AD-05 Super Admin Sign-in & MFA Gate | Admin App Specification

Super Admin Sign-in & Authentication Flow

Click to Zoom Fullscreen

graph LR
    SignInPage[AD-05 Sign-in Screen] --> ChooseProvider{Select Provider: Google / Azure / Apple}
    ChooseProvider --> OAuthRedirect[Supabase OAuth Redirect]
    OAuthRedirect --> Callback[/callback Endpoint]
    Callback --> WhitelistCheck{Email in super_admins Table?}
    WhitelistCheck -->|Yes| Dashboard[Redirect to /dashboard]
    WhitelistCheck -->|No| RedirectError[Redirect to /signin?error=unauthorized]

Authentication Subsystems & Routes

• admin/src/app/signin/page.tsx (Sign-in Page Component)
• admin/src/app/callback/route.ts (OAuth Session Exchange Handler)
• NEXT_PUBLIC_ENABLED_OAUTH_PROVIDERS (Comma-delimited Provider Config)

Super Admin Authentication Guardrails

Strict Database Whitelisting: Authentication alone is insufficient. Users must have an active record matching their email in the super_admins table or session issuance is aborted.

sequenceDiagram
    autonumber
    actor User as Admin Operator
    participant UI as SignInContent Component
    participant Provider as OAuth Provider (Google/Azure/Apple)
    participant Callback as /callback Route Handler
    participant DB as Supabase DB (super_admins)

    User->>UI: Click 'Continue with Google/Azure/Apple'
    UI->>Provider: Redirect to OAuth Consent Prompt
    Provider-->>Callback: Return Auth Code to /callback
    Callback->>DB: Query super_admins WHERE email = user.email
    DB-->>Callback: Return Whitelist Record
    Callback-->>User: Issue Session Token & Redirect to /dashboard

Component	Codebase Path / Token
SignInContent Container	admin/src/app/signin/page.tsx (Line 24)
ProviderIcon Renderer	admin/src/app/signin/page.tsx (Line 139)
Error Message Switcher	admin/src/app/signin/page.tsx (Line 28)

Super Admin Sign-in & MFA Gate

Page Visual Switcher

Super Admin Sign-in & Authentication Flow

AD-05 Super Admin Sign-in & MFA Wireflow