Phase 4 · Shipped
Platform Foundation
The technical foundation every future ApartmentOS module rests on. Secure by default, role-aware, and ready to scale to thousands of communities.
1 · Architecture
Modular, feature-based routing under
src/routes/. Shared UI kit in src/components/, brand primitives in src/components/brand/, domain modules under _authenticated/. Server logic via TanStack createServerFn. No business modules yet — only platform primitives.2 · Authentication
Email / password
Sign up, sign in, forgot & reset
Google
Managed OAuth via Lovable Cloud broker
Phone / OTP
Ready to enable (provider add-on)
Session
Auto-refresh, persistent, remember-me toggle
Sign out
Cancels queries → clears cache → clears session
3 · Role-Based Access Control
Roles stored in a dedicated user_roles table (never on profiles) with a security-definer has_role() helper to avoid RLS recursion.
super_admin
society_admin
secretary
committee_member
resident
security_guard
staff
vendor
4 · Organization Hierarchy
ApartmentOS
└── Societies
└── Buildings
└── Wings
└── Floors
└── Flats
└── Residents
5 · Database Foundation
societies
tenant root — name, slug, address, timezone
buildings / wings / flats
hierarchical, indexed, cascade-safe
profiles
mirrors auth.users, auto-created on signup
user_roles
RBAC bindings, scoped by society_id
flat_residents
user ↔ flat, ownership, move-in dates
invitations
token-based, 7-day expiry
society_settings
category/key/value JSONB
user_preferences
theme, language, notification channels
notifications
unified inbox for every future module
files
uploads metadata (bucket, path, purpose)
audit_logs
actor, action, entity, IP, user-agent
6 · Security
Row-Level Security on every table. Explicit GRANTs per role. SECURITY DEFINER helpers restricted to authenticated users. Bearer-token middleware on every server function. Passwords hashed by Supabase Auth (bcrypt). Input validated with Zod.
7 · Notifications, Files & Audit
Every future module writes to the same
notifications, files, and audit_logs tables — one inbox, one file catalog, one audit trail.8 · API & Performance
Server functions follow a single pattern:
createServerFn + requireSupabaseAuth + Zod inputValidator. Routes are code-split by the TanStack plugin. Data reads use TanStack Query. Fonts preconnected, assets lazy-loaded.9 · Next
Ready for Phase 5 — Society Setup: create societies, buildings, wings, and flats through the Secretary experience.