Initial import: property management SaaS + security hardening + admin dashboard

Property Management Network — Next.js 16 (App Router), Better Auth,
Drizzle ORM over PostgreSQL, Stripe, OpenAI, Resend.

Includes:
- Security hardening: access-control/IDOR fixes, TLS-by-default DB layer,
  constant-time cron auth, strict security headers, atomic AI quota gating,
  HTML/email output encoding, demo-backdoor disabled in production.
- Superadmin dashboard at /admin (overview/MRR, server-paginated users with
  ban/impersonate/plan/delete, billing, platform activity + admin audit log,
  AI usage, system health) via the Better Auth admin plugin.
- Seed/migration utility scripts under scripts/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/(auth)/forgot-password/page.tsx

@@ -0,0 +1,69 @@
+import Link from "next/link"
+import { Logo } from "@/components/shared/logo"
+import { resetPassword } from "@/app/actions/auth"
+
+export default async function ForgotPasswordPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string; success?: string }>
+}) {
+  const params = await searchParams
+  const error = params.error
+  const success = params.success
+
+  return (
+    <div className="w-full">
+      <div className="mb-8 flex flex-col items-center">
+        <Logo size="lg" />
+        <h1 className="mt-6 text-2xl font-bold text-white">Reset your password</h1>
+        <p className="mt-2 text-sm text-white/60">
+          Enter your email and we&apos;ll send a reset link
+        </p>
+      </div>
+
+      <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {error && (
+          <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">
+            {decodeURIComponent(error)}
+          </div>
+        )}
+        {success === "email-sent" && (
+          <div className="mb-4 rounded-lg border border-emerald-500/20 bg-emerald-500/10 px-4 py-3 text-sm text-emerald-400">
+            Check your email — reset link sent.
+          </div>
+        )}
+
+        <form action={resetPassword} className="space-y-4">
+          <div>
+            <label htmlFor="email" className="mb-1.5 block text-sm font-medium text-white/70">
+              Email address
+            </label>
+            <input
+              id="email"
+              name="email"
+              type="email"
+              required
+              autoComplete="email"
+              placeholder="you@example.com"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <button
+            type="submit"
+            className="w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"
+          >
+            Send reset link
+          </button>
+        </form>
+
+        <p className="mt-6 text-center text-sm text-white/40">
+          Remember your password?{" "}
+          <Link href="/login" className="text-indigo-400 hover:text-indigo-300">
+            Back to sign in
+          </Link>
+        </p>
+      </div>
+    </div>
+  )
+}

app/(auth)/layout.tsx

@@ -0,0 +1,13 @@
+import type { Metadata } from "next"
+
+export const metadata: Metadata = {
+  title: "Sign in to Property Management Network",
+}
+
+export default function AuthLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-[#09090b] px-4">
+      <div className="w-full max-w-md">{children}</div>
+    </div>
+  )
+}

app/(auth)/login/page.tsx

@@ -0,0 +1,132 @@
+import Link from "next/link"
+import { Logo } from "@/components/shared/logo"
+import { signIn, signInWithGoogle } from "@/app/actions/auth"
+
+export default async function LoginPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string; success?: string }>
+}) {
+  const params = await searchParams
+  const error = params.error
+  const success = params.success
+
+  return (
+    <div className="w-full">
+      <div className="mb-8 flex flex-col items-center">
+        <Logo size="lg" />
+        <h1 className="mt-6 text-2xl font-bold text-white">Welcome back</h1>
+        <p className="mt-2 text-sm text-white/60">Sign in to your account</p>
+      </div>
+
+      <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {/* Google OAuth */}
+        <form action={signInWithGoogle}>
+          <button
+            type="submit"
+            className="flex w-full items-center justify-center gap-3 rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm font-medium text-white transition hover:bg-white/10"
+          >
+            <GoogleIcon />
+            Continue with Google
+          </button>
+        </form>
+
+        <div className="relative my-6">
+          <div className="absolute inset-0 flex items-center">
+            <div className="w-full border-t border-white/10" />
+          </div>
+          <div className="relative flex justify-center text-xs">
+            <span className="bg-[#111118] px-3 text-white/40">or continue with email</span>
+          </div>
+        </div>
+
+        {/* Error / Success messages */}
+        {error && (
+          <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">
+            {decodeURIComponent(error)}
+          </div>
+        )}
+        {success === "password-updated" && (
+          <div className="mb-4 rounded-lg border border-emerald-500/20 bg-emerald-500/10 px-4 py-3 text-sm text-emerald-400">
+            Password updated. Sign in below.
+          </div>
+        )}
+
+        {/* Email + Password form */}
+        <form action={signIn} className="space-y-4">
+          <div>
+            <label htmlFor="email" className="mb-1.5 block text-sm font-medium text-white/70">
+              Email
+            </label>
+            <input
+              id="email"
+              name="email"
+              type="email"
+              required
+              autoComplete="email"
+              placeholder="you@example.com"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <div>
+            <div className="mb-1.5 flex items-center justify-between">
+              <label htmlFor="password" className="text-sm font-medium text-white/70">
+                Password
+              </label>
+              <Link href="/forgot-password" className="text-xs text-indigo-400 hover:text-indigo-300">
+                Forgot password?
+              </Link>
+            </div>
+            <input
+              id="password"
+              name="password"
+              type="password"
+              required
+              autoComplete="current-password"
+              placeholder="••••••••"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <button
+            type="submit"
+            className="mt-2 w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"
+          >
+            Sign in
+          </button>
+        </form>
+
+        <p className="mt-6 text-center text-sm text-white/40">
+          Don&apos;t have an account?{" "}
+          <Link href="/signup" className="text-indigo-400 hover:text-indigo-300">
+            Sign up free
+          </Link>
+        </p>
+      </div>
+    </div>
+  )
+}
+
+function GoogleIcon() {
+  return (
+    <svg className="h-4 w-4" viewBox="0 0 24 24">
+      <path
+        d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
+        fill="#4285F4"
+      />
+      <path
+        d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
+        fill="#34A853"
+      />
+      <path
+        d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"
+        fill="#FBBC05"
+      />
+      <path
+        d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
+        fill="#EA4335"
+      />
+    </svg>
+  )
+}

