[Programcode]

Summary

• keep Google as the primary sign-in and add six-digit email OTP plus demo-code sign-in
• add admin create, list, disable, and reset controls for redacted demo codes
• bind reusable demo accounts through server-controlled Auth app metadata
• reject spoofed metadata, unrelated Auth accounts, and bound admin or banned accounts before consuming a use
• make demo-code attempt-store failures fail closed

Verification

• ./.superset/db-gate.sh: 27 pgTAP tests passed; local stack stopped
• npm run verify: 976 Vitest tests, 137 Edge tests, production build, and 134 desktop/mobile Chromium tests passed
• coverage: 90.2% statements, 82.34% branches, 91.86% functions, 94.12% lines
• focused handler regression: spoofed user metadata rejected, matching app metadata accepted, unrelated account unchanged, new account bound in app metadata

Environment boundary

Protected staging was not run because the required staging URL, anon key, and dedicated demo code are not available in this checkout. Production credentials were not substituted.

Summary by CodeRabbit

• New Features
  • Added email one-time-passcode and administrator-issued demo-code sign-in options alongside Google sign-in.
  • Added OTP verification, resend, validation, focus management, and clearer authentication status messages.
  • Added administrator tools to create, copy, disable, and reset demo access codes, with usage limits and expiration details.
  • Improved demo-code security with rate limiting, expiration, usage controls, and account protection.
• Documentation
  • Updated authentication, privacy, terms, and administration guidance for email and demo-code access.
• Tests
  • Added comprehensive coverage for authentication flows and demo-code administration.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 7, 2026 1:31pm UTC

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 3143b4c0-2fb2-49d8-92d1-ea9e4af63423

📥 Commits

Reviewing files that changed from the base of the PR and between 0e940ed and cbf7225.

⛔ Files ignored due to path filters (1)

• .audit/auth-email-and-demo-code-sign-in.tsv is excluded by !**/*.tsv

📒 Files selected for processing (21)

• docs/architecture.md
• e2e/login.spec.ts
• package.json
• src/lib/supabase/AuthProvider.tsx
• src/locales/en.json
• src/locales/es.json
• src/locales/hu.json
• src/pages/AdminPage.tsx
• src/pages/LoginPage.tsx
• src/test/auth/AuthProvider.behavior.test.tsx
• src/test/auth/LoginPage.test.tsx
• src/test/pages/AdminPage.test.tsx
• supabase/README.md
• supabase/functions/_shared/demo-code.test.ts
• supabase/functions/_shared/demo-code.ts
• supabase/functions/admin/demo-code-contract.test.ts
• supabase/functions/admin/index.ts
• supabase/functions/demo-code-login/index.ts
• supabase/functions/demo-code-login/index_test.ts
• supabase/migrations/20260902000000_demo_access_admin_controls.sql
• supabase/tests/demo_access_codes_rls_test.sql

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Demo authentication and access management

Layer / File(s)	Summary
Demo-code policy and reservation controls supabase/functions/_shared/*, supabase/migrations/*, supabase/tests/*, docs/architecture.md, supabase/README.md	Adds shared validation, hashing, role, denial, and rate-limit rules. Restricts database access and reserves code usage atomically through service-role operations.
Administrator demo-code management supabase/functions/admin/*	Adds listing, creation, disabling, and usage-reset operations with validation, hashing, collision handling, and controlled raw-code disclosure.
Demo-code login function supabase/functions/demo-code-login/*, package.json	Adds shared helper usage, fail-closed rate limiting, account binding through app_metadata, existing-user checks, and exported request handling.
Email OTP and demo-code authentication UI src/lib/supabase/AuthProvider.tsx, src/pages/LoginPage.tsx, src/locales/*, src/test/auth/*, e2e/login.spec.ts	Adds email OTP and demo-code sign-in flows, handoff verification, validation, resend behavior, localized messages, and browser coverage.
Admin demo access panel src/pages/AdminPage.tsx, src/test/pages/AdminPage.test.tsx	Adds the Demo Access tab and workflows for creating, copying, disabling, and resetting demo codes.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant LoginPage
  participant AuthProvider
  participant demo-code-login
  participant Supabase Auth
  LoginPage->>AuthProvider: submit demo code
  AuthProvider->>demo-code-login: invoke code and browser fingerprint
  demo-code-login->>Supabase Auth: create or locate demo user
  demo-code-login-->>AuthProvider: magic-link token hash
  AuthProvider->>Supabase Auth: verify token hash
  Supabase Auth-->>LoginPage: authenticated session

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}