Mvp overhaul

[Taleef7]

Changes
This pull request introduces several improvements and refactors to the admin analytics dashboard and related backend logic. The main focus is enhancing platform health visibility, especially around package renewals, and improving code maintainability and UI consistency.

Admin Analytics Dashboard Enhancements:

• Added a "Renewals Due" section to the analytics dashboard, showing students with packages expiring in the next 5 days, including session counts and expiry dates. This uses the new getExpiringPackages service and joins user profile data for display. [1] [2]
• Changed the calculation of "active students" to count unique users with active requests, providing a more accurate metric. [1] [2]

UI and Styling Updates:

• Updated dashboard headings, cards, and sections to use a consistent color palette and bolder typography for improved readability and visual hierarchy. [1] [2] [3]

Backend and Auth Refactor:

• Refactored admin action authentication by importing and using the shared requireAdmin function from lib/auth/requireAdmin, removing the local duplicate implementation and unused sign-out code. [1] [2] [3]

Documentation and Environment Setup:

• Added a comprehensive CLAUDE.md file detailing repository tooling, workflows, coding standards, DB migration discipline, and architectural conventions for onboarding and automation.
• Updated .env.example to include new environment variables for bank details, Sentry, and cron secrets, clarifying required fields for deployment and local development.

[Copilot]

Pull request overview

This PR overhauls the MVP admin + user dashboards by adding renewal/health visibility, tightening auth/route protection, and standardizing the UI component system (Bauhaus styling + shadcn-style primitives), alongside new backend utilities (rate limiting, cron expiry, typed Supabase clients) and expanded E2E/unit tests.

Changes:

• Adds platform health/admin tooling: package expiry cron + renewal lookups, new admin subjects management, pagination, and richer admin dashboard counts.
• Strengthens auth/security: shared requireAdmin, role-based middleware + email verification redirect, API route rate limiting, and security headers.
• Refactors UI: introduces reusable UI primitives (button/card/table/etc.), consistent styling, toasts/tooltips, plus loading/error/not-found pages and E2E coverage.

