GallaDev Workspace

CRM for reviewing, qualifying, and managing leads for asesorías y gestorías. Supabase (PostgreSQL) is the sole source of truth. The Notion runtime has been removed.

Formerly Leads_CRM. Production: https://workspace.galladev.com.

Live demo — open the login page and choose Entrar como visitante (fictional data only). The UI is available in Spanish (default) and English via the ES/EN control.

Quickstart

npm install
cp .env.example .env.local
# Set Supabase vars in .env.local (see below)
npm run dev

Open http://localhost:3000/leads. The app syncs on load; you can also press Sincronizar.

Demo

A passwordless visitor session shows the real UI with fictional leads only. It is off unless DEMO_MODE_ENABLED is true or 1, and it also needs DEMO_SESSION_SECRET (16+ characters). Then the login page shows Entrar como visitante. The signed cookie lasts 4 hours, never reads or writes Supabase, and blocks settings, automations, team, ingest, email, and live AI. Set DEMO_MODE_ENABLED=false (or unset it) to turn the button off without a code change. The live demo is active at https://workspace.galladev.com/login. The same page will also show a public ¿Qué es? / What is it? section (specified, not built yet): text and screenshots, no session, alongside the visitor button. Details: operations guide and what-it-is.md.

Minimal config:

LEADS_DB_PROVIDER=supabase
SUPABASE_URL=https://<project>.supabase.co
SUPABASE_PUBLISHABLE_KEY=<publishable-key>
SUPABASE_SECRET_KEY=<secret-key-never-commit>
# Browser client. Next inlines NEXT_PUBLIC_* at build time; use the same URL and publishable key.
NEXT_PUBLIC_SUPABASE_URL=https://<project>.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=<publishable-key>
AUTH_DISABLED=true

Sign-in is Supabase Auth (email + password). There is no self-signup: keep public sign-up disabled, and an Admin creates accounts in the Supabase Dashboard (Authentication → Users). The on_auth_user_created trigger inserts a profiles row with no role; the account sees a pending-access screen until an Admin assigns Admin, Seller, or Viewer in Settings → Equipo. AUTH_DISABLED=true skips login only when NODE_ENV is not production.

Documentation

• Documentation overview (español)
• Business and product context (español)
• Roadmap and delivery (español)
• Company email — Correo module in GDW, decision 29 Sep 2026 (español)
• Architecture and integrations (español)
• Operations and user guide (español)
• UX and AI contracts (español)
• History and maintenance (español)

Stack

Next.js App Router, React, TypeScript, Tailwind CSS, Lucide, TanStack Query, Zustand, Supabase (@supabase/ssr, @supabase/supabase-js), Resend, Groq.

Verification

npm run lint
npx tsc --noEmit
npm run test:unit
npm run test:component
npm run build
npm run test:e2e

See Testing and the roadmap and delivery context before assuming roadmap sections are complete.

Web ingest emails

After a successful POST /api/ingest/lead (created or deduped), the app sends with Resend:

• Receipt to the visitor (email from the payload)
• Internal notice to EMAIL_NOTIFY_TO

Fail-open: if the key is missing or Resend fails, the lead is still saved and the API answers 201/200.

Variables (names; values in Vercel, never in git): RESEND_API_KEY (full access — required to read inbound bodies via the Receiving API; sending_access alone yields empty bodies), EMAIL_FROM_CLIENTS, EMAIL_NOTIFY_TO, optional EMAIL_REPLY_TO. Company mailbox setup and the one-shot body backfill (POST /api/email/backfill-bodies, Admin only): company-email.md.

Not used for marketing or nurturing lists.

Contributing

See CONTRIBUTING.md (español) for branches, commits, tests, and the PR process. By participating you agree to our CODE_OF_CONDUCT.md (español); report vulnerabilities privately per SECURITY.md (español).