FFH Sign-Up & Login — Proposed Flow + Test Plan

1 The model: one door, one identity

The whole system rests on three simple rules.

One login screen. /login is the ONLY place anyone signs in or creates an account (email + password or magic link). Home-page "Login" and "Join Free" both point here.

The Gate steps out of the way. /gate stops being a sign-in step. It becomes only two things: the bouncer that catches a signed-out visitor who deep-links a locked page (and sends them to /login), and the VIP-code door for invited guests. A signed-in member never sees it. This is what kills the "sign in twice" wall you hit.

One source of truth for who you are. Your Supabase profiles.role field. One value per user. Everything — where you land, what you can open — reads from that single field.

2 The six roles → what the database calls them → where they land

Five of your six already exist in Supabase. Only Advisor is new.

Role	DB value (profiles.role)	How they get it	Lands on
Basic Free User	member	Self-serve free sign-up (default for everyone)	Member Home — /network-overview/
Ambassador	ambassador	Stripe $49/yr · invite code · admin grant	Ambassador Home — /for-ambassadors/ + Share-It kit
Group Leader	group_leader	Stripe $99/yr · invite code · admin grant	Group dashboard — /for-community-leaders/
Regional Chamber Director	director	Estimate → contract · invite code · admin grant	Director Console — /chamber-director-console/ (region, CRM pre-loaded)
State Chamber Director	state_director	Estimate → contract · invite code · admin grant	Director Console — state rollup view of the regions under them
Advisor	advisor (NEW)	Admin invite only — not self-serve	Advisory library — /leadership-and-advisory/
Super Admin (you + Dr. Rob)	super_admin	Permanent allowlist	Demo Dashboard w/ role switcher — /demo-dashboard/
Reviewer / VIP guest	reviewer	VIP code at the Gate	Network overview (coach experience)

Regional vs State: both use the same Console page; the difference is scope — a State Director sees the regional directors beneath them. (Your DB also has community_director, school_district, and healthcare_workforce tiers already defined — room to grow without schema changes.)

3 The flow, start to finish

What a person actually experiences, in order.

Arrive

Home "Join Free" / "Login" — or a locked page bounces a signed-out visitor. Every path lands on /login, carrying ?next= if they were headed somewhere specific.

Authenticate

New user → Create Account (password or magic link) → Supabase creates the user + a profiles row defaulting to role = member. Returning user → Sign in.

First-timer? → Activation Journey

If the profile has no first name yet, route to /activation-journey/ — welcome → personalize-or-skip → "for myself vs as a leader" fork → optional plan. Finishing sets their name and (if they chose/paid) their tier.

Role router — the fix

Once authenticated with a completed profile, /login reads profiles.role and sends them straight to that role's home using one shared map. No detour through the Gate. This is the single change that makes it "butter smooth."

Upgrades

A free member becomes a paid role three ways: pays via Stripe (activation-journey plan step), redeems an invite code (redeem_invite_code RPC via /redeem/), or a Super Admin grants it. Next load, they're routed and gated as the new tier.

Every page enforces

role-gate.js reads profiles.role and: lets any signed-in role onto normal pages; restricts Director / State / Advisor consoles to those tiers (+ admin); keeps Super-Admin pages admin-only. You and Dr. Rob are allowlisted everywhere.

4 What must be wired to make this real

The honest punch list. Do G1–G4 and users can sign up and log in as every role today (via invite codes). G5 makes paid self-serve automatic.

/login role router

After a successful sign-in, route by profiles.role instead of bouncing to the Gate. Also fixes the double-gate you're hitting now.

Teach role-gate.js the paid tiers

Right now ambassador / group_leader / director / state_director would be wrongly blocked on normal member pages — the gate only recognizes member/reviewer/super_admin. Add the five tiers + a rank so higher tiers inherit lower access. This is a live bug, not just a nicety.

Add the Advisor tier

One SQL line to add advisor to the invite-codes check + a code, and confirm Regional = director, State = state_director.

One shared role → home map

A single tiny file both /login and /gate read, so landing destinations never drift apart again.

Stripe products + webhook

Ambassador $49 / Group Leader $99 / Director estimate. Webhook sets profiles.role on payment. Until wired, invite codes mint every role — so testing doesn't wait on Stripe.

5 The test — role by role, runnable today

Because Stripe isn't wired yet, mint each role with an invite code, then confirm it lands in the right home and can/can't open the right pages.

Setup (once): In Supabase → SQL Editor, confirm the invite-codes migration is applied and add the Advisor code. Existing codes: FFH-AMBASSADOR-2026, FFH-GROUP-2026, FFH-DIRECTOR-2026, FFH-STATE-DIR-2026, FFH-VIP-2026. Add: FFH-ADVISOR-2026 → advisor.

Reset between tests: visit /gate/?reset=1 and sign out of Supabase so each role starts clean.

Test progress: 0% (0/0)

1 · Basic Free User tap to open ▾

Provision: Create a brand-new account at /login. No code. Expected landing: Activation Journey (first-timer) → then Member Home /network-overview/.

Create account at /login with a fresh email + password. → profiles.role = member First sign-in routes to Activation Journey, not the Gate. After finishing (or "fast sign-up"), lands on Member Home. Can open a normal member page (courses, trackers) with no gate wall. Opening /chamber-director-console/ shows the restricted overlay (not allowed).

2 · Ambassador tap to open ▾

Provision: Sign in as a member → redeem FFH-AMBASSADOR-2026 at /redeem/. Expected landing on next login: Ambassador Home.

Redeem code succeeds — message "Welcome aboard." → role = ambassador Sign out, sign back in → lands on /for-ambassadors/ (Ambassador home). Can open member pages AND the Ambassador Share-It kit — no wall. /chamber-director-console/ still blocked.

3 · Group Leader tap to open ▾

Provision: Redeem FFH-GROUP-2026. Expected: Group Leader dashboard.

Redeem succeeds → role = group_leader Next login lands on /for-community-leaders/ group dashboard. Can open/manage their group; member pages open freely. Director console blocked.

4 · Regional Chamber Director tap to open ▾

Provision: Redeem FFH-DIRECTOR-2026. Expected: Director Console, CRM pre-loaded.

Redeem succeeds → role = director Next login lands on /chamber-director-console/ — no wall. CRM shows their pre-populated targets; all lower pages open. Super-Admin page (/super-admin/) is blocked.

5 · State Chamber Director tap to open ▾

Provision: Redeem FFH-STATE-DIR-2026. Expected: Director Console, state rollup.

Redeem succeeds → role = state_director Next login lands on the Director Console with the state view. Can see regions/directors beneath them; all lower pages open. Super-Admin page blocked.

6 · Advisor tap to open ▾

Provision: Redeem FFH-ADVISOR-2026 (after G3 adds the tier). Expected: Advisory library.

Advisor tier exists in DB + code redeems → role = advisor Next login lands on /leadership-and-advisory/. Can open the advisory / authors library and leave feedback. Director console + Super-Admin pages blocked (advisor is advise-only).

7 · Super Admin (you) tap to open ▾

Provision: Sign in as lucy@theforceforhealth.com. Expected: Demo Dashboard, everything unlocked.

Sign in at /login → lands directly on /demo-dashboard/ — no second gate. Role switcher lets you preview every role's home. Every page opens — Director console, Super-Admin, all of it.

Tip: run tests in an incognito window so sessions don't bleed together. A failed row is a to-do, not a dead end — send me the row and I'll fix it.