Public product · private source · source-pinned case study

Adaptivearts.ai turns AI research into a usable, secure publishing platform.

A static-first Astro site with React interaction, Supabase authentication and a server-side Gemini boundary for editorial workflows, AI labs and public research artefacts.

Open live product Explore the architecture flows View MADS proof

Astro 6 React 19 TypeScript Supabase Auth Edge Functions Google Gemini Static-first

What was built

Adaptivearts.ai is not only a portfolio page. It combines public publishing, authenticated editorial tools and AI-assisted workflows in one deployed system.

Public

research and publishing surface

Research directions, prototypes, articles, book material, open-science notes and collaboration flows are published through a static-first web architecture.

Authenticated

editorial and administration surface

Supabase sessions and application roles support article editing, cover-image handling, newsletter administration and protected AI actions.

Server-side

AI provider boundary

Gemini calls are dispatched from a Supabase Edge Function. The provider credential is read from the server environment rather than embedded in the browser bundle.

Implemented architecture

The public site is statically generated where possible. Interactive and private actions cross explicit client, authentication and provider boundaries.

1. Astro pagesStatic output, site structure, content presentation, sitemap generation and public navigation.

↓

2. React islandsInteractive labs, authentication state, editorial controls and application-level user flows.

↓

3. Supabase sessionUser authentication, session restoration, role lookup and least-privileged fallback to the customer role.

↓

4. Edge FunctionValidates private actions, reads server-held provider credentials and dispatches a bounded action set.

↓

5. Gemini providerText or image generation returns structured JSON to the application boundary.

Explore three product flows

The examples below are browser-only explanations derived from the inspected architecture. They do not call Supabase or Gemini.

Public research flow

Provider boundary

POST Edge Function
{
  "action": "generateExcerpt",
  "payload": {
    "prompt": "Synthetic example only"
  }
}

The function rejects unknown actions. Non-public actions require a valid Supabase user session before the provider call is created.

Credential boundary

Browser bundle
  Supabase URL + anonymous key

Edge Function environment
  GEMINI_API_KEY

The anonymous Supabase key is a public client identifier used with Auth and database policies. The Gemini provider key remains server-side.

Evidence record

This page is tied to exact source and verification points so the architecture claim can be revisited when the product changes.

Private source repository	`fbratten/project-adaptivearts-ai`
Current documentation pin	`adea33d6a2c193d67dcb0f5389fb7b17acf6954c`
Implementation evidence pin	`e31d085707dd98c86286e8368b0c4dc75b5ac9fa`
Verified	2026-08-02
Public runtime evidence	The production site was externally reachable during the review.
Source evidence	Astro build scripts and config, Supabase Auth role flow, and server-side Gemini Edge Function inspected.
Automated test evidence	No broad automated test suite is claimed by this package.
Case-study execution	Static browser explanation only. No private service calls are performed.

Explicit limitations

This case study demonstrates an implemented application architecture and a reachable public product. It does not claim Azure OpenAI, Azure deployment, customer production delivery, a broad automated test suite or public access to the private source repository.

Supported claims

Astro and React product architecture
Supabase authentication and role projection
Server-side Gemini provider boundary
Public publishing and authenticated editorial flows
Deployed and externally reachable public site

Not claimed

Azure or Azure OpenAI implementation
Enterprise multi-tenant production
Public source code
New test or deployment run from this proof change
That client-side role flags are the sole security boundary