Travio
Mobile-first travel planning web app: the whole trip (itinerary, stays, transport, tickets, travelers) in one place.
Stack: Next.js, TypeScript, Tailwind CSS, shadcn/ui, Supabase.
Development
Requires Docker and the Supabase CLI.
npm install
cp .env.example .env.local # then paste the publishable key from `supabase status`
supabase start # local Postgres, Auth, Storage and Studio (http://127.0.0.1:54323)
npm run dev
Open http://localhost:3000.
Database
- Migrations live in
supabase/migrations/ and are plain SQL.
- New migration:
supabase migration new <name>; rebuild the local database from the migrations: supabase db reset.
- After changing the schema, regenerate the TypeScript types:
npm run db:types.
Tests
npm test # Vitest: schedule, conflicts, dates, Today, budget split… (src/lib/**/*.test.ts)
npm run typecheck # route types + tsc
npm run test:db # pgTAP against the local database: RLS and invitations (supabase/tests/)
The database tests run inside a transaction that is rolled back, so they leave no data behind. The first npm run test:db downloads the pg_prove image and can take a few minutes.
GitHub Actions runs all of this on every push (.github/workflows/ci.yml). In Vercel, Settings → Deployment Checks requires the "Travio CI" commit status (posted by the last CI job once "App" and "Database" pass), so a red build is never promoted to production.
Authentication
Supabase Auth with email/password and Google. Sessions live in cookies (@supabase/ssr); src/proxy.ts refreshes them on each request and redirects signed-out users to /login. Authorization itself is RLS in the database.
Locally, email confirmation is off, so sign-up signs you in immediately. Emails sent by Auth can be read in Mailpit: http://127.0.0.1:54324.
Google sign-in
Disabled until you have OAuth credentials:
-
In Google Cloud Console → APIs & Services → Credentials, create an OAuth client ID of type Web application.
-
Add the authorized redirect URI http://127.0.0.1:54321/auth/v1/callback (for the hosted project it is https://<project-ref>.supabase.co/auth/v1/callback).
-
Create supabase/.env (git-ignored) with:
SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID=...
SUPABASE_AUTH_EXTERNAL_GOOGLE_SECRET=...
-
Set enabled = true under [auth.external.google] in supabase/config.toml and restart: supabase stop && supabase start.
Avisos por correo
Emails go out through Resend (src/lib/email/send.ts,
templates in src/emails/). Without RESEND_API_KEY they're only logged.
Without a verified domain Resend only delivers to the account owner's address.
What sends what:
- Invitations and "X se unió / salió": right away, from the server actions.
- Change summaries (hourly or daily, per person) and the reminder the day
before a trip: a job at
POST /api/avisos/enviar, called every 10 minutes by
pg_cron in Supabase (migration 20261005150000_trip_events_and_cron.sql).
Changes are recorded by triggers in trip_events.
Each environment needs:
-
Env vars (.env.local locally, Vercel in production): SUPABASE_SECRET_KEY,
RESEND_API_KEY, EMAIL_FROM, CRON_SECRET (see .env.example).
-
Two Vault secrets in that environment's database, so pg_cron knows where to
call and with what (run in the SQL editor, or with psql locally):
select vault.create_secret('<app url>/api/avisos/enviar', 'notifications_url');
select vault.create_secret('<same value as CRON_SECRET>', 'notifications_secret');
Locally the URL is http://host.docker.internal:3000/api/avisos/enviar (the
database runs in Docker). Without these secrets the job simply doesn't run.
To run the job right away instead of waiting for the clock:
select public.request_notification_run(); and check net._http_response.
