Moup (Airtribe Team 54): Personal Relationship Manager
Next.js 15 (App Router) + Supabase (Postgres, Auth, RLS) unified platform, alongside the FastAPI prototype backend and static runner.
Validation and local setup
For credential-free checks, start with the
acceptance evidence and safe reproduction commands.
The setup below is separate: installing dependencies, starting Supabase and
applying migrations/seeds require deliberate operator approval and a disposable
local target. They are not prerequisites for the isolated test fixtures.
Run locally
1. Unified App (Next.js 15)
pnpm install
supabase start # needs Docker; applies migrations + seed.sql
cp .env.example .env.local # fill keys from: supabase status
pnpm dev # http://localhost:3000
pnpm test # test suite; use sanitized commands linked above for isolated validation
Legacy live-target smoke is not a safe default gate. scripts/smoke.mjs
loads .env.local for a local target (or an explicitly supplied env file), signs
up users and writes API data; optional service-role checks also write database
rows. Run it only after an operator explicitly approves the exact disposable
target and side effects. Do not run it against a deployment merely to verify
that deployment, and do not change Auth/security settings just to make it pass.
It was not used for the credential-free acceptance evidence below.
Deploying (Vercel + hosted Supabase): see DEPLOY.md.
pnpm check-env validates the env (--prod for production values).
2. FastAPI Prototype Runner
pip install -r requirements.txt
python -m uvicorn main:app --reload --port 8000
Open http://127.0.0.1:8000 - API docs at http://127.0.0.1:8000/docs
Auth
/login has a minimal page (magic link, or email+password sign-in/sign-up).- Social sign-in candidates are Google, Facebook, LinkedIn and Instagram
through Supabase Auth OAuth, but buttons are filtered by the project's provider
settings. Google is the initial/failure fallback, not proof it is configured.
The custom Instagram recipe remains unverified. See
provider setup and readiness boundaries.
- Magic links require the requesting browser's PKCE cookie. Use the latest link;
if it fails, request a fresh one. See
magic-link retry and account-switch boundaries.
- In the browser the session lives in cookies, so
fetch('/api/me/...') just works.
- From scripts/curl:
Authorization: Bearer <supabase access_token>.
Google Contacts import
Contacts → Import Google Contacts offers a separate, read-only Google consent
flow, an unchecked preview, category selection, duplicate detection, and explicit
saves in batches of up to five. It never imports automatically or changes Google
Contacts. Onboarding retains its separate five-person limit.
The connector stays disabled until an authorized operator configures its own
OAuth client, server-side encryption key, and reviewed database migration. See
Google Contacts setup and security notes for exact
scopes, redirects, retention/cleanup, revocation limitations and mock-test coverage.
Adding the code does not connect a real Google account.
API-generated meetup invitation text includes Bengaluru date/time with an explicit
IST (Asia/Kolkata) label, independent of the server timezone. Stored meetup
instants are unchanged; meetup screens continue to display device-local time.
Unscheduled meetups do not invent a date. A separately generated voice-plan
share message is not reformatted by this API fallback.
Private API (signed-in user, scoped by RLS)
| Method | Path | Body / query | Notes |
|---|
| GET | /api/me/dashboard | | goals, contact_counts, recorded_activity (separate measures), contacts_by_category, followups, upcoming_meetups, recent_activity, is_empty |
| GET | /api/me/contacts | ?category=personal|professional|community | |
| POST | /api/me/contacts | one contact, or { contacts: [...] } (max 5, onboarding confirm) | |
| GET | /api/me/contacts/:id | | contact + interaction history |
| PATCH / DELETE | /api/me/contacts/:id | partial contact | |
| GET / PUT | /api/me/goals | { personal, professional, community } | must total 100 |
| GET | /api/me/followups | ?days=14 | { overdue, upcoming } |
| GET | /api/me/interactions | ?limit=20 | recent activity |
| POST | /api/me/interactions | { contact_id, type?, notes?, occurred_at?, next_followup_at? } | completes a follow-up; updates last_interaction_at and next_followup_at |
| GET / POST | /api/me/meetups | { title, activity?, area?, starts_at?, budget? } | POST returns meetup.room_url + invite_text. Nothing is sent automatically. |
| GET / PATCH / DELETE | /api/me/meetups/:id | partial + status, final_venue_id | edit / close |
| POST | /api/extract | { transcript } (max 20,000 chars) | onboarding pre-fill; see below. Stateless, never writes to the DB |
| GET | /api/voice/signed-url | | { signed_url } for the ElevenLabs onboarding agent; 503 if not configured |
Contacts, full contact history, Meetups, follow-ups and dashboard reads return
complete results within a shared per-request safety budget, or an explicit 503
instead of silently truncated lists or counts. See bounded organizer reads for
limits, keyset/HEAD verification, ordering and concurrency guarantees.
Voice onboarding and extraction
Ported from Arindom Chetia's PR #3 (FastAPI routers/voice.py, static/voice.*).
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
