INGEST_API_FRONTEND.md

Ingest Admin — Frontend (Next.js) Quickstart

Purpose

• Example Next.js admin panel with Supabase auth and server-side proxy routes that forward admin actions to the Python ingest API.

Key files (in this repo)

• admin-nextjs-example/pages/admin.js — Admin UI (magic-link sign-in via Supabase, triggers ingest actions).
• admin-nextjs-example/pages/api/proxy/ingest-url.js — Server proxy for URL ingest (verifies Supabase token, forwards to Python API with server-side key).
• admin-nextjs-example/pages/api/proxy/ingest-pdf.js — Server proxy for PDF uploads (parses multipart with formidable, forwards to Python API with server-side key).

Environment variables (Next.js server)

• NEXT_PUBLIC_SUPABASE_URL — Supabase project URL (client)
• NEXT_PUBLIC_SUPABASE_ANON_KEY — Supabase anon key (client)
• SUPABASE_SERVICE_ROLE_KEY — Supabase service role key (server-only; used to verify tokens)
• INGEST_API_URL — URL of Python ingest service (server-only)
• INGEST_API_KEY — Admin API key for Python ingest service (server-only)

Optional (client direct upload)

• NEXT_PUBLIC_INGEST_API_URL and NEXT_PUBLIC_INGEST_API_KEY (only for testing; DO NOT expose in production)

Install

# in your Next.js project
npm install @supabase/supabase-js formidable form-data

Run

# set env vars in .env.local or host environment
npm run dev

How it works

• Admin UI uses Supabase magic-link auth. After sign-in the client receives an access token.
• Client calls server proxy endpoints with Authorization: Bearer <access_token>.
• Server proxy verifies token using SUPABASE_SERVICE_ROLE_KEY and then forwards request to Python ingest API using INGEST_API_KEY kept server-side.

Security notes

• Never expose SUPABASE_SERVICE_ROLE_KEY or INGEST_API_KEY to the browser.
• Only allow trusted admin users in Supabase (use roles or check email against allowlist in proxy route).

Next steps / customization

• Add an allowlist in ingest-url.js and ingest-pdf.js to restrict which Supabase users can trigger ingests.
• Add a jobs dashboard that polls GET /jobs/{job_id} and displays status/history.
• Integrate Supabase Row Level Security (RLS) if storing job records in Supabase DB.

Notes

• The example ingest-pdf proxy uses formidable to parse uploads and form-data to forward files; ensure Node environment has permissions to write temp files.
• For serverless deployments, adjust temp file handling per platform.