DealAtlas
UK-first B2B opportunity intelligence. This repository contains the Next.js application, Supabase migrations, and product specifications.
Stack
- Next.js 16 App Router
- TypeScript (strict)
- Tailwind CSS v4
- shadcn/ui
- Supabase SSR/Auth/Postgres
- Dodo Payments (
@dodopayments/nextjs) for Pro checkout, webhooks, and the customer portal
- Vercel-compatible runtime
Local development
npm install
cp .env.example .env.local
npm run dev
Fill .env.local with local Supabase values (npx supabase start prints the API URL and keys). Never prefix server secrets with NEXT_PUBLIC_.
Email/password auth is available at /signup, /login, /forgot-password, and /reset-password. Those pages also offer Sign up / Sign in with Google. Set NEXT_PUBLIC_GOOGLE_CLIENT_ID so Google’s account picker shows dealatlas.uk instead of *.supabase.co (SETUP_STEPS.md Phase G). Local Supabase currently auto-confirms email; hosted production should require verification. Auth emails from the local stack appear in Mailpit/Inbucket (npx supabase status prints the URL).
Scripts
| Command | Purpose |
|---|
npm run dev | Next.js development server |
npm run lint | ESLint |
npm run typecheck | TypeScript --noEmit |
npm test | Vitest unit/integration tests |
npm run build | Production build |
npm start | Start the production server |
npm run db:start | Start local Supabase (Docker) |
npm run db:reset | Recreate the local database from migrations |
npm run db:types | Generate lib/db/database.types.ts from local schema |
npm run db:test | Run pgTAP database tests |
npm run test:db | pgTAP, rollback checks (needs psql) and PostgREST RLS smoke tests |
npm run db:bundle | Refresh supabase/dealatlas_full_schema.sql from migrations |
npm run ingest -- --source find-a-tender | Ingest one registered source (official Find a Tender OCDS API) |
npm run ingest:smoke | Controlled live smoke: a few recent Find a Tender records |
Never run db reset against a linked production database. Never expose SUPABASE_SECRET_KEY as a NEXT_PUBLIC_ variable.
Specification
SETUP_STEPS.md — manual setup orderCURSOR_GOALS.md — ordered Cursor /goal prompts.cursor/rules/dealatlas.mdc — always-on engineering safeguardsdocs/PRODUCT.md — product / free-vs-Pro behaviourdocs/ARCHITECTURE.md — technical architecturedocs/DATABASE.md — database model and security boundarydocs/DATA_INGESTION.md — public/private source ingestiondocs/SECURITY.md — anti-bypass and security rulesdocs/BILLING_DODO.md — Dodo subscription behaviourdocs/DESIGN.md — UI design systemdocs/TECHNICAL_SEO.md — technical SEOdocs/TESTING_AND_LAUNCH.md — test and launch gatesdocs/LAUNCH_CHECKLIST.md — remaining manual production steps (credentials, Dodo live, DNS, legal)supabase/migrations/*.sql — executable database migrations
Core security rule
Free users receive only deal_previews. Buyer/company name, source, source title, URLs, references, exact identifying facts, documents and contacts remain protected until server-side Pro entitlement is verified.
