| + Aspect + | ++ Traditioneel + | ++ AI Speedrun + | +
|---|---|---|
| + {item.label} + | ++ {item.traditional} + | ++ {item.aiSpeedrun} + | +
+ {content.subheading} +
+ )} + ++ "{content.quote}" ++ +
+ {content.subtitle} +
++ {children} +
++ {blockSection.content} +
+ ) + } + + if (blockSection.type === 'insight') { + return ( ++ {section.content} +
++ {content.error.message} +
+ ++ {content.hero.subtitle} +
++ {content.hero.description} +
++ {benefit.description} +
++ Nog vragen? Stuur een email naar{' '} + + contact@speedrun.nl + +
++ We reageren binnen 24 uur +
++ {credentials.note} +
+ + ++ {content.hero.subtitle} +
++ {content.hero.description} +
++ {content.demo.description} +
+ ++ {feature.description} +
+| + Stap + | ++ {content.comparison.traditional.label} + | ++ {content.comparison.speedrun.label} + | +
|---|---|---|
| Intake samenvatting | ++ {content.comparison.traditional.intake} + | ++ {content.comparison.speedrun.intake} + | +
| Probleemprofiel | ++ {content.comparison.traditional.profile} + | ++ {content.comparison.speedrun.profile} + | +
| Behandelplan | ++ {content.comparison.traditional.plan} + | ++ {content.comparison.speedrun.plan} + | +
| Totaal | ++ {content.comparison.traditional.total} + | ++ {content.comparison.speedrun.total} + | +
+ {content.comparison.savings} +
++ {content.video.description} +
+ ++ {content.video.placeholder} +
++ {content.cta.subheading} +
+ )} + + +- Marketing route group is working. Content will be loaded here. -
+import type { Metadata } from 'next' +import dynamic from 'next/dynamic' +import { getContent } from '@/lib/content/loader' +import type { ManifestoContent, MetadataContent } from '@/content/schemas/manifesto' +import { HeroQuote } from './components/hero-quote' +import { ManifestoContent as ManifestoContentComponent } from './components/manifesto-content' +import { StructuredData } from './components/structured-data' + +// Generate metadata for SEO +export async function generateMetadata(): Promise+ AI-powered EPD voor de GGZ sector +
+{message.text}
++ π Demo Credentials: +
+Email: demo@mini-ecd.demo
+Password: Demo2024!
++ Build in Public door{' '} + + AI Speedrun + +
+Klik op de knop hieronder om in te loggen bij Mini-ECD:
+ +Of kopieer deze link naar je browser:
+{{ .ConfirmationURL }}
+Deze link is 1 uur geldig.
+``` + +#### Redirect URLs + +Add these redirect URLs under "Redirect URLs": + +``` +http://localhost:3000/auth/callback +https://yourdomain.com/auth/callback +``` + +#### Email Auth Settings + +- β Enable Email provider +- β Confirm email: OFF (for demo convenience) +- β Secure email change: ON +- β±οΈ Rate limits: Default (4 emails per hour) + +--- + +## File Structure + +``` +app/ + login/ + page.tsx # Login UI (magic link + demo login) + auth/ + callback/ + route.ts # Handles magic link callback + logout/ + route.ts # Logout endpoint + +lib/ + auth/ + client.ts # Client-side auth helpers + server.ts # Server-side auth helpers + database.types.ts # Generated Supabase types + +middleware.ts # Route protection +scripts/ + seed-demo-users.ts # Demo user creation script +``` + +--- + +## Usage Examples + +### Client-Side (React Components) + +```typescript +import { + loginWithMagicLink, + loginWithPassword, + logout, + getUser, + isDemoUser +} from '@/lib/auth/client' + +// Magic link login +async function handleMagicLink(email: string) { + const result = await loginWithMagicLink(email) + console.log(result.message) // "Check je email voor de magic link!" +} + +// Demo account login +async function handleDemoLogin() { + await loginWithPassword('demo@mini-ecd.demo', 'Demo2024!') + router.push('/clients') +} + +// Check current user +const user = await getUser() +const isDemo = await isDemoUser() + +// Logout +await logout() // Redirects to /login +``` + +### Server-Side (API Routes, Server Components) + +```typescript +import { + requireAuth, + getUser, + canWrite, + getDemoUserInfo +} from '@/lib/auth/server' + +// Require authentication in API route +export async function GET() { + const session = await requireAuth() // Throws if not authenticated + // ... handle request +} + +// Check write permissions +export async function POST() { + const hasWriteAccess = await canWrite() + + if (!hasWriteAccess) { + return NextResponse.json( + { error: 'Read-only demo account cannot create data' }, + { status: 403 } + ) + } + + // ... create resource +} + +// Get demo user info +const demoInfo = await getDemoUserInfo() +if (demoInfo) { + console.log(`Access level: ${demoInfo.access_level}`) + console.log(`Usage count: ${demoInfo.usage_count}`) +} +``` + +--- + +## Route Protection + +Routes are protected via `middleware.ts`: + +### Public Routes (No Auth Required) +- `/` - Landing page +- `/login` - Login page +- `/epd` - EPD demo info +- `/contact` - Contact form +- `/auth/callback` - Auth callback + +### Protected Routes (Auth Required) +- `/clients` - Client list +- `/clients/*` - Client details, intake, etc. +- Any other route not in public list + +**Behavior:** +- β Unauthenticated β Redirect to `/login?redirect=/original-path` +- β Authenticated on `/login` β Redirect to `/clients` +- β Session auto-refreshed in middleware + +--- + +## Security Features + +### β Implemented + +1. **RLS Policies**: All database queries filtered by `auth.uid()` +2. **Session Management**: Auto-refresh tokens via middleware +3. **Secure Cookies**: HTTP-only, secure flags set +4. **CSRF Protection**: Built-in Next.js CSRF protection +5. **Rate Limiting**: Supabase default (4 emails/hour) +6. **Demo User Tracking**: Usage count and last login tracked + +### π Production Enhancements + +For production deployment: + +1. **Email Confirmation**: Enable email confirmation +2. **Password Requirements**: Enforce strong passwords +3. **MFA**: Add multi-factor authentication +4. **Session Timeout**: Implement auto-logout after inactivity +5. **IP Whitelisting**: Restrict demo accounts to specific IPs +6. **Audit Logging**: Enhanced tracking of all auth events + +--- + +## Demo User Management + +### Checking Demo Status + +```typescript +// Check if user is demo user +const isDemo = await isDemoUser() + +// Get access level +const accessLevel = await getDemoAccessLevel() +// Returns: 'read_only' | 'interactive' | 'presenter' | null +``` + +### Restricting Actions + +```typescript +// In API route +const demoInfo = await getDemoUserInfo() + +if (demoInfo?.access_level === 'read_only') { + return NextResponse.json( + { error: 'This demo account is read-only' }, + { status: 403 } + ) +} +``` + +### Resetting Demo Accounts + +To reset a demo account (clear data, reset usage): + +```sql +-- Reset usage count +UPDATE demo_users +SET usage_count = 0, last_login_at = NULL +WHERE access_level = 'interactive'; + +-- Or via Supabase Dashboard: Authentication β Users β Delete user data +``` + +--- + +## Troubleshooting + +### Issue: Magic link not arriving + +**Causes:** +- Email in spam folder +- Rate limit exceeded (4 emails/hour) +- Email provider blocking Supabase emails + +**Solutions:** +1. Check spam folder +2. Wait 1 hour and try again +3. Use demo account instead +4. Configure custom SMTP in Supabase + +### Issue: "Invalid login credentials" + +**Causes:** +- Wrong email/password for demo account +- Demo user not created yet + +**Solutions:** +1. Check credentials match exactly (case-sensitive) +2. Run seed script: `tsx scripts/seed-demo-users.ts` +3. Verify in Supabase Dashboard β Authentication β Users + +### Issue: Redirect loop on /login + +**Causes:** +- Middleware configuration error +- Session cookie issues + +**Solutions:** +1. Clear browser cookies +2. Check middleware.ts public routes config +3. Verify `NEXT_PUBLIC_SUPABASE_URL` is correct + +### Issue: "Row