Home/Emergent (Vibe Coding) Tutorials/Build a Cinematic Photo Gallery with Emergent
Emergent (Vibe Coding) TutorialBeginner60 min read

Build a Cinematic Photo Gallery with Emergent

Create a public dark-theme photo gallery with a full-screen lightbox and a secure single-admin upload dashboard.

Tutorial ForgeUpdated Aug 5, 2026

1. What you will build

In this beginner-friendly lesson you will create **Nocturne Gallery** — a public photography portfolio with a cinematic dark interface. Visitors never create an account: they simply browse. Behind a single protected login at /admin, you (the owner) upload, edit, publish, and delete photos.
Finished project at a glance

Administrator access

The public gallery is available to everyone. To manage photos, open the Admin Dashboard and sign in with the administrator email and password configured in your Emergent project secrets. There are no public user accounts. If you built your own version, replace the demo URL with your published domain followed by /admin.

2. Before you begin

Prerequisites
Never paste real passwords

Never type a real password into an AI prompt, a chat message, a screenshot, or frontend code. Real credentials belong only in your project's secure Secrets or Environment settings, which you configure in step 6.


3. Create the project

01

Start a new Emergent FastAPI/React project

Open Emergent, create a new project, and choose the FastAPI backend with React frontend environment. When the agent asks what you want to build, paste the complete master prompt from the next section as your very first message — nothing else.

Paste it whole

Send the master prompt as one single message. Splitting it up is what makes the agent stop and ask clarifying questions.


4. Master build prompt

Copy the entire prompt below. Every decision the agent would normally ask about is already made, and it is explicitly told to proceed without follow-up questions.
Master build prompt — copy all of it
Build a complete, production-minded photo gallery application using the platform-provided FastAPI backend and React frontend. Do not ask follow-up questions. Treat every decision below as final and proceed autonomously. PRODUCT - Create a public photography gallery called "Nocturne Gallery." - Visitors can browse every published photo without creating an account or signing in. - Do not display public login, registration, profile, or account controls. - Create a separate protected administrator area at /admin. FIXED IMPLEMENTATION DECISIONS - Stack: Use the provided FastAPI backend and React frontend. - Database: Use the platform-provided database. - Administrator authentication: Use JWT-based custom authentication for exactly one administrator. - Read the administrator email and password only from secure server-side environment variables named ADMIN_EMAIL and ADMIN_PASSWORD. - Hash and verify the password securely. Never hard-code credentials, return them through an API, store plaintext passwords, or expose secrets in the frontend bundle. - Image storage: Use Emergent Object Storage for every administrator-uploaded image. Do not use local server disk storage. - Store photo metadata and object-storage references or URLs in the database. - Public users have read-only access to published photos. - Enforce all upload, create, update, publish, unpublish, and delete authorization in the FastAPI backend, not merely by hiding buttons in React. - Do not ask about authentication, image storage, database choice, theme, seed data, routes, or other implementation preferences. VISUAL DIRECTION - Use a cinematic, moody gallery aesthetic. - Use deep black and charcoal backgrounds with warm amber and champagne-gold accents. - Use large immersive photography, elegant editorial headings, restrained glassmorphism, soft gradients, subtle glows, and layered shadows. - Add gentle hover scaling, image reveals, and smooth fades. - Keep animation restrained and respect prefers-reduced-motion. - Provide strong contrast, visible keyboard focus states, and accessible controls. - Avoid bright colors, generic dashboard styling, excessive gradients, and flashy animation. PUBLIC GALLERY - Build a responsive masonry-style gallery for desktop, tablet, and mobile. - Add a compact header with the gallery name and subtitle. - Add category filter chips and one search field for titles and descriptions. - Add an optional featured-photo hero using the photo marked featured. - Show only published photos. - Sort first by displayOrder and then newest first. - Lazy-load gallery images and display polished skeleton placeholders. - Preserve image aspect ratios. - Include an attractive empty state. LIGHTBOX - Clicking a photo opens an elegant full-screen lightbox. - Include previous, next, and close controls. - Support left/right arrow keys, Escape to close, and mobile swipe gestures. - Show the photo title, description, category, and date. - Add smooth fade and restrained zoom transitions. - Trap keyboard focus while open and restore focus to the originating photo when closed. - Make controls clearly labeled for assistive technology. ADMIN BACKEND - Protect /admin with the single-administrator JWT login. - Do not provide public registration. - Allow the administrator to upload one or multiple photos. - Show previews and upload progress. - Validate JPG, PNG, and WebP files and enforce a reasonable configurable size limit. - Allow editing title, description, alt text, category, captured date, display order, featured status, and published status. - Allow replacing an image. - Allow publishing and unpublishing. - Allow deletion only after a confirmation dialog. - Provide search and filtering for existing photos. - Show clear loading, success, empty, and error states. - Ensure unpublished photos are excluded from public API responses and are not discoverable through predictable public routes. DATA MODEL Create a Photo model with: - id - objectKey or storage reference - imageUrl - thumbnailUrl when supported - title - description - altText - category - capturedAt - uploadedAt - displayOrder - isFeatured - isPublished Create a Category model if helpful, with: - id - name - slug - displayOrder INITIAL CONTENT - Seed the gallery with 10-12 tasteful remote Unsplash placeholder photos so it looks complete on first launch. - Create the sample categories Architecture, Landscapes, Portraits, Street, and Abstract. - Include realistic titles, short descriptions, accessible alt text, captured dates, and display-order values. - Mark one seeded photo as featured. - Publish all seeded photos. - Clearly distinguish seed records so the administrator can replace or delete them. - Avoid copying remote demo files into paid object storage unless required. - The gallery must still show an attractive empty state if all samples are deleted. ROUTES - / - public gallery - /admin - protected administrator dashboard - Add nested administrator upload or edit routes only if they improve usability. QUALITY REQUIREMENTS - Build a functional application, backend API, database models, object-storage integration, permissions, and admin workflow-not a static mockup. - Use reusable React components. - Sanitize metadata. - Handle expired JWTs cleanly and return the administrator to the login screen. - Do not log credentials or tokens. - Include clear setup notes for ADMIN_EMAIL and ADMIN_PASSWORD. - Test the public gallery, filters, lightbox keyboard behavior, administrator login, uploads, editing, publishing, unpublishing, and deletion. - Make sensible production-ready choices for any remaining minor decisions and do not pause for clarification.

