Spotflow Case Management

Two-sided case management for Spotflow:

• Merchants submit cases at /submit (no login)
• Admins sign in with email OTP at /admin/login, review cases, update status (emails merchant)

Stack

Next.js (App Router) · TypeScript · Prisma · PostgreSQL (RDS) · S3 · Resend · Slack webhook

Setup

1. Copy env and fill values:

cp .env.example .env

Required:

Variable	Purpose
DATABASE_URL	RDS Postgres connection string
JWT_SECRET	Session signing (≥16 chars)
RESEND_API_KEY / RESEND_FROM_EMAIL	Transactional email
SLACK_WEBHOOK_URL	New-case Slack notification
AWS_REGION / AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / S3_BUCKET	Image uploads
NEXT_PUBLIC_APP_URL	Absolute app URL (Slack deep links)
SEED_ADMIN_EMAIL	Whitelisted admin seeded on db:seed

2. Migrate and seed:

npx prisma migrate dev --name init
npx prisma db seed

3. Run:

npm run dev

• Merchant form: http://localhost:3000/submit
• Admin: http://localhost:3000/admin/login

Notes

• OTP codes are hashed (bcrypt); never logged.
• Slack/email failures on case create are logged and do not fail the request.
• In-memory rate limiting is wired for OTP + case create; swap to Redis for multi-instance production.