sharang created pull request Benjamin_Boenisch/breakpilot-core#2

sharang
Sun, 05 Apr 2026 18:50:53 +0000

2#feat(pitch-deck): passwordless investor auth, audit logs, snapshots & PWA#

Summary

Passwordless magic link auth — admin invites investor via API, investor receives email with one-time link, clicks to get JWT session. Single active session per investor, 72h link TTL, rate-limited.

Audit logging — tracks all investor activity: logins, slide views, assumption changes, chat messages. Queryable via admin API with filters.

Financial model snapshots — per-investor auto-save/restore of assumption changes. Debounced 2s after last change. Reset to defaults button.

PWA — manifest.json, service worker (cache-first for static, network-first for APIs), app icons, fullscreen display.

Safeguards — email watermark overlay on every slide, security headers (X-Robots-Tag, X-Frame-Options, CSP frame-ancestors none), content protection (no right-click, no text select), rate limiting (magic links, auth, API, chat), IP logging, new IP detection.

Docker integration — pitch-deck service added to docker-compose.coolify.yml with health check, env vars, breakpilot-network.

New files (26)

migrations/001_investor_auth.sql — 5 tables (investors, magic_links, audit_logs, snapshots, sessions)

middleware.ts — auth enforcement on all routes

lib/auth.ts, lib/email.ts, lib/rate-limit.ts — core auth utilities

lib/hooks/useAuth.ts, lib/hooks/useAuditTracker.ts — client hooks

app/api/auth/* — verify, logout, me endpoints

app/api/admin/* — invite, investors, revoke, audit-logs endpoints

app/api/audit/, app/api/snapshots/, app/api/health/ — audit, snapshot, health endpoints

app/auth/, app/auth/verify/ — login and verification pages

components/Watermark.tsx — diagonal email watermark

public/manifest.json, public/sw.js, public/icons/ — PWA assets

Modified files (9)

docker-compose.coolify.yml — add pitch-deck service + update health-aggregator

package.json — add jose, nodemailer deps

next.config.js — security headers

app/layout.tsx — PWA meta tags + service worker registration

app/page.tsx — auth wrapper with useAuth hook

components/PitchDeck.tsx — investor prop, audit tracker, watermark, content protection

components/slides/FinancialsSlide.tsx — snapshot status indicator + reset button

lib/hooks/useFinancialModel.ts — snapshot save/restore logic

lib/types.ts — Investor, InvestorSnapshot types

Test plan

Run migration against PostgreSQL

Invite investor via curl -X POST /api/admin/invite -H "Authorization: Bearer $PITCH_ADMIN_SECRET"

Verify magic link email received

Click magic link, confirm redirect to pitch deck with session cookie

Access / without cookie — should redirect to /auth

Navigate slides, check pitch_audit_logs table for events

Change financial assumptions, logout, login again — confirm values restored

Verify watermark overlay shows investor email

Check response headers for security headers (curl -I)

Test PWA install prompt in Chrome

Spam /api/admin/invite — confirm 429 after 3rd request

docker compose -f docker-compose.coolify.yml build pitch-deck — confirm build succeeds

Generated with Claude Code