Reviewed changes

Copilot reviewed 143 out of 163 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
next.config.ts	Adds global security headers for all routes
middleware.ts	Adds role enforcement + email verification checks in middleware
lib/validators/request.ts	Updates request validation for structured availability windows + package tier
lib/validators/payment.ts	Adds zod schemas for payment-related server actions
lib/utils/session.ts	Updates session status labels/colors + formatting utilities
lib/utils/request.ts	Adds availability formatting helper and refines status styling constants
lib/utils.ts	Adds cn() Tailwind utility (clsx + tailwind-merge)
lib/supabase/server.ts	Adds typed server Supabase client + safer cookie writes
lib/supabase/client.ts	Adds typed browser Supabase client
lib/supabase/admin.ts	Adds typed service-role Supabase admin client
lib/services/whatsapp.ts	Adds WhatsApp helpers + PK phone normalization
lib/services/requests.ts	Adds request status transition helper + admin request fetch
lib/services/payments.ts	Adds package expiry cron logic + expiring package query
lib/services/tests/scheduling.test.ts	Adds vitest coverage for session generation logic
lib/rate-limit.ts	Adds in-memory rate limiter utility
lib/config/timezones.ts	Adds centralized IANA timezone options
lib/config/pricing.ts	Pulls payment instruction bank details from env
lib/auth/requireAdmin.ts	Introduces shared admin guard for server actions
lib/tests/rate-limit.test.ts	Adds vitest coverage for rate limiter
e2e/utils.spec.ts	Adds Playwright tests for utility formatting functions
e2e/responsive.spec.ts	Adds basic mobile responsiveness checks
e2e/request-form.spec.ts	Adds redirect checks for protected request/admin routes
e2e/protected-routes.spec.ts	Adds protected-route redirect coverage
e2e/policies.spec.ts	Adds policies page rendering assertions
e2e/not-found.spec.ts	Adds 404 page assertions
e2e/landing.spec.ts	Adds landing page smoke coverage
e2e/dashboard-features.spec.ts	Adds dashboard route redirect coverage
e2e/auth.spec.ts	Adds auth page smoke checks
e2e/accessibility.spec.ts	Adds basic a11y checks (alt text, labels, focus)
components/ui/tooltip.tsx	Adds Tooltip primitive wrapper
components/ui/tabs.tsx	Adds Tabs primitive wrapper
components/ui/table.tsx	Adds Table component wrappers
components/ui/sonner.tsx	Adds global toast Toaster configuration
components/ui/skeleton.tsx	Adds Skeleton component
components/ui/separator.tsx	Adds Separator primitive wrapper
components/ui/pagination.tsx	Adds Pagination components
components/ui/label.tsx	Adds Label primitive wrapper
components/ui/input.tsx	Adds Input component styling
components/ui/form.tsx	Adds react-hook-form helpers + accessible field wiring
components/ui/dialog.tsx	Adds Dialog primitive wrapper
components/ui/card.tsx	Adds Card components
components/ui/button.tsx	Adds Button component + variants
components/ui/badge.tsx	Adds Badge component + variants
components/ui/alert-dialog.tsx	Adds AlertDialog primitive wrapper
components/dashboards/StatusBanner.tsx	Adds request status banner helper + component
components/dashboards/SessionCompleteForm.tsx	Adds toasts + restyles tutor session completion form
components/dashboards/RescheduleButton.tsx	Restyles WhatsApp reschedule CTA
components/dashboards/OnboardingChecklist.tsx	Adds onboarding checklist component
components/dashboards/NextSessionCard.tsx	Restyles next-session card + improves link a11y
components/WhatsAppLink.tsx	Restyles WhatsApp link component
components/WhatsAppCTA.tsx	Restyles WhatsApp CTA
components/WeeklyAvailabilityPicker.tsx	Adds interactive weekly availability picker
components/CopyMessageButton.tsx	Restyles copy/open WhatsApp buttons
components/AdminPagination.tsx	Adds pagination component for admin lists
components.json	Adds shadcn/ui config metadata
app/tutor/sessions/page.tsx	Restyles tutor sessions list
app/tutor/profile/page.tsx	Changes tutor profile reads to admin client (scoped by user) + restyles
app/tutor/profile/actions.ts	Uses admin client for tutor profile mutations (scoped by user)
app/tutor/loading.tsx	Adds tutor loading skeleton UI
app/tutor/layout.tsx	Adds persistent tutor nav + server-action sign out
app/tutor/error.tsx	Adds tutor route error UI
app/not-found.tsx	Adds global 404 page
app/layout.tsx	Adds global TooltipProvider + Toaster
app/globals.css	Adds base styling, focus ring, scrollbar, motion preferences
app/error.tsx	Adds global error page
app/dashboard/tutor/[id]/page.tsx	Adds read-only student view of assigned tutor profile
app/dashboard/sessions/page.tsx	Restyles student sessions list + improves link a11y
app/dashboard/requests/actions.ts	Adds student request cancellation action
app/dashboard/requests/[id]/CancelRequestButton.tsx	Adds cancel request UI
app/dashboard/packages/new/page.tsx	Adds tier query param support + restyles package selection
app/dashboard/packages/actions.ts	Adds signed URL generation + rejected payment resubmission
app/dashboard/loading.tsx	Adds dashboard loading skeleton UI
app/dashboard/layout.tsx	Adds persistent student nav + role redirects + server-action sign out
app/dashboard/error.tsx	Adds dashboard route error UI
app/auth/verify/page.tsx	Restyles verify page + adds geometric panel
app/auth/verify/ResendButton.tsx	Adds resend verification CTA
app/auth/sign-out/route.ts	Adds GET support and refactors sign-out handler
app/auth/sign-in/page.tsx	Restyles sign-in page + geometric panel
app/auth/reset-password/page.tsx	Adds reset password page
app/auth/profile-setup/page.tsx	Restyles profile setup and swaps to Bauhaus UI components
app/auth/forgot-password/page.tsx	Adds forgot password page
app/auth/actions.ts	Adds shared sign-out server action
app/api/leads/route.ts	Adds IP-based rate limiting to lead submission
app/api/cron/expire-packages/route.ts	Adds cron endpoint to expire packages
app/admin/tutors/page.tsx	Restyles tutors directory page
app/admin/tutors/actions.ts	Refactors to shared requireAdmin
app/admin/tutors/[id]/page.tsx	Restyles tutor detail page
app/admin/tutors/TutorFilters.tsx	Restyles tutor filters
app/admin/tutors/TutorActions.tsx	Restyles approve/revoke actions
app/admin/subjects/page.tsx	Adds admin subjects management page
app/admin/subjects/actions.ts	Adds subject add/toggle actions
app/admin/subjects/AddSubjectForm.tsx	Adds subject creation form
app/admin/sessions/page.tsx	Adds pagination + restyles admin sessions list
app/admin/requests/actions.ts	Refactors to shared requireAdmin + adds new admin request actions
app/admin/requests/[id]/AdminRequestActions.tsx	Adds admin status/cancel controls UI
app/admin/requests/RequestFilters.tsx	Restyles request filters
app/admin/payments/actions.ts	Refactors to shared requireAdmin + validates inputs with zod
app/admin/payments/ViewProofButton.tsx	Adds modal proof viewer with signed URL fetch
app/admin/payments/PaymentQuickActions.tsx	Adds compact WA + copy-message quick actions
app/admin/payments/PaymentActions.tsx	Restyles payment action forms
app/admin/page.tsx	Adds admin dashboard counts + refreshed card styling
app/admin/loading.tsx	Adds admin loading skeleton UI
app/admin/layout.tsx	Restyles admin layout + server-action sign out
app/admin/error.tsx	Adds admin route error UI
app/admin/audit/page.tsx	Restyles audit log
app/admin/actions.ts	Refactors to shared requireAdmin and removes duplicate signOut
.env.example	Documents new env vars (bank, cron, Sentry)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

