Sonata CRM
A modern booking and management system for piano technicians and their customers.
🎹 About
Sonata CRM is a multi-tenant Next.js application. Technicians sign up, manage
customers, pianos, appointments, availability and service types, and customers
book online. The Express API and Railway deployment were retired in the
2026 overhaul — Next.js route handlers + Prisma are the whole backend.
🚀 Tech Stack
- App: Next.js 15 (App Router), React 19, TypeScript, Tailwind CSS v4
- UI: shadcn/ui-style primitives (
apps/web/components/ui), Lucide icons,
Sonner toasts, scoped liquid-glass chrome (auth / marketing / modals)
- Database: PostgreSQL via Prisma (Supabase Postgres in production)
- Authentication: Supabase Auth in production; signed-cookie Prisma/bcrypt
credentials fallback for local development before Supabase is configured
(see
supabase/cutover.md)
- Deployment: Vercel (app) + Supabase (database & auth)
- Monorepo: Turborepo
🎨 Design System
DESIGN.md is the canonical design system: tokens, the
glass-vs-solid surface rules, the component catalog, and conventions for
auth/forms/tables. Read it before building UI — implementations live in
apps/web/components/ui, apps/web/components/auth, and
packages/tailwind-config/shared-styles.css.
📁 Project Structure
sonata-crm/
├── apps/
│ └── web/ # Next.js app: pages, app/api route handlers, prisma/
├── packages/ # Shared tailwind / typescript / eslint configs
├── supabase/ # RLS policies + production cutover checklist
└── backups/ # Local pg_dump backups (gitignored)
🛠️ Quick Start
Prerequisites
- Node.js 20+
- PostgreSQL (local, or a Supabase project)
1. Install
make install
cp apps/web/.env.example apps/web/.env # then fill in DATABASE_URL + AUTH_SECRET
2. Database
make migrate # apply migrations
make seed # seed sample technicians/customers (bcrypt-hashed passwords)
Seed password defaults to Sonata-Dev-2026! (override with
SEED_TECH_PASSWORD). Seeded accounts: [email protected],
[email protected], [email protected].
3. Run
make dev # http://localhost:3001
Log in at http://localhost:3001/tech/login with a seeded account, or create a
new tenant at /tech/sign-up.
📦 Scripts
make install / generate / seed / dev / migrate / reset
cd apps/web
yarn lint # ESLint (warnings ratcheted, see eslint config)
yarn check-types # tsc --noEmit
yarn test # Vitest: session tokens + tenant-isolation (needs DATABASE_URL)
yarn test:e2e # Playwright: login, sign-up, dashboard guard, booking page
yarn build # production build (type + lint gates enforced)
🔐 Authentication & multi-tenancy
- Route protection:
apps/web/middleware.ts (Supabase session refresh, or
local session cookie presence) + server-side checks in every route handler.
- Every API query is scoped by the signed-in technician's id — client-supplied
tenant ids are ignored. Cross-tenant reads return 404 (proven by
apps/web/lib/tenant-isolation.test.ts and the API itself).
- Passwords are bcrypt-hashed; no password is ever logged or returned by an API.
- Going to production with Supabase Auth: follow
supabase/cutover.md.
Setting NEXT_PUBLIC_SUPABASE_URL + NEXT_PUBLIC_SUPABASE_ANON_KEY
switches the app to Supabase Auth automatically.
🚀 Deployment (Vercel + Supabase)
- Create the Supabase project, run
npx prisma migrate deploy against it.
- In Vercel, set:
DATABASE_URL (pooled), AUTH_SECRET,
NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY,
SUPABASE_SERVICE_ROLE_KEY, and optionally Cloudinary keys for piano photos.
- Deploy. No separate API service exists anymore.
📄 License
MIT
