# Supabase setup (Phase 4)

One-time steps to connect the review portal to Supabase. None of these require
pasting secrets into chat — you do them in the Supabase dashboard and your own
shell.

## 1. Create the project
1. Go to https://supabase.com → New project (free tier is fine).
2. Pick a name (e.g. `review-portal`) and a strong database password.
3. Wait for it to provision (~2 min).

## 2. Fill in the public keys
From **Project Settings → API**, copy:
- **Project URL**
- **anon public** key

Edit `/srv/apps/review/.env` in your own shell (nano/vi) and replace the two
placeholders:
```
NEXT_PUBLIC_SUPABASE_URL=<Project URL>
NEXT_PUBLIC_SUPABASE_ANON_KEY=<anon public key>
```
(These are public values, safe to bake into the app. No service-role key or DB
password is stored on the server.)

Sanity check — should print `0` (no placeholders left):
```
grep -c REPLACE_WITH_ /srv/apps/review/.env
```

## 3. Apply the schema + seed
In the Supabase dashboard → **SQL Editor → New query**, paste and run, in order:
1. the contents of `supabase/migrations/0001_init.sql`
2. the contents of `supabase/seed.sql`

This creates the tables, the status-change logging trigger, RLS policies, the
private `note-images` storage bucket, and seeds the Brentwood project.

(Alternatively, if you'd rather I run them for you, that path needs the DB
connection string on the server — tell me and I'll walk through it. The SQL
Editor route keeps the server free of DB credentials.)

## 4. Create your login user
Dashboard → **Authentication → Users → Add user** → enter your email + a
password. (The portal has no public sign-up; users are added here.)

## 5. Tell me "done"
I'll then `srv-gw deploy --project review --build`, run the security audit, and
we'll test login + live edits together.