- Adds Next.js route src/app/api/create-user/route.ts for secure creation (JWT validation, password generation).
- Adds client fallback in lib/api.ts: signup via /auth/v1/signup then call create-user Edge Function.
- Wires CredentialsDialog into registration forms and maps RLS errors to a user-friendly message.
- Removes banner from pp/paciente/page.tsx.
NOTE: Not fully resolved — requires SUPABASE_SERVICE_ROLE_KEY on server and/or RLS policy changes; server route needs Next.js restart.
- What was done:
- Added a server-side Next.js route at `src/app/api/create-user/route.ts` that validates the requester token, checks roles, generates a temporary password and forwards the creation to the Supabase Edge Function using the service role key.
- Client wired to call the route via `lib/config.ts` (`FUNCTIONS_ENDPOINTS.CREATE_USER` -> `/api/create-user`) and the `criarUsuario()` wrapper in `lib/api.ts`.
- Status / missing work:
- Important: user creation is NOT working yet (requests to `/api/create-user` return 404 in dev).
- Next steps: restart dev server, ensure `SUPABASE_SERVICE_ROLE_KEY` is set in the environment, check server logs and run a test POST with a valid admin JWT.
- Persist `roles` array in localStorage on login and session restore.
- Reconcile `userType` from roles returned by the `user-info` function.
- `ProtectedRoute` now accepts `requiredUserType?: UserType[]` and `requiredRoles?: string[]` and evaluates multi-role permission (OR semantics).
- Minor adjustments in `useAuth` and debug logs to ensure consistent `profile` and `roles` restoration.
- Main files changed: `hooks/useAuth.tsx`, `components/ProtectedRoute.tsx`, `types/auth.ts.
- Removido fallback Direct Auth no frontend
- Removida tentativa de atribuir role no cliente
- Mensagens de erro aprimoradas para 'failed to assign user role' e email duplicado
- Atualizados formulários de médico e paciente para instruções claras
Implements automatic creation in Supabase Auth with mandatory
email confirmation. Adds credentials popup and clear messages
about the confirmation process.
BREAKING CHANGE: Users must confirm email before login
