# BrickDocket deployment setup

BrickDocket can be previewed as a static site immediately. Two services are needed before it should be used as a production app.

## 1. Accounts and password recovery

The sign-in page is ready for Supabase Auth.

1. Create a Supabase project.
2. Open `assets/auth-config.js`.
3. Add the project URL and publishable key. Do not use the `service_role` key.
4. In Supabase Authentication, enable Email, Google and Discord as needed.
5. Add the deployed `signin.html` URL to the redirect allow list.
6. Configure the Google and Discord client credentials in the Supabase dashboard.

Email sign-up, sign-in, confirmation and password-recovery links will then use Supabase. Google and Discord buttons remain disabled until this configuration is present.

## 2. Shared workspace and client links

Workspace data and uploaded files still use browser storage in this version. That makes local preview easy, but another device cannot open a client link or see the workspace.

Before public launch, move the `Store.read` and `Store.write` implementation in `assets/core.js` to an authenticated database and move file storage in `assets/files.js` to private object storage. Apply row-level access rules so creators can only access their own workspace. Client-link reads should resolve only an unrevoked, unexpired token and return only client-visible fields.

Do not advertise client links as cross-device sharing until that storage migration is complete.