A game can now carry a list of items the host puts on the scoreboard one at
a time: a question (shown above the standings, with an optional picture and
an answer to reveal), a sound (played through the scoreboard's speakers) or
a video such as a karaoke track (takes over the screen).
- Media is a YouTube link, an https link to a file, or an upload to the
private game-media bucket. The scoreboard API signs a URL only for the
item that is on screen.
- What is on screen is state on the event, like the timer, so the ping
still carries no data. An unrevealed answer and a sound's or video's name
never reach the scoreboard payload.
- Control room: click an item to show it, or "Random" to have one picked
(prefers items not played yet). Show/hide answer, pause, take off screen;
shortcuts Q / A / X.
- Duplicating a game or event copies its items and files; deleting removes
the files.
Needs supabase/migrations/0006_screen_items.sql applied before deploying.
database.types.ts was edited by hand to match; re-run gen:types after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner shares an event by email; a co-host gets full access inside it
but can't delete it or change who it's shared with. Shares are keyed by
email so an admin can be added before their first login, and RLS (not the
UI) is what enforces the owner-only parts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each team gets a buzzer link (/b/[token]); a game opts in with a
"Teams buzz in" checkbox. The database's clock orders the buzzes, so
the result doesn't depend on phone clocks. The control room lists the
order and clears it per question (B); the scoreboard shows who buzzed
first with a ding.
Buzzes follow the existing rules: token-gated route handlers with the
service-role client, RLS on the new table, and data-free realtime pings
on a new buzzer:{eventId} channel.
Needs supabase/migrations/0003_buzzer.sql applied before deploying.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Types are generated from the live database's API schema by
scripts/gen-types.mjs (npm run gen:types), in the same shape as
supabase gen types, so no Supabase CLI login is needed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tokens.ts validates link tokens (32 hex chars) before any DB query.
check:rls proves the anon key cannot read or insert on any table, and
fails loudly if the migration has not been applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
joshuaandClaude Opus 5.5