addSubject and toggleSubjectActive use the service-role admin client but do not call requireAdmin(). Server actions can be invoked directly (bypassing the layout redirect), so these mutations need an explicit admin guard (and ideally audit logging) to prevent unauthorized subject changes.

[Copilot]

The Radix import shape here appears incorrect for the usage (TooltipPrimitive.Provider, .Root, etc.), and the Tailwind class origin-(--radix-tooltip-content-transform-origin) is invalid syntax (Tailwind expects bracket form). This will likely fail at build time; switch to the standard Radix Tooltip module import pattern and correct the Tailwind arbitrary value syntax.

[Copilot]

The Radix import shape here appears incorrect for the usage (TooltipPrimitive.Provider, .Root, etc.), and the Tailwind class origin-(--radix-tooltip-content-transform-origin) is invalid syntax (Tailwind expects bracket form). This will likely fail at build time; switch to the standard Radix Tooltip module import pattern and correct the Tailwind arbitrary value syntax.

[Copilot]

TabsPrimitive.Root/List/Trigger/Content usage requires a namespace-style Radix import; importing { Tabs as TabsPrimitive } is unlikely to provide those members and will break compilation/runtime. Use the standard Radix Tabs package import that matches the API surface you’re calling.

Suggested change

	import { Tabs as TabsPrimitive } from "radix-ui"
	import * as TabsPrimitive from "@radix-ui/react-tabs"

[Copilot]

LabelPrimitive is imported as a type-only symbol, but it’s referenced via typeof LabelPrimitive.Root, which requires a runtime value. This will fail type-checking; import the Radix Label primitive as a value (from the correct Radix package) or change the prop type so it doesn’t rely on typeof against a type-only import.

Suggested change

	import type { Label as LabelPrimitive } from "radix-ui"
	import { Slot } from "radix-ui"
	import * as LabelPrimitive from "@radix-ui/react-label"
	import { Slot } from "@radix-ui/react-slot"

[Copilot]

The className includes a stray /50 token at the end (and double spaces), which isn’t a valid Tailwind utility and will be ignored (or potentially flagged by class linting). Remove the stray token and normalize the class list.

Suggested change

	<form action={formAction} className="mt-2 space-y-2 border border-[#D0D0D0] bg-[#F0F0F0] p-3 /50">
	<form action={formAction} className="mt-2 space-y-2 border border-[#D0D0D0] bg-[#F0F0F0] p-3">

[Copilot]

The request validator/schema uses availability_windows, but this admin fetch selects availability. If the underlying DB column is now availability_windows (or the UI expects that field), this will return the wrong shape/empty data. Align the selected column name with the updated schema and downstream consumers.

