Songs that found me
in the dark

Site Settings

Admin Access Code

This is the code someone enters (after clicking the logo 5 times) before they even see the admin login form. It's a light front-door lock, not a strong secret — like the rest of this site's auth, it's checked in the browser, so treat it as a deterrent for casual visitors rather than a real security boundary. The real gate is your admin email + password below. The code is stored as a hash, not plain text, and the field below is always blank — it never shows the current code back to you (or anyone else).

Admin Login Credentials

This is the real admin email + password used on the login screen. Changing it here updates it for every browser (once Supabase is connected — otherwise it only applies to this browser). The password is stored as a hash, never in plain text, and these fields stay blank on load.

👑 Owner Account

Link one chat/user account (by @username) as the site Owner. That account gets a gold profile frame, a crown badge, an OWNER tag everywhere its name appears, and the power to ban/unban any user directly from their public profile card — no need to open this dashboard. Only one owner account at a time.

Manage Songs

Add New Song

Registered Users

Profile Pictures

Upload the profile pictures users are allowed to choose from, tagged by gender. Users can only pick from images uploaded here — no outside images.

Manage Genres

Add, edit, or remove genre tags used across the archive.

Manage Moods

Moods power the filter bar and the colored tags on every song. Add, rename, recolor, or remove them.

Quotes of the Day

One quote is shown on the homepage each day (rotates automatically). Add many at once — one quote per line. Optional attribution after a pipe: quote text | Author

Pending Submissions

User Reports

Reports filed by users on other users or chat messages. Only visible here — the reporter and reported user never see this list.

Chat System

Full control over the chat system — toggle it on or off, manage rooms, and moderate messages.

All Rooms

Email (OTP)

Paste your EmailJS details here and signup verification codes will be emailed for real, instead of just appearing on-screen. All three values below are meant to be public (same spirit as the Supabase key on the Database tab) — EmailJS has no separate "secret" key for this. If you save while connected to Supabase, these sync to every visitor's browser through site_settings; otherwise they're saved to this browser only.

EmailJS setup (once, ~5 minutes, free tier = 200 emails/month)

Safety & Bots

Current status

Part 1 — Turnstile (stops bot signups)

Free, unlimited, no account limits. Takes about 10 minutes. Do the steps in order — leave the switch in step 5 off until steps 1–4 are done, or signups will start failing for everyone.

Code for step 4 — verify-turnstile

// supabase/functions/verify-turnstile/index.ts
// Deno Edge Function — verifies a Turnstile token server-side, where the
// secret key can actually stay secret.
import { serve } from "https://deno.land/std@0.203.0/http/server.ts";

serve(async (req) => {
  const { token, remoteip } = await req.json();
  const secret = Deno.env.get("TURNSTILE_SECRET_KEY");

  const body = new URLSearchParams();
  body.set("secret", secret ?? "");
  body.set("response", token ?? "");
  if (remoteip) body.set("remoteip", remoteip);

  const cfRes = await fetch(
    "https://challenges.cloudflare.com/turnstile/v0/siteverify",
    { method: "POST", body }
  );
  const outcome = await cfRes.json();

  return new Response(JSON.stringify({ success: !!outcome.success }), {
    headers: { "Content-Type": "application/json" },
    status: 200,
  });
});

Part 2 — Word Filter (screens chat messages)

Checks every chat and DM message against the word list below before it posts — no OpenAI key, no external API call. Already deployed and live. Set each word to either mask (swaps the letters for ##### and still posts the message) or block (the message doesn't post at all). Add words any time — no redeploy needed.

Local mode — connect Supabase (Database tab) for site-wide live stats across every visitor, not just this device.

Right Now

Growth & Activity

"Possible Bot Signups" flags accounts created in rapid bursts — 3 or more signups within 10 seconds of each other. It's a heuristic based on timing patterns, not a certainty a real script wrote them. Always check the Users tab before deleting anything it flags.

Who's Online

Database Connection

By default this site stores everything in your browser only — songs, moods, chat messages, ratings. Nobody else sees your changes. Connect a free Supabase project to make all of that shared and permanent across every visitor.

Setup Guide

Real Google Sign-In Setup (optional)

The "Continue/Sign in with Google" buttons work as a simple alias picker until you do this setup — after that, they use real Google accounts. This needs Supabase connected above and the site hosted at a real https:// address (Google won't redirect back to a local file).