The Box Portal

Member-facing web app and back office for The Box, the community makerspace run by Discover Burien (Burien, WA).

Status

Phase 5 (current): Prisma schema + seed, PrismaDataProvider, Auth.js magic links, Google Drive CMS sync scaffold, Docker Compose (Mailpit), Vitest, Playwright smoke tests. UI still defaults to mock data for day-to-day work.

Phase 4: staff admin + /dev/reader
Phase 3: classes, reserve, learn/quizzes
Phase 2: onboarding, dashboard, account, certifications, usage
Phase 1: shell, fixtures, public pages

Local development (mock UI — default)

npm install
npm run dev

Open http://localhost:3000. Use Dev · Switch user at the bottom. That toolbar and the fixture data are for local work only. They are not part of the live site.

Local quick share while your laptop is on (temporary):

npx cloudflared tunnel --url http://localhost:3000

Production: Cloudflare Workers + D1

Live at https://discoverburienmakerspace.com (the Worker's default thebox.james-trey-young.workers.dev address also works but is not the canonical one — sessions are per hostname, so always link to the root domain). Deploys from main through Cloudflare Workers Builds (Workers & Pages → thebox → Settings → Build). A pull request gets its own preview deployment.

• Build command: npx opennextjs-cloudflare build
• Deploy command: bash scripts/cf-deploy.sh — applies migrations/*.sql to the thebox-db D1 database, optionally seeds, then deploys the OpenNext bundle.
• Config: wrangler.jsonc (Worker name, D1 binding DB, plain-text vars). Secrets live in the dashboard under Settings → Variables and Secrets: AUTH_SECRET, AUTH_RESEND_KEY, ZEFFY_API_KEY, ZEFFY_WEBHOOK_SECRET, DISPLAY_TOKEN, READER_SHARED_SECRET.

Database. Prisma uses @prisma/adapter-d1 on Workers (src/lib/db.ts); in Node scripts it falls back to DATABASE_URL. D1 runs $transaction as plain sequential queries. The schema is still prisma/schema.prisma; D1 gets it through migrations/:

1. Edit prisma/schema.prisma and push. The db-artifacts GitHub workflow rebuilds a scratch DB from the existing migrations, diffs it against the schema, and commits the next migrations/NNNN_*.sql plus a refreshed prisma/seed-data.sql to your branch.
2. Merge. The deploy applies the new migration before the Worker is published.

Seeding production once. Add a build variable SEED_D1=1 (Settings → Build → Variables), deploy, then remove it. seed-data.sql uses INSERT OR IGNORE, so it never overwrites edits made in the portal.

Sign-in email. Workers have no SMTP, so production uses the Resend provider when AUTH_RESEND_KEY is set (src/auth.ts); locally it still uses Nodemailer/Mailpit.

Classes & calendar

Zeffy is where a class is created. An hourly Worker cron (src/worker.ts) pulls event campaigns into ClassSession and pushes them to Google Calendar. Paid events go to the classes calendar. Free events, and classes created in the portal, go to the community calendar. Sheet-imported rows (source = csv) are not pushed.

1. Create a Google Cloud service account, enable the Calendar API, and store the JSON key as the secret GOOGLE_SERVICE_ACCOUNT_JSON.
2. In the discovermakers Google Calendar, share box classes and community classes with the service-account email as Make changes to events. Copy each calendar id into GOOGLE_CALENDAR_CLASSES_ID and GOOGLE_CALENDAR_COMMUNITY_ID.
3. Delete the hand-entered Nov/Dec events on those calendars (or retire the calendars and create fresh ones). The sync never edits an event that it did not create.
4. Recreate the Nov/Dec classes in Zeffy (ticketed when paid, free RSVP for make nights). In the portal, set Default class instructor under Admin → Settings, then use Sync from Zeffy now on Admin → Classes. Confirm the calendar.
5. After that deploy, mark the old sheet rows once:

npx wrangler d1 execute thebox-db --remote --file=scripts/one-off/mark-csv-class-sessions.sql

Then use Archive CSV-imported sessions so the public classes page only shows Zeffy classes. 6. Embed the Google Calendar on the Discover Burien Squarespace “Makerspace Classes” page.

SYNC_SECRET lets a caller POST /api/sync/zeffy without a staff session. The cron calls the sync directly and does not need it.

Prisma (SQLite)

cp .env.example .env   # set AUTH_SECRET, DATABASE_URL=file:./dev.db
npm run db:push
npm run db:seed

• Schema: prisma/schema.prisma (mirrors fixtures; SQLite in dev)
• Seed: npm run db:seed loads data/mock/*.json
• Provider: createPrismaDataProvider() when DATA_PROVIDER=prisma (see src/lib/data/factory.ts)

Mode	What to set	What the browser uses
Local next dev	leave both unset	Fixtures and the Dev toolbar, for building only
Live site	production build on Cloudflare. Optional: DATA_PROVIDER=prisma and NEXT_PUBLIC_DATA_MODE=live	Auth.js session and D1. A production build does this by default.

/workstation and /api/me talk to Prisma directly (incremental upserts — no full-table wipe). The lobby display keeps using /api/display/feed.

Workstation (shared Windows PCs)

/workstation?device=BOX-PC-1 is the kiosk UI (no public header/footer/Dev toolbar). PIN or phone QR logs in the same User row. Magic links stay for home use.

Login is identity + which software you may open. Sitting at a desk URL does not start a clock or debit credits. Charge when a job is sent (estimate shown first). 3D: grams × (filament $/kg × 1.30 / 1000), default ~$12/kg PLA → ~1.56¢/g, min $1 member / $5 nonmember. Laser/CNC: estimated run time rounded up 5 min (member/nonmember rates). Vinyl, woodshop, sewing, hand tools: included. Sublimation $1/$2 per print. Unlimited: log the job at $0 machine time. Prints and spooler jobs are not cancelled on logout.

This is the beginning of the README. Read the rest at the original. Read the full README ↗