QuotationToCash
Multi-tenant quotation and invoice SaaS for small businesses in India, built with GST
(CGST/SGST/IGST) rules in mind. See InvoiceFlow-spec.md and
InvoiceFlow-build-prompt-final.md for the full
product spec and implementation plan.
Stack
Next.js (App Router) + TypeScript, Tailwind CSS + shadcn/ui, Prisma against Supabase
Postgres, Supabase Storage, Clerk auth, Resend for email, react-pdf for PDF export.
Getting started
-
Copy .env.example to .env and fill in real Supabase, Clerk, and Resend
credentials.
-
Install dependencies:
npm install
-
Apply the checked-in migrations to your Supabase database:
npx prisma migrate deploy
(Use npx prisma migrate dev instead once you start changing
schema.prisma yourself — it diffs against the database and writes a new
migration file.)
-
Run the dev server:
npm run dev
Open http://localhost:3000.
Roles & permissions
Each business member has a role — owner, admin, or staff — plus an optional
position in a manager/report hierarchy (reportsToId on BusinessMember). Owner and
Admin see every document unconditionally; Staff visibility is scoped by hierarchy
(themselves and, if they have direct reports, their reports' documents too — see
docs/hierarchy-access-control-design.md).
"Manager" is never a stored role — it's derived live from whether a member has active
direct reports (lib/auth/permissions.ts).
Permission (what a member can do) and scope (which records they can see) are
independent axes — see docs/permission-layer-design.md.
Route handlers call requirePermission() / requireBusinessAdmin() /
requireBusinessOwner() from lib/auth/ to enforce both.
New members join by accepting an emailed invitation (never by "add member by email")
— see docs/invitation-onboarding-design.md
for the token/expiry/rate-limit design.
Public document sharing
Sent documents can be shared via a public, unauthenticated link scoped to the
business's own subdomain ({business-slug}.{apex domain}/public/documents/{token}).
See docs/public-share-subdomains-design.md
for the slug generation/collision handling and why the subdomain isn't resolved in
middleware.
Project structure
app/ routes: (auth), (app) [dashboard, quotations, invoices, customers,
products, settings], onboarding, invitations, invite/[token],
public/documents/[token], api
components/ ui (shadcn), layout, dashboard, documents, customers, products, settings
lib/ auth, business (hierarchy/slug/subdomain), db, tax, documents,
invitations, pdf, email, rate-limit, validation, storage, env
prisma/ schema.prisma, migrations
docs/ design docs for hierarchy/permissions/invitations/public sharing
Business logic (tax calculations, authorization, document calculations) lives in
lib/, not inside React components. Every tenant-owned query must be scoped by
businessId; use requireAuth() / requireBusiness() / requireBusinessOwner() /
requireBusinessAdmin() / requirePermission() from lib/auth/session.ts and
lib/auth/permissions.ts (or the redirect-on-failure *ForPage() variants in
lib/auth/page.ts) to get it — see lib/auth/.
