Apply this in the PocketBase Admin UI (or via a migration). All API
rules are left empty / superuser-only because the
public-internet browser never talks to PocketBase directly — the Next.js
server mediates every read/write with the superuser token
(POCKETBASE_ADMIN_EMAIL /
POCKETBASE_ADMIN_PASSWORD).
In the Admin UI, leaving a rule field blank with the lock closed = superuser only. Do not set rules to the public
@request/empty-open state.
guests
(type: Base)| Field | Type | Required | Options |
|---|---|---|---|
token |
Text | no | Unique (QR guest token; add a unique index) |
name |
Text | yes | max ~80 chars |
emoji |
Text | no | max ~16 chars |
avatar |
File | no | Single file; Max select 1; MIME image/*; thumb
e.g. 100x100 |
API rules (all superuser-only): List, View, Create, Update, Delete = empty + locked.
Unique index (SQL form):
CREATE UNIQUE INDEX idx_guests_token ON guests (token);photos
(type: Base)| Field | Type | Required | Options |
|---|---|---|---|
guest |
Relation | yes | Collection guests; Max select 1; Cascade delete on |
file |
File | yes | Single file; Max select 1; MIME image/*,
video/*; max size e.g. 50MB |
caption |
Text | no | optional overlay/caption text |
API rules (all superuser-only): List, View, Create, Update, Delete = empty + locked.
Create a superuser (PocketBase Admin) and put the credentials in
.env.local:
POCKETBASE_URL=http://pocketbase.home.arpa
POCKETBASE_ADMIN_EMAIL=...
POCKETBASE_ADMIN_PASSWORD=...