Authentication

SalesArck uses Supabase for identity and SalesArck-owned data for authorization.

Current Flow

1. The frontend signs in with Supabase OTP.
2. The API verifies the access token server-side.
3. The API resolves or creates the users row.
4. The API loads tenant memberships from tenant_users.
5. The API returns either a strict auth context or a looser profile response for /auth/me.

Key Implementation Files

• apps/api/src/middleware/auth.ts
• apps/api/src/middleware/auth-profile.ts
• apps/api/src/lib/resolve-user.ts
• packages/auth/src/supabase-server.ts

Role Derivation

The first authenticated request can derive a user role from Supabase metadata:

• client or merchant requests map to client with pending_approval
• admin requests only stay admin when the email domain is approved
• otherwise the user defaults to consumer

Admin Email Domains

The current allowed admin domains are:

• @salesarck.com
• @doshidhruv.com

Profile Response

GET /api/v1/auth/me returns the current session profile, including:

• userId
• role
• tenantIds
• status
• canUseApp
• needsMerchantOnboarding
• email
• phone
• optional code when app access is blocked

Important Invariants

• authentication is server-validated
• client payloads never decide tenant membership
• pending approval is a profile state, not a client-side guess
• admin email-domain checks cannot be bypassed by the UI