GEMCA Music

Overview

The marketing site for GEMCA Music, with a blog, galleries and a PDF library, plus an admin CMS for managing content, enrolment requests and contact messages. Next.js and Firebase, with admin writes enforced by Firestore rules rather than by the interface.

The problem

A music organisation needs a public site that looks the part and can be updated by the people who run it, without a developer for every blog post, carousel image or PDF.

The approach

Firebase as a headless CMS behind a Next.js App Router front end. The security model lives in the data layer: admin privilege is a custom claim on the account, Firestore rules enforce every write, and the public can read only what is published or enabled. The newsletter signup goes through a server-side route so the Mailchimp key never reaches the browser.

Outcome

• Staff manage blog posts, the homepage carousel, event media, embedded posts and a searchable PDF library themselves
• Enrolment requests and contact messages arrive in the admin area, where they can be marked contacted, deleted and restored
• The footer newsletter signup confirms or fails in a modal rather than leaving the visitor guessing
• An audit-ci configuration and a tests directory sit alongside the app

What it does

• Admin by claim, enforced by rules

  Sign-in is Google-only for admins, privilege is a custom claim, and Firestore rules enforce every write, so hiding a button is never the only protection.

• Published means published

  Visitors can read only published posts and enabled media, so a draft cannot leak by guessing a URL.

• Forms that reach a person

  Enrolment and contact submissions are stored for review in the admin area, with soft delete and restore.

• A library people can search

  PDFs can be uploaded or linked, categorised, tagged and searched, so a handbook is found by what it is about.