violates RLS policy" errors + +**Causes:** +- User not properly authenticated +- Session expired +- RLS policies misconfigured + +**Solutions:** +1. Logout and login again +2. Check `auth.uid()` returns valid UUID +3. Verify RLS policies allow user access + +--- + +## Testing Checklist + +### Magic Link Flow +- [ ] Can enter email on /login +- [ ] Magic link email received +- [ ] Clicking link redirects to /clients +- [ ] Session persists after page refresh +- [ ] New users auto-created on first login + +### Demo Account Flow +- [ ] Can login with demo@mini-ecd.demo +- [ ] Can login with readonly@mini-ecd.demo +- [ ] Interactive account can create/edit data +- [ ] Read-only account blocked from editing +- [ ] Demo usage tracked in demo_users table + +### Route Protection +- [ ] /clients redirects to /login when not authenticated +- [ ] /login redirects to /clients when authenticated +- [ ] Public routes accessible without auth +- [ ] Session auto-refreshes + +### Logout +- [ ] Logout clears session +- [ ] Redirects to /login +- [ ] Cannot access protected routes after logout + +--- + +## References + +- [Supabase Auth Documentation](https://supabase.com/docs/guides/auth) +- [Next.js Middleware](https://nextjs.org/docs/app/building-your-application/routing/middleware) +- Build Plan: `docs/specs/bouwplan-ai-speedrun-marketing-first-v1.1.md` Epic 2 +- Technical Design: `docs/specs/to-mini-ecd-v1_2.md` Β§ 5.7 + +--- + +**Status:** β Implemented and Ready for Testing +**Next Steps:** E2.S4 - Seed data script (clients + dossiers) diff --git a/docs/RLS_SECURITY.md b/docs/RLS_SECURITY.md new file mode 100644 index 0000000..beb3f07 --- /dev/null +++ b/docs/RLS_SECURITY.md @@ -0,0 +1,304 @@ +# π Row Level Security (RLS) Documentation + +**Project:** AI Speedrun - Mini-ECD Prototype +**Epic:** E2 - Database & Auth +**Story:** E2.S2 - RLS policies implementeren +**Last Updated:** 2024-11-15 + +--- + +## Overview + +This document describes the Row Level Security (RLS) implementation for the EPD core database tables. RLS is PostgreSQL's security feature that restricts which rows users can access in database queries. + +### Security Model + +- **Authentication Required:** All data access requires a valid Supabase authentication session +- **Authorization:** Checked via `auth.uid()` function which returns the authenticated user's UUID +- **MVP Level:** All authenticated users can access all data (suitable for demo/single-org) +- **Production Path:** Ready to extend with `org_id` filtering for multi-tenancy + +--- + +## Tables & Policies + +### 1. Clients Table + +**Purpose:** Basic client information +**RLS Enabled:** β Yes + +#### Policies: + +| Policy Name | Operation | Rule | +|------------|-----------|------| +| Authenticated users can view clients | SELECT | `auth.uid() IS NOT NULL` | +| Authenticated users can create clients | INSERT | `auth.uid() IS NOT NULL` | +| Authenticated users can update clients | UPDATE | `auth.uid() IS NOT NULL` | +| Authenticated users can delete clients | DELETE | `auth.uid() IS NOT NULL` | + +**Production Enhancement:** +```sql +-- Add organization filtering +CREATE POLICY "Users can view own org clients" + ON clients FOR SELECT + USING ( + auth.uid() IS NOT NULL AND + org_id = (SELECT org_id FROM users WHERE id = auth.uid()) + ); +``` + +--- + +### 2. Intake Notes Table + +**Purpose:** TipTap/ProseMirror JSON content storage +**RLS Enabled:** β Yes + +#### Policies: + +| Policy Name | Operation | Rule | +|------------|-----------|------| +| Authenticated users can view intake notes | SELECT | `auth.uid() IS NOT NULL` | +| Authenticated users can create intake notes | INSERT | `auth.uid() IS NOT NULL` | +| Authenticated users can update intake notes | UPDATE | `auth.uid() IS NOT NULL` | +| Authenticated users can delete intake notes | DELETE | `auth.uid() IS NOT NULL` | + +**Security