Admin guide

1Configure Supabase

Open config.js and set your Supabase project URL and public anon/publishable key. Do not add the service-role key, R2 access key, or R2 secret key to browser files. Run the complete supabase/schema.sql in the Supabase SQL editor.

2Assign the first admin

Create your account through Supabase Auth, then find its UUID in Authentication → Users. In SQL Editor, run the following after replacing the UUID with the account you verified:

update public.profiles
set role = 'admin'
where id = 'YOUR_AUTH_USER_UUID';

Never promote an unverified account. Founder and Owner roles should only be assigned by a trusted project owner.

3Automatic ID formats

• Founder: EK-FD-01, EK-FD-02…
• Owner: EK-OW-01, EK-OW-02…
• Admin: EK-AD-01, EK-AD-02…
• Seller: EK-SELL-01, EK-SELL-02…
• Customer: EK-CM-01, EK-CM-02…
• Order: EK-OR-01, EK-OR-02…
• Premium order: EK-PRO-OR-01, EK-PRO-OR-02…

PostgreSQL generates these using atomic counters and unique constraints. Role changes receive a new role-specific user ID; orders are generated server-side on insertion.

4Cloudflare R2 uploads

Use the included Cloudflare Pages Function functions/api/r2-upload.js with an R2 bucket binding. In Cloudflare Pages Settings, add variables SUPABASE_URL, SUPABASE_ANON_KEY, R2_PUBLIC_BASE_URL and secret SUPABASE_SERVICE_ROLE_KEY. Under Settings → Bindings, bind R2 bucket ekannto-media to variable name R2_BUCKET. No Supabase Edge Function or R2 API secret keys are needed by this binding-based upload flow. The function validates the signed-in account role and limits image uploads to 10 MB.

5User and product management

Open /admin.html to sign in, view database counts, review users and update roles. Role changes are passed through the database function admin_set_user_role, which verifies the caller's role. Product upload is available from the storefront's admin upload flow and writes product metadata to Supabase and image objects to R2.

6Important production checklist

• Enable email confirmation and configure Google OAuth redirect URLs in Supabase.
• Use HTTPS on the deployed website and set appropriate CORS origins.
• Keep RLS enabled on every table; never expose service-role credentials.
• Configure a trusted payment provider and server-side checkout before accepting real payments.
• Review and test every RLS policy, role escalation path, file upload, and database migration in a staging project before launch.
• Product gallery UI supports numbered image selection and quantity controls. Live inventory, checkout, payment processing, and full order lifecycle need their respective backend/payment integrations.