AuthenlySign Developer Guide

+---------------------------------------------------+
|                    Frontend                        |
|   Next.js 16 App Router + React 19.2 RSC          |
+------------------------+--------------------------+
                         |
+------------------------+--------------------------+
|              Proxy (Edge Middleware)               |
|   WAF -> Rate Limiter -> Supabase Session Refresh |
+--------+----------+-----------+-------------------+
         |          |           |
  +------+---+ +---+-----+ +--+------------+
  | Supabase | | Stripe  | | Vercel Blob   |
  | Postgres | | Payments| | File Storage  |
  | + Auth   | |         | |               |
  +----------+ +---------+ +---------------+
         |
  +------+--------+
  | Upstash Redis |
  | Rate Limiting |
  | + Caching     |
  +---------------+

git clone https://github.com/your-org/authenlysign.git
cd authenlysign
pnpm install

# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key
SUPABASE_SERVICE_ROLE_KEY=your_service_role_key

# App
NEXT_PUBLIC_SITE_URL=http://localhost:3000

# Stripe
STRIPE_SECRET_KEY=sk_test_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...

# Vercel Blob
BLOB_READ_WRITE_TOKEN=vercel_blob_...

# Email
RESEND_API_KEY=re_...

# Security
CRON_SECRET=random_secret_for_cron_jobs

pnpm dev

authenlysign/
+-- app/                          # Next.js App Router (104 pages)
|   +-- api/                     # API route handlers (159 routes)
|   |   +-- admin/               # Admin-only endpoints
|   |   +-- auth/                # Authentication endpoints
|   |   +-- documents/           # Document CRUD + signing
|   |   +-- cron/                # Scheduled jobs
|   |   +-- health/              # Health check endpoints
|   |   +-- security/            # Security monitoring
|   |   +-- webhooks/            # Webhook handlers
|   +-- auth/                    # Auth pages (signin, signup, verify, etc.)
|   +-- dashboard/               # Protected dashboard pages
|   |   +-- admin/               # Admin panels
|   |   +-- documents/           # Document management
|   |   +-- templates/           # Template management
|   |   +-- settings/            # User and org settings
|   +-- sign/[documentId]/       # Public signing ceremony
|   +-- layout.tsx               # Root layout with fonts + metadata
|   +-- page.tsx                 # Landing page
+-- components/                   # React components (120 files)
|   +-- ui/                      # shadcn/ui primitives
+-- lib/                          # Server utilities (106 modules)
|   +-- supabase/                # Supabase client/server/proxy/admin
|   +-- api-auth.ts              # requireAuth / requireAdmin guards
|   +-- input-sanitizer.ts       # SQL/XSS/CMD/Path injection detection
|   +-- compliance-logger.ts     # Hash-chained audit trail
|   +-- waf.tsx                  # Web Application Firewall engine
|   +-- pki-manager.ts           # PKI digital signatures
|   +-- webhook*.ts              # Webhook delivery and retry
+-- hooks/                        # React hooks (use-auth, use-mobile, etc.)
+-- scripts/                      # SQL migrations (82+ files)
+-- docs/                         # Additional documentation
+-- proxy.ts                      # Edge middleware (WAF + rate limit + auth)
+-- next.config.mjs               # Next.js config with security headers

auth.users (Supabase Auth)
  |-- user_profiles (1:1, auto-created via trigger)
  |-- documents (1:many)
  |     |-- document_signers (1:many)
  |     |-- document_fields (1:many)
  |     |-- document_field_data (1:many)
  |     |-- audit_logs (1:many)
  |-- organizations (many:many via org_members)

-- Users can only access their own data
CREATE POLICY "users_own_data" ON documents
  FOR ALL USING (auth.uid() = user_id);

-- Signers can access documents they are assigned to
CREATE POLICY "signers_access" ON documents
  FOR SELECT USING (
    id IN (SELECT document_id FROM document_signers WHERE signer_email = auth.email())
  );

{
  "error": "DOCUMENT_NOT_FOUND",
  "message": "Document not found or access denied",
  "details": { "documentId": "..." }
}

// Browser client (singleton)
import { createClient } from "@/lib/supabase/client"
const supabase = createClient()

// Server client (per-request)
import { createServerSupabaseClient } from "@/lib/supabase/server"
const supabase = await createServerSupabaseClient()

// Service role client (admin operations, bypasses RLS)
import { createServiceRoleClient } from "@/lib/supabase/server"
const supabase = createServiceRoleClient()

import { requireAuth, requireAdmin, isAuthError } from "@/lib/api-auth"

// Require authenticated user
export async function GET() {
  const auth = await requireAuth()
  if (isAuthError(auth)) return auth
  // auth.user and auth.supabase are available
}

// Require admin role
export async function POST() {
  const auth = await requireAdmin()
  if (isAuthError(auth)) return auth
  // Only admins reach here
}

{
  "id": "evt_abc123",
  "type": "document.completed",
  "created": 1709251200,
  "data": {
    "id": "doc_abc123",
    "title": "NDA Agreement",
    "status": "signed",
    "completedAt": "2026-02-19T12:00:00Z"
  }
}

import crypto from "crypto"

function verifyWebhook(payload: string, signature: string, secret: string): boolean {
  const expected = crypto.createHmac("sha256", secret).update(payload).digest("hex")
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(\`sha256=\${expected}\`))
}

import { validateInput, validateRequestBody } from "@/lib/input-sanitizer"

const result = validateInput(userInput)
if (!result.safe) {
  // result.threats contains ["sql_injection", "xss", etc.]
}

const bodyResult = validateRequestBody(requestBody)  // Recursive check of all values

import { logComplianceEvent } from "@/lib/compliance-logger"

await logComplianceEvent({
  documentId: "...",
  action: "document_signed",
  eventType: "document_signed",
  actorEmail: "signer@example.com",
  actorIpAddress: ip,
  details: { certificate_id: "...", document_hash: "..." },
})

curl https://your-app.vercel.app/api/health
curl https://your-app.vercel.app/api/health/database
curl https://your-app.vercel.app/api/health/security  # Requires admin auth

# Check overall health
curl https://your-app.vercel.app/api/health

# Check production readiness
curl https://your-app.vercel.app/api/health/production

# Check security posture (requires admin cookie)
curl -H "Cookie: ..." https://your-app.vercel.app/api/health/security