MLAM Studio Pro — one independent website
Local, unified successor to the two separate Sites projects. This folder is not deployed and is not tied to a Sites project ID. The original MLAM_DAW_SITE and MLAM_PLUGIN_SITE checkouts and hosted sites have not been deleted or modified by this consolidation.
One origin
/ and /plugins: green MLAM Studio Pro storefront, actual product artwork, rotating 360° Y-axis 3D logo, plugin prices/details/demo links, and DAW coming soon./tutorials: uploaded How to use videos, with seeking/range streaming./downloads: licensed ZIP downloads./checkout?product=...: same-site purchase destination. Payments are deliberately disabled until a real merchant provider is integrated./admin: MLAM Studio Pro Administration. Manage products, upload images, demo/full ZIPs and videos, view orders and issue/revoke download licenses./admin/login: owner-only Supabase email/password sign-in. The server allowlists one confirmed owner email through MLAM_ADMIN_EMAIL; admin/customer sessions use separate HttpOnly cookies.- Owner Administration is reached directly at
/admin; the public storefront and customer-account screens do not show an Admin link. This is presentation only, not the authorization boundary: owner login and API guards remain mandatory. /admin?section=products, releases, or videos keeps the selected upload section through login. Unknown section values cannot become external redirects. Mobile Administration keeps visible text labels and sign-out instead of icon-only controls.
Run locally
Node.js 24+ required (built-in node:sqlite). Reproducible installation: pnpm install --frozen-lockfile using the included lockfile. The development machine uses local dependency junctions plus an isolated Supabase dependency runtime to avoid duplicating large packages on a nearly-full drive. Do not ship node_modules, node_modules-shared or .local-auth-runtime; install from package.json on the host.
npm run db:migrate
npm run dev
Open http://127.0.0.1:4180/; Admin is http://127.0.0.1:4180/admin on the same origin.
Responsive layouts cover storefront, account/checkout forms, tutorial videos, product dialogs and Administration. Fluid grids and wrapping controls fit narrow phones, tablets and desktop widths without hiding page overflow. The device-width viewport does not restrict browser zoom; touch controls have 44px targets and mobile form fonts are 16px.
Customer login/signup use a compact, light account card inspired by the owner's supplied reference: Log in/Create account navigation, email/password first, Google below, an accessible show/hide-password control, and MLAM green accents. Customer setup notices do not expose internal Supabase instructions. The signed-in customer page separates account details, verification status, purchases and useful download/tutorial links without inventing orders or license counts. Styling is scoped to customer pages; owner Administration and backend authentication are unchanged.
Admin uses the same Supabase project as customer authentication but remains owner-only: the confirmed Supabase account must match the server-only MLAM_ADMIN_EMAIL allowlist. There is no public Admin registration, customer metadata cannot grant Admin, and the role is checked server-side on every protected request. To set the local allowlist privately, double-click ADMIN-SETUP.cmd or run npm run admin:setup; this asks only for the confirmed Supabase email (never the password), writes MLAM_ADMIN_EMAIL to .env.local, and requires restarting the local server. On a hosted server, set that variable in the host's private environment instead. Customers and Admin keep separate Supabase cookies.
Supabase issues and refreshes the Admin session in an HttpOnly, SameSite=Lax cookie (Secure on HTTPS); each request verifies the user with Supabase and checks the allowlisted email. Admin login is limited to 5 attempts per normalized email per 15 minutes and 30 requests per source per 15 minutes. Explicit same-origin checks apply to every mutating API request. Do not expose port 4180 directly to the internet.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
