# Set up your library database and administrator

## 1. Create a project

Open https://supabase.com/dashboard, create a project named Global Myanmar Library,
and choose a region close to your initial readers. Save your database password
in a password manager. Do not share the password or a secret/service-role API key.

## 2. Create the schema

In your NEW project's **SQL Editor**, create a new query. Open
`supabase/001_library.sql` from this source download, copy its entire contents,
and run it. Run it once in a new project, not against an existing unrelated schema.
The migration is transactional. If anything fails, it rolls back; resolve the
reported error before retrying. It creates the tables, secure catalog view,
save transaction, revision checks, audit triggers, and book-covers storage bucket.
Do not turn off row-level security to work around an error.

Expected result: **Success. No rows returned.** In Table Editor you should see
profiles, categories, authors, books, book_authors, book_editions, and audit_logs.
The book catalog starts empty. Fictional prototype books are not automatically
imported into the live database.

## 3. Create your administrator account

Go to **Authentication → Users → Add user → Create new user**. Enter the email
and password you want to use for library administration. Enable **Auto Confirm
User** if offered, because this is an account you are creating directly.
The database trigger creates a profile with the reader role by default.

Open `supabase/002_make_admin.example.sql`. Replace BOTH occurrences of
`YOUR_ADMIN_EMAIL` with the account's email. Run it in SQL Editor. The final
query should show your email and the role `admin`.

This is the only bootstrap role assignment. Do not put it in your website code.
Changing raw signup metadata will not grant administrator access.

## 4. Configure the site

The project URL and public publishable key are in **Connect** or
**Settings → API Keys** / **Data API**, depending on the dashboard version.
Edit `dist/config.js`:

```javascript
window.GML_CONFIG = {
  supabaseUrl: "https://YOUR_PROJECT.supabase.co",
  supabasePublishableKey: "sb_publishable_YOUR_PUBLIC_KEY",
};
```

These are public browser configuration values. An older public anon key also
works. Never use a database password, secret key, or service-role key here.
This copy already contains the public values supplied by the project owner.
For a separate local demo, leave BOTH strings empty.

No email redirect is required for the phase 1 email/password form. The website
has no public signup, password reset, or invitation UI yet; manage accounts and
password resets in the Supabase dashboard for now. If signup is unnecessary,
disable public signup under Authentication's email/signup settings.

## 5. Sign in and add your first book

Open `/admin.html` on your deployed website. Enter your administrator email and
password. Choose **Add book**, fill in the details, and save as **Draft**.
Use **Preview** to review it. Edit the status to **Published**, or use the row's
**Publish** action. Open **Reader library** to see the published title.
Archived books remain in administration but disappear from the reader library.

The form currently manages one author and one primary edition per book.
Prices are USD metadata only; no transaction is processed. Digital files and
licensed audio are not delivered by this release.

## 6. Check permissions on the actual project

1. Sign in as admin and create one draft and one published book.
2. Open the reader catalog: only the published book should appear.
3. Create a second test account without granting admin. It must not enter the
   admin workspace. Remove the test account when finished.
4. Confirm an edit increments the book revision and adds audit rows.
5. Open the same book in two admin tabs. Save in the first tab, then try saving
   the stale form in the second; it should request a reload.
6. Upload a JPEG/PNG/WebP cover up to 2 MB and verify the reader can view it.

The repository tests exercise the SQL against embedded PostgreSQL with mock
Supabase auth/storage schemas. These hosted-service checks still need your real
account and project. Visual testing in a real browser is also recommended.

## Backups and recovery

**Export JSON** downloads catalog metadata; it is not a full database/storage
backup and is not an automatic restore tool. Use Supabase database backups or
`pg_dump` for database recovery and separately back up Storage objects.
The local demo embeds uploaded covers in its JSON export; live exports contain
storage paths, so save live cover files separately.

Cover images are public, including covers uploaded while a book is a draft.
Only admins may upload; file types and the 2 MB limit are enforced by the bucket.
Never upload an e-book, audiobook, or confidential image to book-covers.
Replacing a cover does not automatically delete the old file. Periodically
remove unreferenced files through the dashboard after checking database records.