Reverse spec drafted

Sign in

Email/password and Google authentication entry into the platform.

Observed route/sign-inFuture Spec 17 →

Current maturityPartial authentication implementation

Evidence confidenceKnown limitation

Last reviewedAugust 4, 2026

Visual evidenceDeferred during UI updates

Current-state summary

The product supports an authenticated Supabase-backed session used by the live Admin workspace. Email/password authentication is sufficiently functional to establish the current signed-in session. Google sign-in is intended to appear as an authentication option but does not currently complete successfully through Supabase and must be treated as nonfunctional until configuration and callback behavior are repaired and tested.

Interface inventory

Anatomy and verified behavior

Verification states separate observed behavior from requirements or assumptions.

Element	Current behavior	Verification
Design Registry identity	The authentication surface is expected to carry the same black-and-white product identity as the authenticated shell.	Requirement confirmed; live unauthenticated page not reviewed in this session
Google sign-in action	The option is part of the intended sign-in experience, but the Supabase OAuth flow does not currently work.	Known limitation confirmed by product owner
Email field	Collects the user identity used for password authentication.	Email/password session exists; exact field behavior requires unauthenticated review
Password field	Collects the password and should support hidden entry with a visibility toggle.	Authentication requirement; live control not reviewed
Sign-in action	Submits credentials and resolves the user session before Workspace context loads.	Successful authenticated session verified indirectly
Forgot-password link	Provides entry to password recovery.	Required route and flow; live link not reviewed
Create-account link	Expected to route a new person into the appropriate application, invitation or signup journey.	Future requirement; current destination unverified

User journeys

Current flows

Email and password

Open the sign-in surface
Enter email and password
Submit credentials
Supabase establishes a session
Application resolves User and Workspace membership
Authorized Workspace loads

Google

Select Continue with Google
Begin Supabase OAuth
Return through the configured callback
Resolve identity and Workspace destination

Unauthorized identity

Submit credentials or OAuth identity
Resolve the User
Check active Workspace memberships and allowed destinations

State model

Current and expected states

Idle

Authentication form is available for input.

Submitting

A loading state should prevent duplicate submission; exact implementation is unverified.

Authenticated

User enters the Admin application and the shell begins resolving active Workspace context.

Invalid credentials

Expected to show a non-enumerating error; exact copy is unverified.

Google OAuth failed

Known current failure. Exact failure point and user-facing message have not been documented.

No authorized Workspace

Expected to stop protected navigation and provide a safe next step; current behavior unverified.

Product rules

Non-negotiable boundaries

Authentication proves identity; Workspace Membership determines access.
The browser session must not be the only source of authorization truth.
Errors must not confirm whether an unrelated email has an account.
Provider tokens, callback errors and authentication secrets must not appear in client logs or Activity.
Google authentication consent is separate from later Gmail, Calendar, Sheets or Drive integration consent.

Dependencies

Supabase AuthUser identity recordWorkspace Membership resolutionAuthorized redirect/callback configurationSession cookie and refresh behavior

Known current limitations · 4 mapped

What is missing, broken or unverified

Future Spec 17 owns closure →

Google sign-in does not currently work through Supabase.
The exact sign-in route, responsive layout, field validation and error copy were not observed in an unauthenticated session.
Account creation, invitation continuation, email verification and duplicate identity linking are not validated as current behavior.
MFA, recent-authentication gates and session management are not yet represented in the current profile.

Future alignment

Required evolution

01Repair and test the Supabase Google provider, authorized origins and callback URLs in every environment.
02Preserve application or invitation context through authentication and email verification.
03Add explicit loading, cancellation, provider failure and no-membership states.
04Complete identity linking, session security and account recovery in Spec 17.

Current baseline

Acceptance record

Email/password authentication can create a valid session.
Google is visibly documented as nonfunctional until a successful end-to-end test passes.
An authenticated identity cannot access a Workspace without an active Membership.
Sign-in failures do not disclose whether unrelated accounts exist.

Reverse-spec completeness

Documentation coverage

The interface is still changing, so visual evidence and repository tracing remain intentionally incomplete.

Purpose and user outcome

Documented

Roles and access

Documented

Routes and entry points

Documented

Page and component anatomy

Documented

Fields and displayed data

Documented

Primary actions

Documented

Forms and validation

Documented

States and transitions

Documented

Empty, loading and error states

Documented

Responsive behavior

Partial

Accessibility behavior

Partial

Activity and audit events

Partial

Data sources and persistence

Documented

Notifications and automation

Partial

Known defects and limitations

Documented

Reusable component dependencies

Documented

Future-spec conflicts

Partial

Visual and repository evidence

Deferred

Acceptance of current baseline

Documented