Case 06: Unit Gestao – Vertical ERP for Bespoke Manufacturing

Unit Gestao Beab'atelie Web system for managing orders, scheduling, customers, products, finance, and PDF reports, with Supabase authentication and a Next.js (App Router) interface. Overview Application focused on an atelier's daily flow: customer and product registration, order creation with items, delivery scheduling, monthly financial control, configurable reminders, and PDF report generation. The entire data layer runs on Supabase (Postgres + Auth + Storage), with business rules implemented via triggers, views, and RPCs. Architecture

[Browser]
  |-- UI (Next.js App Router)
  |-- Server Components (fetchApi)
  |-- Client Components (fetchApiClient)
           |
        /api/* (Route Handlers)
           |
   Repositories (src/lib/repositories)
           |
Supabase (Postgres + Auth + Storage)

Tech Stack

Core Modules

Technical Flows

1. Order creation: the form accepts existing or new customers, existing or new items, calculates total and status (Open, Partial, Paid), sends to POST /api/pedidos and uses RPC create_order_with_items to persist order and items.
2. Schedule: lists records from the agenda_entries view, aggregates by date via buildAgendaByDate, and renders by day and time range.
3. Finance: income entries are read from the finance_order_entries view (paid > 0 and within period) and expenses from expenses, with summary calculated in buildFinanceSummary.
4. Reminders: the backend builds a date window with parseDaysParam + getRangeForDays, queries agenda_entries, and returns filtered summary and items.
5. PDF reports: route handlers generate PDFs via @react-pdf/renderer and return application/pdf in Node runtime.
6. Automated message: GET /api/mensagens/pedido/:id builds a message with items, dates, and values for client delivery.
7. Reference images: upload via POST /api/pedidos/:id/referencias, with type/size validation, stored in Storage and recorded in order_reference_images.

Authentication and Authorization

• Login via POST /api/auth/login using Supabase Auth (password), returning HTTP-only cookies: sb-access-token, sb-refresh-token, sb-expires-at.
• Middleware protects non-public routes and redirects to /login when the token is missing or expired.
• fetchApi (server) injects Authorization: Bearer <token> from the cookie.
• fetchApiClient (browser) uses cookies and attempts POST /api/auth/refresh on 401.
• Roles in profiles: sys-admin, admin, user.
• RLS applies permissions by role on tables and views; finance endpoints require the admin role.
• In development, createSupabaseRouteClient can use SUPABASE_SERVICE_ROLE_KEY when there is no token, facilitating local testing.

Database

Rules and automations

• set_order_status: defines status based on paid and total.
• set_paid_date: fills paid_date when payment exists.
• next_*_control_code: generates yearly sequences for orders and products.
• agenda_entries: schedule view aggregating customers, products, and dates.
• finance_order_entries: view for financial income entries.

Storage

• Public bucket order-references for order-linked images.

API Response format

{ "data": { ... } }

Error

{ "error": { "message": "...", "details": ... } }

Auth

Orders and images

Customers and products

Schedule and reminders

Finance

PDF reports

Messages

PDF Reports

• Server-side rendering via @react-pdf/renderer.
• src/lib/reports/pdf.tsx centralizes templates for orders, schedule, and finance.
• Runtime configured as nodejs for report routes.
• Custom fonts in public/fonts.

Reference Images

• Allowed types: image/jpeg, image/png, image/webp, image/gif, image/avif.
• Max size: 5MB per file.
• Uploads use the admin client for Storage writes and metadata insertion.

Configuration Required environment variables

Optional variables (cookies)

Supabase local

• npm run supabase:start starts services; npm run supabase:seed applies seeds and reset.

Scripts

• npm run dev: development environment.
• npm run build: production build.
• npm run start: production Next server.
• npm run lint: lint.
• npm run test: vitest.
• npm run supabase:start: start local Supabase.
• npm run supabase:stop: stop local Supabase.
• npm run supabase:reset: reset local database.
• npm run supabase:seed: reset with seed.

Structure

src/
  app/               App Router routes and APIs
  components/        UI and domain modules
  lib/               business rules, repositories, and utils
supabase/
  deployed/          applied SQL migrations
  seed.sql           local seed
public/
  fonts/             fonts used in PDFs
tests/               unit tests (vitest)

Observability

• logError writes console.error with scope, message, and context (ignoring tests); APIs return standardized messages with fail().

Security

• HTTP-only session cookies with SameSite and Secure configuration; middleware blocks access without a valid session.
• RLS enabled on core tables; image upload validates type and size before persisting.

Deploy

1. Configure Supabase environment variables.
2. npm run build to generate the build.
3. npm run start to serve.
4. Ensure Node runtime for report routes (/api/relatorios/*).

Common Issues

• 401 accessing routes: session expired or missing cookies.
• 403 on finance: user without admin or sys-admin role.
• Empty PDFs: missing fonts in public/fonts or non-Node runtime.
• Upload errors: unsupported type or file > 5MB.