5. Answering the agent's five questions

Most build agents pause to ask the same five things. The master prompt already answers them. Keep this panel handy in case you are asked anyway.
QuestionPreselected answer
Admin authenticationJWT custom authentication with exactly one admin; email and password read from server-side environment variables
Image storageEmergent Object Storage (never local server disk)
ThemeCinematic and moody — deep blacks with warm amber/champagne glow accents
Seed contentYes — 10-12 tasteful Unsplash samples and five categories
Any remaining questionUse sensible production-ready defaults and continue without asking

6. Configure administrator secrets

After the first build finishes, ask Emergent to prepare the administrator secrets for you. Emergent should create or identify the required server-side variables and direct you to its secure Secrets or Environment interface. The exact settings label can vary.
Send this to Emergent
Help me configure the administrator login for this project. Set up the server-side secret variables ADMIN_EMAIL and ADMIN_PASSWORD, then open or direct me to the secure Secrets or Environment interface so I can enter their values privately. Do not ask me to paste the email or password into chat, and do not place either value in client-side code, source files, logs, screenshots, or version control. After I save them, confirm the backend reads both variables at runtime and tell me whether the backend must be restarted or redeployed.

What happens next

  1. 1.Emergent creates or confirms the variable names ADMIN_EMAIL and ADMIN_PASSWORD.
  2. 2.Emergent opens or points you to the secure Secrets or Environment screen.
  3. 3.Enter your chosen administrator email and a strong, unique password there — not in the chat.
  4. 4.Save the values and restart or redeploy the backend if Emergent instructs you to.
  5. 5.Open your published domain followed by /admin and sign in with the same email and password.
Info

These are the only administrator credentials for this project; there are no public user accounts.

VariableWhat to enter
ADMIN_EMAILyour administrator email
ADMIN_PASSWORDa strong, unique password or passphrase
Keep secrets out of everything else

Use your own real email and a strong unique password when you save them — but only inside the Secrets or Environment settings screen. Never place real secrets in the chat prompt, screenshots, client-side code, or a Git repository. Restart or redeploy the backend after saving so the new values load.

Is the /admin URL a secret?

No. Keeping /admin out of the public navigation creates a cleaner visitor experience, but the route itself is not a security boundary. Anyone can guess /admin. Real protection must come from administrator authentication and protected backend operations; knowing the URL must never grant access by itself.

Administrator access best practices
Best practice

Hidden from normal navigation by design; securely protected, not secret.


Public gallery checks

8. Test the administrator workflow

Work through these steps in order: 1. Open your published site at `/admin` (for the completed example, use the **Open Admin Dashboard** button above). 2. Sign in using the single administrator credentials stored in your Emergent environment/secrets. 3. Upload a test photo, add its title, alt text, category, and optional description. 4. Publish it and confirm it appears in the public gallery. 5. Unpublish it and confirm it is removed from the public gallery. 6. Test editing, display order, featured status, search/filtering, and deletion confirmation.
Administrator checks
Prove the backend is the gatekeeper

Ask the agent to show you the route protections, or try a protected request from a signed-out private window. Hidden buttons are not security — the FastAPI backend must reject the request.


9. Refinement prompt

Once everything works, send this second prompt to polish quality without touching the look you established.
Refinement and audit prompt
Audit and fix the existing photo gallery application without redesigning the established cinematic aesthetic. Keep the current colors, typography, and layout direction. Review and repair: - Accessibility: heading order, alt text, ARIA labels on lightbox and admin controls, visible keyboard focus states, color contrast, and prefers-reduced-motion support. - Mobile layout: header, filter chips, search field, masonry grid, lightbox controls, and admin forms at small widths. - Loading states: skeletons, upload progress, disabled buttons during requests, and clear success and error messages. - Broken images: graceful fallback when an image URL fails, and no layout shift. - Backend authorization: confirm every upload, create, update, publish, unpublish, and delete endpoint requires a valid administrator JWT, and that unpublished photos never appear in public API responses. - Secret exposure: confirm ADMIN_EMAIL and ADMIN_PASSWORD are only read server-side, are never returned by an API, never logged, and never bundled into the frontend. - Lightbox behavior: arrow keys, Escape, swipe gestures, focus trapping while open, and focus restoration to the originating photo when closed. Report what you changed and list anything you intentionally left alone.

10. Publish and final review

Open the live preview and resize it to a desktop width, then a phone width. Next, open the public route in a signed-out or private window to confirm a visitor sees the gallery with no login prompt and no unpublished photos. When everything looks right, publish the project from Emergent.
Final launch checklist
You shipped a real gallery

You now have a public cinematic photography portfolio backed by a real API, a real database, object storage, and a secure single-administrator dashboard. Add your own photos and it is genuinely ready to share.

Tags
#Emergent#Photo Gallery#Admin#Object Storage