Building an admin CMS where every staff action is auditable

A React and Supabase site for a record label, with an eight-panel admin CMS where every create, update, and delete writes to an audit trail and images route through a caching Worker.

Southside Records is a record label inside a Los Santos roleplay community. The public site shows the roster, releases, and events; the back office lets staff manage all of it. It's built with React, Vite, and shadcn/ui on top of Supabase.

Every mutation is logged

The decision I'd point to: the data layer wraps each Supabase call in a small API object, and every create, update, and delete writes an audit-log row on the way through. Staff actions leave a trail without anyone having to remember to log them.

1create: async (artist, userEmail?) => {2  const { data, error } = await supabase3    .from('artists').insert(artist).select().single();4  if (error) throw error;5  try {6    await adminLogsApi.create({7      action: 'create', entity_type: 'artist', entity_id: data.id,8      details: `Created artist "${data.name}"`, user_email: userEmail,9    });10  } catch (logError) { console.error("Error logging action:", logError); }11  return data as Artist;12}

The audit write is wrapped in its own try/catch so a logging failure can't break the actual operation — the label still gets its artist even if the log hiccups.

Images go through a Worker

Supabase Storage works, but serving images straight from it isn't the fastest path. A small Cloudflare Worker sits in front and rewrites storage URLs to a cached edge path:

1export function getImageWorkerUrl(url) {2  if (!url) return null;3  const match = url.match(storagePattern); // matches the Supabase storage bucket4  if (match && match[1]) {5    return `https://southside-records.mjd072.workers.dev${match[1]}`;6  }7  return url;8}

Every image on the site passes through this, so uploads land in Supabase but visitors get them from the edge.

Scope

Ten tables, eight admin panels (artists, releases, events, photos, team, messages, logs, map), 43 service methods, and streaming links out to Spotify, Apple Music, YouTube Music, and SoundCloud on each release.

What I'd improve

• There are no automated tests yet; the audit-log wrapper and the URL rewriter are the first things I'd cover.
• Security leans entirely on Supabase row-level-security policies, which live in the database, not the repo — I'd check those into version control.
• The per-entity API objects repeat a lot of shape; a small generic factory would cut most of it.

If you're weighing a CMS against a custom admin panel for your own business, that's the kind of build I take on — see my services or browse other projects.