Session handoffSupabase Auth session, then product grant
Signing in only proves the browser session. The tenant summary still requires an AIRCITE product grant before customer-scoped aggregate counts can render.
AUTHBrowser session handoff
AIRCITE uses Supabase Auth to issue a customer bearer session. The app stores only the user access token in this browser and sends it to the protected tenant summary API.
Secret boundaryService-role keys and secret values are never stored in the browser
No secrets GATEWhat happens next
After the browser stores a Supabase user session, the app sends that bearer token to /api/aircite/tenant-summary. The server still checks product membership before returning aggregate counts.
Valid sessionSupabase Auth accepts the bearer token
RequiredAIRCITE grantbusiness_member_products or tenant_products enables access
RequiredTenant data shapeSanitized aggregate counts only
No PHI