phktrent

Design system

• UI Kit

  The design-system reference — every color, type style and component fixed for product UI (CLAUDE.md §5). Not indexed.

Auth flow

• Register

  Create a new account. Sends a confirmation email.

• Verify email (landing)

  Shown after the confirmation link. Open directly to see the "already confirmed" copy.

• Sign in

  Sign-in form for an existing account.

• Forgot password

  Request a password-reset email.

• Reset password

  Only shows the form with a live recovery session, reached via the emailed link. Opened directly, redirects to Forgot password.

Social login — each needs its own Supabase dashboard config first (CLAUDE.md §7)

• Continue with Google

  Redirects to Google's consent screen. Works once the Google provider is enabled in the Supabase dashboard with a real Client ID/Secret; until then it redirects back to Sign in with an error.

• Continue with Facebook

  Same as Google, for Facebook. The button on Sign in/Register is disabled until the Meta app (Privacy Policy + Data Deletion URLs) exists — this direct link works as soon as the Facebook provider is enabled in Supabase.

Legal

• Privacy & data deletion

  MVP placeholder text required by Google/Meta before either OAuth app can go live — not a substitute for legal review.

Dashboard

• Dashboard

  Signed-in home: your roles/permissions, and a button to request the agent role. Redirects to Sign in when logged out.

Admin — staff only, each section needs its own permission (see credentials below)

• Users

  List, suspend/reactivate, invite by email. Needs users.read (admin, director, manager see the list; only admin can suspend or invite).

• Roles

  Role list, plus grant/revoke a role by pasted user id. Viewing needs roles.read; granting needs roles.assign (admin, director).

• Role requests

  Pending "become an agent" applications — approve or reject. Needs role_requests.review (admin, director, manager).

• Audit log

  Every tracked table change, who made it and what changed. Needs audit.read (admin, director).

SEO / technical

• robots.txt

  Per-site robots file.

• sitemap.xml

  Per-site sitemap.

Test accounts

Same password for all of them — the value of SEED_USER_PASSWORD in .env.local.