WorkDocs File Management System (MVP)

Next.js App Router + TypeScript + Tailwind + Supabase (Auth + Postgres + Storage).

Environment Variables

Create .env.local in project root:

NEXT_PUBLIC_SUPABASE_URL=your_supabase_project_url
NEXT_PUBLIC_SUPABASE_ANON_KEY=your_supabase_anon_key
SUPABASE_SERVICE_ROLE_KEY=your_supabase_service_role_key
NEXT_PUBLIC_APP_URL=http://localhost:3000

Notes:

• SUPABASE_SERVICE_ROLE_KEY is required for admin-provisioned user invites and status management.
• Keep service role key server-side only.
• Configure SMTP in Supabase Auth settings so invite emails are delivered.

Install and Run

npm install
npm run dev

Open http://localhost:3000.

SQL Migration

1. Open Supabase Dashboard -> SQL Editor.
2. Run supabase/migrations/001_init.sql.

This migration creates:

• Tables: profiles, uploads, upload_locations, audit_logs
• profiles lifecycle fields: status, invited_at, activated_at, created_by, department
• Trigger for profile row creation from auth.users
• RLS policies for user/admin access
• Private storage bucket workdocs with object policies

Auth Model (Admin-Provisioned)

• /auth is login-only (no public registration).
• Admins invite users from /admin/users.
• Employee receives invite email and completes setup on /invite.
• Account status lifecycle: invited -> active or suspended.

Suspended users:

• Cannot proceed through login/dashboard flows.
• See a clear suspension message.

Admin User Management

Route: /admin/users

Features:

• List all users from profiles
• Create invite (email, full_name, optional department)
• Resend invite email
• Activate or suspend user

Admin Audit Logs

Route: /admin/audit

Features:

• View recent audit entries from audit_logs
• Filter by action and free-text search
• Inspect actor, IP, target upload, and JSON details

Promote a User to Admin

Run in Supabase SQL Editor:

update public.profiles
set role = 'admin', status = 'active', activated_at = now()
where email = 'admin@yourcompany.com';

Upload Features (Unchanged)

• /dashboard: upload file + metadata + GPS/IP evidence
• /admin: all uploads with uploader and location evidence
• /uploads/[id]: upload details with secure download

Admin /admin includes:

• Date range filter: All time, Today, Last 7 days, Last 30 days
• CSV export endpoint honoring active filters

Test Invite Flow

1. Log in as admin.
2. Open /admin/users.
3. Create invite for an employee email.
4. Open invite email link (/invite?...).
5. Set password and profile details.
6. Confirm redirect to /dashboard and status updates to active.

Test Suspension

1. In /admin/users, suspend a user.
2. Attempt login as suspended user.
3. Verify blocked login and suspension message.