EventureOS
The operating system for event businesses.
Enquiry → Customer → Event → Quote → Acceptance → Calendar → Delivery → Invoice → Payment — in one place.
What's in this build (Phase 1, part 1)
| Area | Status |
|---|
| Multi-tenant database with Row Level Security | ✅ |
| Sign in / sign up / create organisation | ✅ |
| App shell: navigation, global search (⌘K), organisation switcher, notifications, quick-create | ✅ |
| Dashboard: KPIs, attention centre, upcoming events, 7-day calendar, tasks, outstanding payments, communication, activity | ✅ |
| Enquiries inbox + enquiry workspace + Convert to event | ✅ |
| Events list + event workspace (9 tabs, journey timeline, audit-logged edits) | ✅ |
| Clients list + basic client page | ✅ |
| Full CRM record, Quote builder, Customer portal, Calendar, Integrations screen | Next build |
| Gmail, Google Calendar (Phase 2) · Xero (Phase 3) · AI classification (Phase 4) | Later |
Stack
Next.js 15 (App Router, Server Actions) · Supabase (Postgres, Auth, RLS) · Tailwind CSS · deployed on Vercel.
Environment variables (Vercel → Settings → Environment Variables)
NEXT_PUBLIC_SUPABASE_URL=https://hrarethuqwfmtewxngxt.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_… (see .env.example)
Both values are public by design; the data is protected by Row Level Security in Postgres.
Tenant security model
- Every tenant table has
organisation_id. RLS policies allow access only when the signed-in user is an active member of that organisation (is_org_staff, is_org_manager helpers).
- Relationships use composite foreign keys
(id, organisation_id), so a record can never point at another tenant's customer, event or quote — even with a crafted request.
- Customers (portal role) cannot read staff data. Only managers and above can delete. The audit log is append-only.
- Published quote versions are immutable (enforced by a database trigger).
- Integration tokens live in
integration_credentials, which no client role can read.
Database
Migrations are in supabase/migrations and have been applied to the eventureos Supabase project.
Demo data: supabase/seed/seed.sql (generated by generate_seed.py, dates relative to today). Re-running it
wipes and recreates only the two demo organisations and demo users.
Demo logins (password EventureDemo!2026)
