Entity Document CRM
Version 1 requirements
Goal
An internal web app to manage documents (EIN, licenses, insurance) for 20 business entities in retail, insurance, and service industries, with department-level confidential access. It must be free to run.
Stack
- Frontend: Next.js (React), deployed free on Vercel.
- Backend and database: Supabase free tier (Postgres, Auth, and file storage).
- Auth: Supabase Auth, with an email and password login for each staff member.
- File storage: Supabase Storage buckets for photos and PDFs of licenses, EIN letters, and insurance certificates.
- Security: Postgres Row Level Security (RLS), so access is enforced in the database, not just hidden in the UI.
Core features (v1)
- Login with Supabase Auth.
- Entity list: a dashboard of all 20 businesses, filtered to the ones the logged-in user is allowed to see.
- Entity detail page: EIN info, licenses, and insurance, with document photos and PDFs that can be viewed and downloaded.
- Document upload (photo or PDF) to an entity. It must work on mobile: staff should be able to take a photo with their phone's camera and upload it on the spot, not just pick an existing file. An HTML file input with
capture="environment"gives mobile browsers the camera as an option without any extra library. - Expiration tracking: flag licenses and insurance that expire within 30 or 60 days.
- Admin panel: choose which users can see which entities.
Access model
- Each staff account is given access to specific entities rather than to a category. This keeps things flexible, since the department structure isn't final yet.
- Admins can see and manage everything and assign access.
- Regular users only ever see the entities they've been given access to.
As built, this became three roles:
| Role | Sees | Can change |
|---|---|---|
| Admin | Every entity | Everything: entities, records, documents, access grants, and roles |
| Editor | Only entities they've been granted | EIN records, licenses, insurance, and their documents on those entities. Editors can't create entities or grant access. |
| Viewer | Only entities they've been granted | Nothing (read-only) |
Status
v1 requirements
| Requirement | Status |
|---|---|
| Login | Done |
| Entity list, filtered by access | Done |
| Entity detail with document viewing | Done |
| Document upload with mobile camera | Done |
| Expiration alerts (30 and 60 days) | Done |
| Admin access-assignment panel | Done |
Added since v1
- Edit and delete for EIN records, licenses, and insurance policies.
- An editor role with write access limited to granted entities.
- An audit log of every create, edit, and delete, written by database triggers so the app can't forget to log a change.
- Self-service password reset, plus a "send reset link" button for admins.
- Monthly cash sheets for each entity, with upload confirmations and a monthly email listing missing sheets (sent by a Vercel Cron job).
- Admin tools to delete staff logins, and to delete entities (with type-to-confirm).
- Database migration tracking, and a CI build check on every push.
Build order
- Set up the Supabase project and run the schema.
- Scaffold the Next.js app and connect the Supabase client.
- Build the auth and login flow.
- Build the entity list and detail views.
- Build document upload with Supabase Storage.
- Build the admin access-assignment panel.
- Add the expiration alerts dashboard.
- Deploy to Vercel (free tier).
Notes and constraints
- Free-tier limits: Supabase's free tier includes a 500 MB database, 1 GB of file storage, and 50,000 monthly active users. That's plenty for this use case, but worth revisiting if photo volume grows.
- Entity type is a field, not a separate schema. Documents can then be filtered and labeled by type (retail, insurance, service, and so on) without restructuring anything.