# AccessLens hosted private beta — authentication integration

## Included
- Invite-only Supabase email/password sign-in, reset-password page, sign-out via `accesslensLogout()`.
- Candidate profile CRUD through `candidate_profiles` with RLS.
- Application queue CRUD through `saved_jobs` with RLS; jobs page enqueues there.
- Python `/api/*` routes reject missing/invalid bearer tokens by verifying against Supabase Auth `/auth/v1/user`.
- Browser automation stays disabled.

## Configure
1. In `supabase-config.js`, set the public **Project URL** and **publishable key**. Never insert secret/service-role credentials.
2. Set backend environment variables `SUPABASE_URL` and `SUPABASE_PUBLISHABLE_KEY` to those same public values. Set existing JSearch/OpenAI keys only on the backend.
3. In Supabase Authentication → URL Configuration, set Site URL and allowlist the final `https://jobs.accesslens.in` domain plus `https://jobs.accesslens.in/reset-password.html` for password recovery. For local tests add `http://127.0.0.1:8780/reset-password.html` to redirect URLs.
4. An invited user must set a password using the Supabase invitation flow before normal sign-in. Supabase's default invite redirect may require a dedicated invite acceptance page: configure an email template redirect to `reset-password.html` and test end-to-end; do not assume the default template works.
5. Run `python3 server.py`, then open `http://127.0.0.1:8780/login.html`.

## Important limitations / release blockers
- **Not deploy-ready**: existing job-search UI also uses browser localStorage for search filters, cached job selections, and some workflow data. These are not yet fully migrated or user-isolated. Clear browser storage when switching beta accounts until migrated.
- `ai.html` and `jobs.html` retain localStorage workflow state; backend APIs authenticate but do not yet implement rate limits or quotas. Do not publicly expose until reviewed.
- The `reset-password.html` flow and invited-user acceptance must be browser-tested with your project email template.
- Supabase schema's RLS policies must be tested with two distinct real users. Service-role keys bypass RLS; never put them in frontend.
- Resume uploads are parsed transiently; private Supabase Storage is not yet integrated.
- `auth.js` uses a CDN for Supabase JS. For production pin/vendor dependency, use CSP, and audit supply chain.
- For deployment use a production WSGI/ASGI server or reverse proxy; this prototype Python `http.server` is not production-ready.
- No auto-submit; manual employer links only.