Sign-in and session handling

What this feature does

Supabase-backed sessions authenticate browser requests while application roles and statuses authorize each Mallello surface.

This guide describes the behavior implemented by Mallello, the people allowed to use it, and the operational checks that keep it dependable.

Detailed workflow

1. The user submits credentials to the sign-in route.
2. Supabase validates them and writes secure session cookies.
3. The session provider loads the current application profile.
4. Navigation and protected pages route the user to the correct dashboard.
5. Sign-out revokes the browser session and clears local account state.

Rules and permissions

• Authentication proves identity; role, status, ownership, and MFA determine authorization.
• Server routes validate sessions independently of hidden buttons.
• Cookies use secure production settings and are not accessible to ordinary client JavaScript where possible.
• Suspended or inactive profiles lose protected access even if a provider session exists.

Failure handling and edge cases

• A 401 from /api/auth/me is normal before login but not after a valid callback.
• Stale cookies may require a clean sign-out before reauthentication.
• Role changes should invalidate or refresh cached session data.