School Event Handler

A role-based school event management platform built with Next.js + Supabase.

Teachers create events, delegate other teachers, manage student applicants, and control registration windows.
Admins approve accounts and manage user records.
Students discover events and apply when eligible.

---

Highlights

• Role-based app for student, teacher, and admin
• Event creation with:
  • class range filters
  • spots needed
  • event date
  • selection/registration cutoff date
• Applicant workflow:
  • apply
  • select
  • unselect
  • reject
• Delegation:
  • event owner can delegate approved teacher accounts
  • delegated teachers can manage applicants
• Registration controls:
  • teacher can stop and reopen registrations
• Security-first architecture:
  • Supabase Auth sessions (JWT in HTTP-only cookies)
  • server actions for protected mutations
  • validation + authorization checks
  • RLS policies for delegation table

---

Tech Stack

• Frontend: Next.js App Router, React, Tailwind CSS
• Backend: Supabase (Postgres + Auth + RLS)
• Auth: Supabase Auth via @supabase/ssr
• Types: TypeScript

---

Project Structure

SchoolEventHandler/
├─ README.md
└─ school-event-portal/
   ├─ src/
   │  ├─ app/                # routes, server actions, API search routes
   │  ├─ components/         # UI + feature components
   │  ├─ lib/                # auth, supabase, events, validation, search
   │  ├─ hooks/              # reusable hooks
   │  └─ types/              # domain types
   ├─ supabase/migrations/   # SQL migration files
   ├─ SECURITY.md            # security notes
   └─ .env.example           # env template

---

Core Roles

Student

• Browse eligible open events
• View detailed event page
• Apply while registration is open
• Track application status

Teacher

• Create and manage events
• Search applicants and students
• Select/unselect/reject applicants
• Delegate approved teacher accounts to co-manage an event
• Stop/reopen registration

Admin

• Approve/reject student accounts
• Edit user account fields (name/email/password/role/etc.)
• Permanently delete accounts

---

Registration Logic

Students can apply only when all conditions are true:

1. Event status is open
2. Current date is on/before selection_date (if set)
3. Student class falls within event class range

Teachers can manually stop registration by changing event status to closed.

---

Getting Started

1) Prerequisites

• Node.js 20+
• npm
• A Supabase project

2) Install dependencies

cd school-event-portal
npm install

3) Configure environment

Create school-event-portal/.env.local:

NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key

# Required for admin user management and enhanced search fallback
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

Keep SUPABASE_SERVICE_ROLE_KEY server-only. Never expose it to client code.

4) Run SQL migrations in Supabase

Open Supabase SQL Editor and run:

1. supabase/migrations/001_event_collaborators_selection_date.sql
2. supabase/migrations/002_profiles_staff_search_rls.sql
3. supabase/migrations/003_delegate_teachers_only.sql

5) Start development server

npm run dev

App runs at: http://localhost:3000

---

Build & Quality

npm run build
npm run lint

---

Security Notes

See school-event-portal/SECURITY.md for full details.

Quick summary:

• Session/auth checks in middleware + server guards
• Role and ownership authorization in server actions
• Input validation on IDs, emails, dates, and text
• Database-backed permissions for collaborator operations
• Security headers set in middleware

---

Typical Workflows

Teacher Event Setup

1. Create event
2. Add preparation criteria in description
3. Set selection date and class range
4. Optionally delegate other teachers
5. Monitor applicants and finalize selections

Admin Operations

1. Approve pending students
2. Manage user roles and profile data
3. Reset credentials when needed
4. Delete accounts when required

---

Troubleshooting

No teachers appear in delegation search

• Ensure migration 002 is applied
• Ensure target users have role teacher and status approved
• Check .env.local for correct Supabase values

Delegation insert fails

• Ensure migration 001 exists in DB
• Ensure migration 003 is applied (teacher-only delegation policy)

Admin edit/delete fails

• Verify SUPABASE_SERVICE_ROLE_KEY is set correctly

---

Roadmap Ideas

• Audit log for registration/delegation changes
• Email notifications for status updates
• Rich analytics for event performance
• Bulk student imports

---

License

Private school project. Add an explicit license if you plan to distribute publicly.