Qart

Web UI for Google Cloud: BigQuery, Cloud Storage, Composer, and monitoring. Uses Supabase (auth, database, Edge Functions).

Authenticates via a service account — lets you give your team access to data and pipelines without managing individual GCP identities or IAM per user/group.

demo_qart.mp4

What you need

• Node.js 18+ and npm
• Docker + Supabase CLI
• A GCP project with a service account JSON (see GCP setup)

---

Run locally (3 terminals)

git clone https://github.com/alaBay94/cloud-ai-architect.git
cd cloud-ai-architect
npm install

Terminal 1 — Supabase (run once, leave running)

supabase start
supabase db reset

Terminal 2 — Edge functions (keep running)

supabase functions serve

Terminal 3 — App

# The pretty `supabase status` table does not show the JWT anon key — run this instead:
supabase status -o env

# Create .env.local with the values above (does not touch .env / prod settings):
cat > .env.local << 'EOF'
VITE_SUPABASE_URL=http://127.0.0.1:54321
VITE_SUPABASE_ANON_KEY=<paste ANON_KEY value from above>
VITE_GCP_USE_SERVER_SECRET=false
EOF

npm run dev   # → http://127.0.0.1:8080

First time in the browser

1. Sign up (local Supabase skips email confirmation).
2. GCP Settings → paste service account JSON → Save.
3. Try BigQuery Explorer or Storage Explorer.

Optional AI features:

echo 'OPENAI_API_KEY=sk-...' > supabase/functions/.env
# then use this instead of plain supabase functions serve:
supabase functions serve --env-file supabase/functions/.env

Switch back to hosted: mv .env.local .env.local.bak → restart npm run dev. It's just whether .env.local exists or not — Vite loads it over .env automatically.

Day-to-day (after first setup): supabase start → supabase functions serve → npm run dev. Skip db reset — it wipes all local data and reruns migrations from scratch.

Reset local data intentionally: supabase stop --no-backup → supabase start → supabase db reset.

---

GCP setup

Do this in Google Cloud before using the app. The GCP Settings screen in Qart repeats this checklist.

1. Enable APIs (API Library) on your project:

• Cloud Storage API
• BigQuery API
• Cloud Composer API
• Cloud Monitoring API
• Compute Engine API

2. Service account — create a key (JSON) and grant roles (minimum for all features):

• BigQuery Job User + BigQuery Data Viewer
• Storage Viewer + Storage Object Admin
• Composer User
• Monitoring Viewer (recommended)

3. In Qart — paste the JSON under GCP Settings and save.

Production / no paste in the browser

Set in .env: VITE_GCP_USE_SERVER_SECRET=true and VITE_GCP_PROJECT_ID. Put the JSON only in Supabase as GCP_SERVICE_ACCOUNT_JSON (Edge secret). Details in .env.example.

---

Security note — verify_jwt = false

All edge functions ship with verify_jwt = false in their config.toml. This means anyone with the function URL can call them without a Supabase session. In paste mode the GCP service account key travels in the request body — no server secret is exposed — but unauthenticated callers could still invoke the functions.

If you want to tighten this: set verify_jwt = true in each supabase/functions/<name>/config.toml and redeploy. For a self-hosted setup where users bring their own Supabase project, leaving it as-is is acceptable.

---

Production (hosted Supabase)

1. Create a project at supabase.com → copy URL + anon key into .env (or host build env).
2. supabase link --project-ref YOUR_REF → supabase db push
3. Deploy functions: supabase functions deploy gcs-working (and fetch-gcp-resources, composer-operations, monitoring-operations)
4. Secrets: OPENAI_API_KEY, and optionally GCP_SERVICE_ACCOUNT_JSON if using server-managed GCP.
5. Authentication → URL configuration: set Site URL to your deployed app URL.
6. npm run build → host the dist/ folder (e.g. Vercel: npm run build, output dist/).

---

Environment variables

Variable	Purpose
VITE_SUPABASE_URL	Supabase API URL
VITE_SUPABASE_ANON_KEY	Supabase anon (public) key — use ANON_KEY from supabase status -o env locally
VITE_GCP_USE_SERVER_SECRET	true = GCP key only on server, not pasted in UI
VITE_GCP_PROJECT_ID	GCP project id (with server-managed mode)
OPENAI_API_KEY	Edge secret — AI in gcs-working
GCP_SERVICE_ACCOUNT_JSON	Edge secret — server-managed GCP

See .env.example. Never commit .env, .env.local, or service account files.

---

Scripts

npm run dev · npm run build · npm run lint · npm run test:e2e (local only)

---

License

AGPL-3.0 — see LICENSE.

For contact : qart.infra@outlook.com