Sonata CRM

A modern booking and management system for piano technicians and their customers.

🎹 About

Sonata CRM is a multi-tenant Next.js application. Technicians sign up, manage customers, pianos, appointments, availability and service types, and customers book online. The Express API and Railway deployment were retired in the 2026 overhaul — Next.js route handlers + Prisma are the whole backend.

🚀 Tech Stack

• App: Next.js 15 (App Router), React 19, TypeScript, Tailwind CSS v4
• UI: shadcn/ui-style primitives (apps/web/components/ui), Lucide icons, Sonner toasts, scoped liquid-glass chrome (auth / marketing / modals)
• Database: PostgreSQL via Prisma (Supabase Postgres in production)
• Authentication: Supabase Auth in production; signed-cookie Prisma/bcrypt credentials fallback for local development before Supabase is configured (see supabase/cutover.md)
• Deployment: Vercel (app) + Supabase (database & auth)
• Monorepo: Turborepo

🎨 Design System

DESIGN.md is the canonical design system: tokens, the glass-vs-solid surface rules, the component catalog, and conventions for auth/forms/tables. Read it before building UI — implementations live in apps/web/components/ui, apps/web/components/auth, and packages/tailwind-config/shared-styles.css.

📁 Project Structure

sonata-crm/
├── apps/
│   └── web/          # Next.js app: pages, app/api route handlers, prisma/
├── packages/         # Shared tailwind / typescript / eslint configs
├── supabase/         # RLS policies + production cutover checklist
└── backups/          # Local pg_dump backups (gitignored)

🛠️ Quick Start

Prerequisites

• Node.js 20+
• PostgreSQL (local, or a Supabase project)

1. Install

make install
cp apps/web/.env.example apps/web/.env   # then fill in DATABASE_URL + AUTH_SECRET

2. Database

make migrate     # apply migrations
make seed        # seed sample technicians/customers (bcrypt-hashed passwords)

Seed password defaults to Sonata-Dev-2026! (override with SEED_TECH_PASSWORD). Seeded accounts: [email protected], [email protected], [email protected].

3. Run

make dev         # http://localhost:3001

Log in at http://localhost:3001/tech/login with a seeded account, or create a new tenant at /tech/sign-up.

📦 Scripts

make install / generate / seed / dev / migrate / reset

cd apps/web
yarn lint          # ESLint (warnings ratcheted, see eslint config)
yarn check-types   # tsc --noEmit
yarn test          # Vitest: session tokens + tenant-isolation (needs DATABASE_URL)
yarn test:e2e      # Playwright: login, sign-up, dashboard guard, booking page
yarn build         # production build (type + lint gates enforced)

🔐 Authentication & multi-tenancy

• Route protection: apps/web/middleware.ts (Supabase session refresh, or local session cookie presence) + server-side checks in every route handler.
• Every API query is scoped by the signed-in technician's id — client-supplied tenant ids are ignored. Cross-tenant reads return 404 (proven by apps/web/lib/tenant-isolation.test.ts and the API itself).
• Passwords are bcrypt-hashed; no password is ever logged or returned by an API.
• Going to production with Supabase Auth: follow supabase/cutover.md. Setting NEXT_PUBLIC_SUPABASE_URL + NEXT_PUBLIC_SUPABASE_ANON_KEY switches the app to Supabase Auth automatically.

🚀 Deployment (Vercel + Supabase)

1. Create the Supabase project, run npx prisma migrate deploy against it.
2. In Vercel, set: DATABASE_URL (pooled), AUTH_SECRET, NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, and optionally Cloudinary keys for piano photos.
3. Deploy. No separate API service exists anymore.

📄 License

MIT