Follow this link to reset your password:
- -If you didn't request this, you can safely ignore this email.
- ``` - -4. **Verify Site URL** - - Go to **Authentication > URL Configuration** - - Ensure your **Site URL** is correct: `https://yourdomain.com` or `http://localhost:3000` for development - - Add redirect URLs: - - `https://yourdomain.com/reset-password` - - `https://yourdomain.com/setup-password` - - `https://yourdomain.com/api/auth/callback` - ---- - -### Step 2: Run Database Migration - -```bash -# Option 1: Using Supabase CLI (Recommended) -npx supabase migration up - -# Option 2: Manual execution in Supabase Dashboard -# Copy the contents of supabase/migrations/add_password_support.sql -# and run it in the SQL Editor -``` - -**What this does**: -- Adds `password_setup_completed` column to `applicants` table -- Creates index for better query performance -- Sets default values for existing users (FALSE for Magic Link users) - -**Verify migration**: -```sql --- Run this in SQL Editor to verify -SELECT column_name, data_type, column_default -FROM information_schema.columns -WHERE table_name = 'applicants' - AND column_name = 'password_setup_completed'; -``` - ---- - -### Step 3: Deploy Code Changes - -```bash -# 1. Commit all changes -git add . -git commit -m "feat: Add password-based authentication with Magic Link fallback" - -# 2. Deploy to production (adjust based on your hosting) -npm run build # For Next.js build -npm run deploy # Or your deployment command - -# For Vercel: -vercel --prod - -# For other hosts, follow your standard deployment process -``` - ---- - -### Step 4: Test Authentication Flows - -#### Test 1: New User Signup (Password) -1. Go to `/signup` -2. Enter email and create a password -3. Should be redirected to `/apply` -4. Verify account created in Supabase Dashboard (Authentication > Users) - -#### Test 2: New User Login (Password) -1. Go to `/login` -2. Select "Password" tab -3. Enter email and password -4. Should be redirected to `/dashboard` - -#### Test 3: Existing User (Magic Link Still Works) -1. Go to `/login` -2. Select "Magic Link" tab -3. Enter existing user's email -4. Check email for magic link -5. Click link → should be redirected to dashboard - -#### Test 4: Password Reset Flow -1. Go to `/login` -2. Select "Password" tab -3. Click "Forgot password?" -4. Enter email -5. Check email for reset link -6. Click link → redirected to `/reset-password` -7. Enter new password -8. Should be redirected to `/login` with success message - -#### Test 5: Existing User Sets Up Password -1. Existing Magic Link user logs in via Magic Link -2. After login, they can visit `/setup-password` -3. Create a password -4. Future logins can use either method - ---- - -## Edge Cases Handled - -### 1. ✅ Existing Users Without Passwords -- **Detection**: Check `password_setup_completed` column -- **Handling**: Users can continue using Magic Link or set up password via `/setup-password` -- **UI**: Login page shows both options - -### 2. ✅ User Tries Password Login But Has No Password -- **Error Message**: "Invalid email or password. If you signed up with Magic Link, please use that option or set up a password first." -- **Solution**: User switches to Magic Link tab or visits `/setup-password` - -### 3. ✅ Admin Users -- **Impact**: None - admin check remains email-based -- **Verification**: `ADMIN_EMAILS` environment variable still works -- **Both Auth Methods**: Admins can use password or Magic Link - -### 4. ✅ RLS Policies -- **Impact**: None - `auth.uid()` works the same for both methods -- **Verification**: Existing policies continue to work -- **Testing**: Verify users can only see their own data - -### 5. ✅ In-Flight Magic Links -- **Impact**: None - Magic Links sent before migration still work -- **Reason**: Both auth methods work simultaneously - -### 6. ✅ Session Management -- **Impact**: None - Supabase handles both methods uniformly -- **Sessions**: