What this stack is for
Somewhere in your company is a spreadsheet that has quietly become load-bearing. Six people edit it, one person understands it, and the day somebody sorts a column without extending the selection, records scramble and nobody notices for a week. This stack is the upgrade path: the same data in Postgres, a real interface over it, and access rules enforced by the database instead of by hoping. You are not building a product here. You are retiring a liability.
Components
- Next.js: the app framework, server + client rendering
- Supabase: Postgres database
- Supabase Auth: login, sessions, and role-based access
- Vercel: hosting, deploys from git, preview URLs per branch
How the pieces fit
- Next.js renders the CRUD screens; Supabase holds the underlying rows
- Supabase Auth gates every route behind login; roles determine what each user can see and edit
- Row-level security in Supabase enforces access rules at the database layer, not just in the UI
- Vercel deploys on every git push, same as any other stack here
- The tool replaces a spreadsheet: one source of truth, with a real access-controlled UI over it
Setup outline
- Create the Next.js app and the Supabase project (full walkthrough coming)
- Design the Postgres schema for the records the spreadsheet currently holds (full walkthrough coming)
- Wire Supabase Auth and define roles/permissions (full walkthrough coming)
- Build the CRUD screens against the schema (full walkthrough coming)
- Turn on row-level security and test it as each role (full walkthrough coming)
- Import the repo into Vercel and deploy (full walkthrough coming)
What to hand your agent
The agent needs the spreadsheet's messy reality, not just the stack:
- The full stack description above, plus the PRD and the current spreadsheet's column list
- The roles that need to exist and what each one can see/edit
- The instruction to use Supabase row-level security, not just UI-level checks, for every permission rule
Adaptation notes
- Airtable or Retool can replace this entire stack if no one on the team wants to maintain code
- A single-role tool with no permissions system can skip Supabase Auth roles and just gate on login
- Postgres views can replace some UI-layer filtering for read-heavy roles