Kaffeelisten is a live digital coffee and snack log for shared campus spaces. It replaces the paper sheet on the wall with a fast PWA flow for members and a PIN-protected admin panel for monthly reporting.
Built by HuggyWuggies for the B4Y3RW4LD Hackathon at ITC1 Deggendorf.
Live app: kaffeelisten.vercel.app
Pitch deck: arudaev.github.io/kaffeelisten
Members use the wall-mounted iPad or any browser:
- Pick a company.
- Pick their name.
- Pick coffee, drinks, snacks, or food.
- Confirm the entry.
No account. No password. No app store. The target interaction is under 15 seconds from cup to saved transaction.
Admins use /admin:
- View month-to-date transactions.
- Filter and inspect entries.
- Manage companies, members, and items.
- Export CSV.
- Send the monthly report manually.
- Let Vercel Cron send the report automatically at month end.
The report flow generates a PDF and Excel workbook, emails them via Resend, archives the live transactions, and resets the current-month table.
![]() |
![]() |
![]() |
![]() |
| Company | Member | Items | Confirmation |
![]() |
![]() |
| PIN login | Dashboard |
![]() |
|
| Transaction log | |
| Layer | Tech |
|---|---|
| Frontend | React 18, TypeScript, Vite, Tailwind CSS |
| PWA | vite-plugin-pwa, Workbox |
| Database | Supabase, PostgreSQL, RLS |
| Hosting | Vercel, Serverless Functions, Cron |
| Reports | Puppeteer, ExcelJS |
| Resend |
apps/web/
src/ React app: member flow, admin panel, privacy page
api/ Vercel functions: PIN check, report send, cron
public/ App icons, illustrations, PWA assets
docs/
index.html Pitch deck
design-*.md Visual system and design notes
prd.md Product requirements
roadmap.md Future phases
supabase/
migrations/ Schema, grants, RLS policies
seeds/ ITC1 seed data
scripts/, tools/ Utility scripts
Requires Node.js 24 or newer.
npm install
cp apps/web/.env.example apps/web/.env.local
# fill apps/web/.env.local using the table below
npm run devThe Vite app runs at http://localhost:5173.
For local API testing, run Vercel from the web app directory:
cd apps/web
npx vercel devUseful root commands:
npm run build
npm run typecheck
npm run lintClient-side variables must use the VITE_ prefix. Server-only variables must
not use that prefix.
| Variable | Used by | Notes |
|---|---|---|
VITE_SUPABASE_URL |
client + server | Supabase project URL |
VITE_SUPABASE_ANON_KEY |
client | Public anon key for RLS-protected reads/inserts |
SUPABASE_SERVICE_ROLE_KEY |
server | Required for reports, archive, and reset |
RESEND_API_KEY |
server | Sends monthly report email |
ADMIN_EMAIL |
server | Report recipient |
ADMIN_PIN |
server | PIN for /admin |
CRON_SECRET |
server | Bearer token for /api/cron/monthly-report |
CHROMIUM_PATH |
server, optional | Local/custom Chromium path for PDF rendering |
Create a Supabase project, then apply the SQL files in supabase/migrations/
in numeric order.
Current migrations:
001_initial_schema.sql
002_grant_table_permissions.sql
003_anon_read_transactions.sql
004_anon_insert_members.sql
005_admin_crud_policies.sql
006_service_role_grants.sql
007_member_work_email.sql
009_fix_member_rls_update.sql
Optional seed data lives in supabase/seeds/002_demo_data.sql.
companies
members
items
transactions
transactions_archive
The browser uses the Supabase anon key with RLS. Service-role access is limited to Vercel serverless functions for admin-only reporting, archiving, and monthly reset behavior.
Manual report:
POST /api/send-report
Header: x-admin-pin: <ADMIN_PIN>
Body: { "month": "YYYY-MM" } # optional
Automatic report:
GET /api/cron/monthly-report
Header: Authorization: Bearer <CRON_SECRET>
Vercel schedules the cron on days 28-31 at 22:00 UTC. The function only runs the report when that day is the actual last day of the month.
The production app is designed for Vercel with apps/web as the project root.
- Create/configure Supabase.
- Apply migrations.
- Add the environment variables in Vercel.
- Deploy
apps/web.
The app is a PWA, so the live URL can be installed on an iPad and used as the wall-mounted member terminal.
Copyright 2026 HuggyWuggies. Licensed under the Apache License 2.0.
This license applies to the source code in this repository. Third-party names, logos, and event or campus branding, including ITC1 Deggendorf and B4Y3RW4LD Hackathon references, remain the property of their respective owners.






