Entry Points

Copy// src/components/auth/login/action.ts
if (existingUser.role === "DEVELOPER") {
  finalRedirectUrl = `/${locale}/dashboard`
} else {
  finalRedirectUrl = `/${locale}` // Homepage
}

Copyconst session = await auth()
if (!session) redirect(`/${lang}/login?callbackUrl=/${lang}/dashboard`)
if (session.user?.role !== "DEVELOPER") redirect(`/${lang}/access-denied`)

Copyexport const roleRoutes: Record<string, Role[]> = {
  "/admin": ["ADMIN", "DEVELOPER"],
  "/admin/*": ["ADMIN", "DEVELOPER"],
  "/settings/*": ["ADMIN", "DEVELOPER"],
 
  "/teachers": ["ADMIN", "DEVELOPER"],
  "/subjects/*": ["ADMIN", "TEACHER", "DEVELOPER"],
  "/grades/*": ["ADMIN", "TEACHER", "DEVELOPER"],
 
  "/students/*": ["ADMIN", "TEACHER", "STAFF", "DEVELOPER"],
  "/parents/*": ["ADMIN", "TEACHER", "STAFF", "DEVELOPER"],
  "/attendance/*": ["ADMIN", "TEACHER", "STAFF", "DEVELOPER"],
 
  "/finance/*": [
    "ADMIN",
    "TEACHER",
    "STUDENT",
    "GUARDIAN",
    "ACCOUNTANT",
    "STAFF",
    "DEVELOPER",
  ],
 
  "/my-grades": ["STUDENT", "GUARDIAN", "DEVELOPER"],
  "/my-attendance": ["STUDENT", "GUARDIAN", "DEVELOPER"],
  "/my-fees": ["STUDENT", "GUARDIAN", "DEVELOPER"],
}

Copyexport function isRouteAllowedForRole(pathname: string, role: Role): boolean {
  if (role === "DEVELOPER") return true
  if (roleRoutes[pathname]) return roleRoutes[pathname].includes(role)
  for (const [pattern, allowedRoles] of Object.entries(roleRoutes)) {
    if (pattern.endsWith("/*")) {
      const base = pattern.slice(0, -2)
      if (pathname.startsWith(base + "/")) return allowedRoles.includes(role)
    }
  }
  return true // default: allow routes not in matrix
}

Copy// src/proxy.ts (simplified)
export async function middleware(request: NextRequest) {
  const hostname = request.headers.get("host")
  const subdomain = extractSubdomain(hostname)
 
  if (subdomain && subdomain !== "ed") {
    return NextResponse.rewrite(
      new URL(`/${locale}/s/${subdomain}${pathname}`, request.url)
    )
  }
 
  if (isProtectedRoute(pathname)) {
    const session = await auth()
    if (!session) return NextResponse.redirect(new URL("/login", request.url))
  }
 
  return NextResponse.next()
}

Copysession.user = {
  id: string
  email: string
  role: UserRole
  schoolId: string | null   // null for new users / DEVELOPER
  isPlatformAdmin: boolean
}

Copy// src/components/school/school-provider.tsx
export function SchoolProvider({ subdomain, children }) {
  const [school, setSchool] = useState(null)
  useEffect(() => {
    getSchoolBySubdomain(subdomain).then(setSchool)
  }, [subdomain])
  return (
    <SchoolContext.Provider value={school}>{children}</SchoolContext.Provider>
  )
}

Copy// e2e/entry-points.spec.ts
test("SaaS marketing loads without auth", async ({ page }) => {
  await page.goto("https://ed.databayt.org/en")
  await expect(page.locator("h1")).toContainText("School Automation")
})
 
test("Operator dashboard requires DEVELOPER", async ({ page }) => {
  await page.goto("https://ed.databayt.org/en/dashboard")
  await expect(page).toHaveURL(/\/login/)
})
 
test("School site loads with subdomain", async ({ page }) => {
  await page.goto("https://hogwarts.databayt.org/en")
  await expect(page.locator("h1")).toContainText("Hogwarts")
})
 
test("School platform requires auth", async ({ page }) => {
  await page.goto("https://hogwarts.databayt.org/en/dashboard")
  await expect(page).toHaveURL(/\/login/)
})