Suggested change

	id, level, subject_id, status, goals, availability, timezone,
	id, level, subject_id, status, goals, availability_windows, timezone,

[Copilot]

This adds a database round-trip on every protected request (including non-admin/non-tutor pages). To reduce middleware latency/cost, consider only querying user_profiles when pathname is under /admin or /tutor, or move role info into a token claim / cached session metadata so middleware can decide without a DB call.

Suggested change

	// Fetch primary_role from user_profiles for role-based route protection
	const { data: profile } = await supabase
	.from('user_profiles')
	.select('primary_role')
	.eq('user_id', user.id)
	.single()
	const primaryRole = profile?.primary_role
	// Redirect non-admin users away from /admin/*
	if (pathname.startsWith('/admin') && primaryRole !== 'admin') {
	const url = request.nextUrl.clone()
	url.pathname = '/dashboard'
	return NextResponse.redirect(url)
	}
	// Redirect non-tutor users away from /tutor/*
	// (admins are allowed to access tutor routes per existing layout logic)
	if (
	pathname.startsWith('/tutor') &&
	primaryRole !== 'tutor' &&
	primaryRole !== 'admin'
	) {
	const url = request.nextUrl.clone()
	url.pathname = '/dashboard'
	return NextResponse.redirect(url)
	const isRoleProtectedPath =
	pathname.startsWith('/admin') || pathname.startsWith('/tutor')
	if (isRoleProtectedPath) {
	// Fetch primary_role from user_profiles for role-based route protection
	const { data: profile } = await supabase
	.from('user_profiles')
	.select('primary_role')
	.eq('user_id', user.id)
	.single()
	const primaryRole = profile?.primary_role
	// Redirect non-admin users away from /admin/*
	if (pathname.startsWith('/admin') && primaryRole !== 'admin') {
	const url = request.nextUrl.clone()
	url.pathname = '/dashboard'
	return NextResponse.redirect(url)
	}
	// Redirect non-tutor users away from /tutor/*
	// (admins are allowed to access tutor routes per existing layout logic)
	if (
	pathname.startsWith('/tutor') &&
	primaryRole !== 'tutor' &&
	primaryRole !== 'admin'
	) {
	const url = request.nextUrl.clone()
	url.pathname = '/dashboard'
	return NextResponse.redirect(url)
	}

[Copilot]

Rendering error.message directly to end users can leak internal details (stack-derived messages, DB errors, etc.). Consider showing a generic message in production and logging the detailed error server-side (or gating the detailed message behind NODE_ENV !== 'production').

[Copilot]

HSTS should generally only be sent when you’re certain the site is always served over HTTPS (typically production only). Consider conditionally adding this header based on environment/deployment to avoid unintended behavior during local/dev or non-HTTPS environments.

Suggested change

	return [
	{
	// Apply security headers to all routes
	source: "/(.*)",
	headers: [
	{
	key: "X-Frame-Options",
	value: "DENY",
	},
	{
	key: "X-Content-Type-Options",
	value: "nosniff",
	},
	{
	key: "Referrer-Policy",
	value: "strict-origin-when-cross-origin",
	},
	{
	key: "Permissions-Policy",
	value: "camera=(), microphone=(), geolocation=()",
	},
	{
	key: "Strict-Transport-Security",
	value: "max-age=63072000; includeSubDomains; preload",
	},
	{
	key: "X-DNS-Prefetch-Control",
	value: "on",
	},
	],
	const securityHeaders = [
	{
	key: "X-Frame-Options",
	value: "DENY",
	},
	{
	key: "X-Content-Type-Options",
	value: "nosniff",
	},
	{
	key: "Referrer-Policy",
	value: "strict-origin-when-cross-origin",
	},
	{
	key: "Permissions-Policy",
	value: "camera=(), microphone=(), geolocation=()",
	},
	{
	key: "X-DNS-Prefetch-Control",
	value: "on",
	},
	];
	if (process.env.NODE_ENV === "production") {
	securityHeaders.push({
	key: "Strict-Transport-Security",
	value: "max-age=63072000; includeSubDomains; preload",
	});
	}
	return [
	{
	// Apply security headers to all routes
	source: "/(.*)",
	headers: securityHeaders,