Same structure for password and Magic Link users - -### 7. ✅ Email Enumeration Protection -- **Forgot Password**: Always returns success (doesn't reveal if email exists) -- **Security**: Prevents attackers from discovering valid email addresses - -### 8. ✅ Password Strength Validation -- **Requirements**: - - Minimum 8 characters - - At least one uppercase letter - - At least one lowercase letter - - At least one number - - At least one special character -- **UI**: Real-time strength indicator (Weak/Medium/Strong) - ---- - -## Environment Variables - -No new environment variables needed! Existing variables continue to work: - -```env -# Existing - no changes needed -NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co -NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key -NEXT_PUBLIC_SITE_URL=https://yourdomain.com -ADMIN_EMAILS=admin1@example.com,admin2@example.com -``` - ---- - -## User Experience Flows - -### New User Journey -``` -1. Visit /signup -2. Enter email + create password -3. Account created instantly (or confirm email if enabled) -4. Redirected to /apply -5. Complete application -6. Access /dashboard -``` - -### Existing User Journey (Magic Link → Password) -``` -Option A (Continue with Magic Link): -1. Visit /login -2. Select "Magic Link" tab -3. Enter email -4. Check email → click link -5. Logged in to /dashboard - -Option B (Migrate to Password): -1. Visit /login -2. Select "Magic Link" tab -3. Log in via email link -4. Visit /setup-password -5. Create password -6. Future logins: use password for instant access -``` - -### Password Reset Journey -``` -1. Visit /login -2. Click "Forgot password?" -3. Enter email -4. Check email → click reset link -5. Redirected to /reset-password -6. Enter new password -7. Password updated → redirected to /login -8. Sign in with new password -``` - ---- - -## Security Considerations - -### Password Storage -- ✅ **Never stored in plain text** -- ✅ **Hashed by Supabase Auth** using bcrypt -- ✅ **Secure by default** - no custom password handling needed - -### Password Requirements -- ✅ **Minimum 8 characters** -- ✅ **Complexity requirements** enforced via validation utility -- ✅ **Real-time feedback** for users during password creation - -### Email Enumeration Protection -- ✅ **Forgot password** always returns success (doesn't reveal if email exists) -- ✅ **Signup** returns generic error if email taken - -### Session Security -- ✅ **HTTPOnly cookies** set by Supabase (not accessible via JavaScript) -- ✅ **Secure flag** in production (HTTPS only) -- ✅ **SameSite** protection against CSRF - -### Rate Limiting -- ✅ **Supabase built-in** rate limiting on auth endpoints -- ✅ **Prevents brute force** attacks on password login - ---- - -## Admin Users - -**No changes to admin authentication**: -- Admins identified by `ADMIN_EMAILS` environment variable -- Admin can use **either** password or Magic Link -- Admin routes protected at middleware level -- RLS policies unchanged (application-layer enforcement) - -**To add a new admin**: -```env -# Add email to ADMIN_EMAILS in .env.local (or production env) -ADMIN_EMAILS=admin1@example.com,admin2@example.com,newadmin@example.com -``` - ---- - -## Rollback Plan - -If you need to rollback this migration: - -### Option 1: Revert Code Only (Keep Database Changes) -```bash -git revertManage RocketHacks 2026 applications
++ Manage RocketHacks 2026 applications +
| Name | School | Major | -Age | +RSVP | Status | Submitted | Actions | @@ -312,16 +359,31 @@ export default function AdminPage() {
|---|---|---|---|---|---|---|---|
|
- {app.first_name} {app.last_name}
+
+ {app.first_name} {app.last_name}
+
{app.email}
|
{app.school} | -{app.major || '-'} | -{app.age || '-'} | ++ {app.major || "-"} + | - + + {!!app.rsvp_attending ? "Yes" : "No"} + + | ++ {app.status} | @@ -352,20 +414,32 @@ export default function AdminPage() { {/* Application Detail Modal */} {selectedApp && ( -