ListMe

Property listing site for India. Next.js 16 (App Router) + Prisma 7 (pg driver adapter) on Supabase Postgres, Supabase Auth and Storage, Firebase phone OTP. Deployed on Vercel (region bom1).

Production: https://listme-sable.vercel.app

Next.js 16 differs from older versions. Read AGENTS.md and the docs in node_modules/next/dist/docs/ before changing framework code.

Setup

Requires Node.js 20.9 or newer.

npm ci                 # also runs `prisma generate`
cp .env.example .env   # then fill in values
npm run dev            # http://localhost:3000

Every environment variable the code reads is documented in .env.example.

Use a separate development Supabase project. Do not point a local .env at the production database: seed scripts and local testing write real rows.

Scripts

Command	What it does
npm run dev	Dev server
npm run typecheck	tsc --noEmit
npm run lint	ESLint
npm run build	Production build
npm run check	typecheck + lint + build
npx prisma db seed	Seed reference data (prisma/seed.ts); dev databases only

Database

• Schema: prisma/schema.prisma. CLI config: prisma.config.ts (uses DIRECT_URL, falling back to DATABASE_URL).
• There is no migration history yet. RLS and storage policies live in prisma/sql/*.sql and are applied by hand in the Supabase SQL editor.

Admin two-step verification

Every ADMIN / SUPER_ADMIN must pass an authenticator-app check (TOTP) before opening /admin pages or calling admin APIs. The first visit to /admin sends the admin to /admin-verify, which shows a QR code to scan and then 8 one-time backup codes. A successful check lasts 12 hours per browser (listme-admin-mfa cookie).

• Data lives in profiles.role_metadata.mfa (secret encrypted with a key derived from SESSION_SECRET; backup codes stored only as hashes). It is never sent to the browser.

• Changing SESSION_SECRET disables every admin's authenticator (the stored secrets can no longer be decrypted). Clear mfa for all admins (below) so they set it up again.

• Another admin lost their phone: a Super Admin opens Role Manager and uses the "Reset two-step verification" button on that admin's row.

• The only Super Admin lost their phone: sign in, choose "Use a backup code" on /admin-verify, enter one saved backup code, then (optionally) ask a second Super Admin to reset it. If no backup code is left, remove the mfa key in the Supabase SQL editor and set it up again on the next visit:

  update profiles set role_metadata = role_metadata - 'mfa' where phone = '+917777777777';
  

Deploy

Pushes to main deploy to Vercel. Set the same variables as .env.example in the Vercel project (never the dev-only mock-auth flags). Security headers (CSP in report-only mode, HSTS, nosniff, frame protection, Referrer-Policy, Permissions-Policy) are set in next.config.ts.

CI

.github/workflows/ci.yml runs typecheck, lint and build on every pull request with placeholder env values. Dependabot opens weekly minor/patch update PRs.