; record each planting and follow its growth stage and harvest window, record harvests straight into stock, and log pests, weather and damage; see a shared pest and weather advisory and a local weather widget; a Market page with each crop's recent sales against planned harvests, alerts, crops worth planting, selling prices beside PSA farmgate prices for Albay and Bicol, also shown when recording a planting; a PSA price reference when pricing a listing
Manager	Approve listings; view a listing and suspend it with reasons (the farmer gets a notice and an email, and has 7 days to resubmit before it is deleted), or delete a suspended one early; restore archived listings; move orders through their lifecycle; manage categories, crop types and announcements (shown to everyone, farmers only or customers only); see upcoming supply by crop and week; review farmers' ID submissions and approve or reject them with reasons, or verify a farmer in person; suspend customers and farmers; view reports and farmer performance; the Market page, with crops to recommend planting, PSA prices and production for Albay and Bicol, and alerts that can be turned into an advisory
Admin	Everything a manager can do, plus deleting accounts, resetting passwords and two-factor authentication, overriding order status, the audit log, homepage banners and FAQs (ordered with move up/down), and site content

Admin and manager accounts must use an authenticator app (two-factor authentication) to sign in.

Only customers buy: farmers, managers and admins have no cart and can't place orders. Managers and admins work from their dashboard and don't see the storefront.

Tech stack

Layer	Technology
Framework	Next.js 16 (App Router), React 19, TypeScript
Styling	Tailwind CSS 4; Big Shoulders and Hanken Grotesk fonts; the cooperative's logo (client/public/logo.svg)
Database	PostgreSQL via Prisma 7
Hosting	Vercel (app and daily cron job), Supabase (Postgres and file storage)
Email	Brevo, with the logo letterhead on every email
Validation	Zod, shared between forms and API routes
Testing	Vitest — unit tests, plus integration tests against a real Postgres database

Getting started

Prerequisites

• Node.js 24
• PostgreSQL running locally (16 or newer)

1. Install

cd client
npm ci

2. Configure

Create client/.env (it is git-ignored). For local development both database URLs can point at the same local database:

DATABASE_URL="postgresql://USER:PASSWORD@localhost:5432/capstone_db"
DIRECT_URL="postgresql://USER:PASSWORD@localhost:5432/capstone_db"
JWT_SECRET="<at least 32 random characters>"
TOTP_ENCRYPTION_KEY="<at least 32 random characters>"
ID_NUMBER_HASH_KEY="<at least 32 random characters>"  # optional locally; derived from JWT_SECRET if unset

# Optional locally — the related features fail gracefully without them
BREVO_API_KEY=""              # emails (verification, password reset)
SUPABASE_URL=""               # image uploads and ID verification
SUPABASE_SERVICE_ROLE_KEY=""
SUPABASE_ANON_KEY=""          # optional: instant page updates (else a 15 s poll)
GEMINI_API_KEY=""             # optional: AI crop report for staff (Google Gemini free tier)
CRON_SECRET=""                # the ID-photo and suspended-listing cleanup jobs

Generate random secrets with:

node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"

See client/DEPLOYMENT.md for what every variable does in production.

3. Set up the database

npx prisma migrate deploy

The generated Prisma client is committed in client/generated/; run npx prisma generate after changing prisma/schema.prisma.

4. Run

npm run dev

Open http://localhost:3000.

Creating the first admin

Sign-up only offers the customer and farmer roles, so staff accounts are promoted directly in the database:

1. Register normally at /register.
2. Without BREVO_API_KEY no verification email is sent, so mark the email verified yourself.
3. Promote the account:

UPDATE "User"
SET role = 'admin', "emailVerifiedAt" = NOW()
WHERE email = '[email protected]';

On the next login you will be asked to set up two-factor authentication with an authenticator app, and shown one-time backup codes to keep safe.

Testing

All commands run from client/.

This is the beginning of the README. Read the rest at the original. Read the full README ↗