Features:** +- Full-text search index with Dutch language support +- Cascade delete when parent client is deleted +- Automatic `updated_at` trigger + +--- + +### 3. Problem Profiles Table + +**Purpose:** DSM-light categorization with severity scoring +**RLS Enabled:** β Yes + +#### Policies: + +| Policy Name | Operation | Rule | +|------------|-----------|------| +| Authenticated users can view problem profiles | SELECT | `auth.uid() IS NOT NULL` | +| Authenticated users can create problem profiles | INSERT | `auth.uid() IS NOT NULL` | +| Authenticated users can update problem profiles | UPDATE | `auth.uid() IS NOT NULL` | +| Authenticated users can delete problem profiles | DELETE | `auth.uid() IS NOT NULL` | + +**Data Constraints:** +- Category: Must be one of 6 DSM-light categories +- Severity: Must be 'laag', 'middel', or 'hoog' +- Cascade delete with parent client +- SET NULL on source note deletion + +--- + +### 4. Treatment Plans Table + +**Purpose:** Treatment plans with JSONB structure and versioning +**RLS Enabled:** β Yes + +#### Policies: + +| Policy Name | Operation | Rule | +|------------|-----------|------| +| Authenticated users can view treatment plans | SELECT | `auth.uid() IS NOT NULL` | +| Authenticated users can create treatment plans | INSERT | `auth.uid() IS NOT NULL` | +| Authenticated users can update treatment plans | UPDATE | `auth.uid() IS NOT NULL` | +| Authenticated users can delete treatment plans | DELETE | `auth.uid() IS NOT NULL` | + +**Versioning:** +- Each client can have multiple versions (v1, v2, etc.) +- Status: 'concept' (editable) or 'gepubliceerd' (locked) +- UNIQUE constraint on (client_id, version) + +--- + +### 5. AI Events Table + +**Purpose:** Telemetry and debugging for AI API calls +**RLS Enabled:** β Yes +**Special:** Append-only (no UPDATE/DELETE for regular users) + +#### Policies: + +| Policy Name | Operation | Rule | +|------------|-----------|------| +| Authenticated users can view AI events | SELECT | `auth.uid() IS NOT NULL` | +| Authenticated users can create AI events | INSERT | `auth.uid() IS NOT NULL` | +| ~~UPDATE~~ | β | Not allowed (audit trail) | +| ~~DELETE~~ | β | Not allowed (audit trail) | + +**Immutability:** +- Regular users cannot modify or delete AI events +- Ensures audit trail integrity +- Service role can bypass RLS for admin cleanup + +--- + +## Testing RLS + +### Test 1: Verify RLS is Enabled + +```sql +SELECT tablename, rowsecurity as rls_enabled +FROM pg_tables +WHERE schemaname = 'public' +ORDER BY tablename; +``` + +**Expected Result:** +All 5 tables should show `rls_enabled: true` + +### Test 2: Check Policy Count + +```sql +SELECT + tablename, + COUNT(*) as policy_count, + STRING_AGG(cmd, ', ' ORDER BY cmd) as commands +FROM pg_policies +WHERE schemaname = 'public' +GROUP BY tablename; +``` + +**Expected Result:** +- `ai_events`: 2 policies (INSERT, SELECT) +- Other tables: 4 policies each (DELETE, INSERT, SELECT, UPDATE) + +### Test 3: Verify Authentication Check + +```sql +SELECT tablename, policyname, cmd, qual +FROM pg_policies +WHERE schemaname = 'public' + AND qual NOT LIKE '%auth.uid()%'; +``` + +**Expected Result:** +Empty (all policies use `auth.uid()` checks) + +--- + +## TypeScript Integration + +TypeScript types are auto-generated and available at `lib/database.types.ts`: + +```typescript +import type { Database } from '@/lib/database.types' + +// Usage with Supabase client +const supabase = createClient$1')
+}
+
diff --git a/lib/database.types.ts b/lib/database.types.ts
new file mode 100644
index 0000000..d77d871
--- /dev/null
+++ b/lib/database.types.ts
@@ -0,0 +1,365 @@
+export type Json =
+ | string
+ | number
+ | boolean
+ | null
+ | { [key: string]: Json | undefined }
+ | Json[]
+
+export type Database = {
+ // Allows to automatically instantiate createClient with right options
+ // instead of createClient