Live radar of newly founded, launched, or funded Egyptian startups. Static site backed by Supabase (auth, Postgres, RLS, realtime).
# Egypt Startup Radar
A static page listing recently founded, launched, or funded Egyptian startups,
backed by Supabase for storage, auth, and live sync.
No framework, no build step, no bundler. Plain ES modules and the Supabase
client from a CDN — the folder can be dropped onto any static host as-is.
## How it works
| Concern | Where |
|---|---|
| Data | `public.startups` in Postgres |
| Read access | Public. Row Level Security grants `SELECT` to `anon`, so visitors never sign in |
| Write access | Admins only, enforced by RLS — not by the UI |
| Auth | Supabase magic link (email OTP) |
| Admin role | Assigned automatically by a database trigger, never by the client |
| Live sync | Supabase Realtime on `public.startups` |
### Files
```
index.html markup + the original stylesheet, unchanged
css/admin.css styles for admin-only chrome (invisible to normal visitors)
js/config.js project URL, publishable key, pinned client version
js/supabase.js the one Supabase client
js/auth.js sign-in/out, session, admin lookup
js/startups.js queries, writes, realtime subscription
js/render.js pure view layer
js/admin.js sign-in panel + add/edit dialog
js/main.js wiring
```
## Running it locally
ES modules are blocked under `file://` by browser CORS rules, so the page has
to be **served**, not opened from disk:
```bash
python -m http.server 3000
```
Then open .
## Admin access
The public page has no sign-in link — visitors see exactly what they saw before
any of this existed. To sign in, add the fragment:
```
localhost
```
Enter the admin address, follow the emailed link, and per-card **Edit** /
**Delete** buttons plus **+ Add startup** appear. Signing in with any other
address grants nothing: the page looks identical to a logged-out visitor's, and
the database rejects writes regardless.
To make sign-in discoverable instead of hidden, see the note at the top of
`js/admin.js`.
### One …