app/(auth)/signup/page.tsx

@@ -0,0 +1,156 @@
+import Link from "next/link"
+import { Logo } from "@/components/shared/logo"
+import { signUp, signInWithGoogle } from "@/app/actions/auth"
+
+export default async function SignupPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string; success?: string }>
+}) {
+  const params = await searchParams
+  const error = params.error
+  const success = params.success
+
+  if (success === "check-email") {
+    return (
+      <div className="w-full">
+        <div className="mb-8 flex flex-col items-center">
+          <Logo size="lg" />
+        </div>
+        <div className="rounded-xl border border-white/10 bg-[#111118] p-8 text-center">
+          <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-emerald-500/10 text-2xl">
+            ✉️
+          </div>
+          <h2 className="text-xl font-bold text-white">Check your email</h2>
+          <p className="mt-2 text-sm text-white/60">
+            We sent a confirmation link to your email. Click it to activate your account.
+          </p>
+          <Link
+            href="/login"
+            className="mt-6 inline-block text-sm text-indigo-400 hover:text-indigo-300"
+          >
+            Back to sign in
+          </Link>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="w-full">
+      <div className="mb-8 flex flex-col items-center">
+        <Logo size="lg" />
+        <h1 className="mt-6 text-2xl font-bold text-white">Create your account</h1>
+        <p className="mt-2 text-sm text-white/60">Start managing your properties for free</p>
+      </div>
+
+      <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {/* Google OAuth */}
+        <form action={signInWithGoogle}>
+          <button
+            type="submit"
+            className="flex w-full items-center justify-center gap-3 rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm font-medium text-white transition hover:bg-white/10"
+          >
+            <GoogleIcon />
+            Continue with Google
+          </button>
+        </form>
+
+        <div className="relative my-6">
+          <div className="absolute inset-0 flex items-center">
+            <div className="w-full border-t border-white/10" />
+          </div>
+          <div className="relative flex justify-center text-xs">
+            <span className="bg-[#111118] px-3 text-white/40">or sign up with email</span>
+          </div>
+        </div>
+
+        {error && (
+          <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">
+            {decodeURIComponent(error)}
+          </div>
+        )}
+
+        <form action={signUp} className="space-y-4">
+          <div>
+            <label htmlFor="full_name" className="mb-1.5 block text-sm font-medium text-white/70">
+              Full name
+            </label>
+            <input
+              id="full_name"
+              name="full_name"
+              type="text"
+              required
+              autoComplete="name"
+              placeholder="John Smith"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <div>
+            <label htmlFor="email" className="mb-1.5 block text-sm font-medium text-white/70">
+              Email
+            </label>
+            <input
+              id="email"
+              name="email"
+              type="email"
+              required
+              autoComplete="email"
+              placeholder="you@example.com"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <div>
+            <label htmlFor="password" className="mb-1.5 block text-sm font-medium text-white/70">
+              Password
+            </label>
+            <input
+              id="password"
+              name="password"
+              type="password"
+              required
+              minLength={8}
+              autoComplete="new-password"
+              placeholder="Min 8 characters"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <button
+            type="submit"
+            className="mt-2 w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"
+          >
+            Create account
+          </button>
+        </form>
+
+        <p className="mt-4 text-center text-xs text-white/30">
+          By signing up you agree to our{" "}
+          <Link href="/terms" className="underline hover:text-white/50">Terms</Link>
+          {" "}and{" "}
+          <Link href="/privacy" className="underline hover:text-white/50">Privacy Policy</Link>.
+        </p>
+
+        <p className="mt-6 text-center text-sm text-white/40">
+          Already have an account?{" "}
+          <Link href="/login" className="text-indigo-400 hover:text-indigo-300">
+            Sign in
+          </Link>
+        </p>
+      </div>
+    </div>
+  )
+}
+
+function GoogleIcon() {
+  return (
+    <svg className="h-4 w-4" viewBox="0 0 24 24">
+      <path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4" />
+      <path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853" />
+      <path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05" />
+      <path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335" />
+    </svg>
+  )
+}

app/(auth)/update-password/page.tsx

@@ -0,0 +1,62 @@
+import Link from "next/link"
+import { Logo } from "@/components/shared/logo"
+import { updatePassword } from "@/app/actions/auth"
+
+export default async function UpdatePasswordPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ error?: string; token?: string }>
+}) {
+  const params = await searchParams
+  const error = params.error
+  const token = params.token ?? ""
+
+  return (
+    <div className="w-full">
+      <div className="mb-8 flex flex-col items-center">
+        <Logo size="lg" />
+        <h1 className="mt-6 text-2xl font-bold text-white">Set new password</h1>
+        <p className="mt-2 text-sm text-white/60">Choose a strong password</p>
+      </div>
+
+      <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {error && (
+          <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">
+            {decodeURIComponent(error)}
+          </div>
+        )}
+
+        <form action={updatePassword} className="space-y-4">
+          <input type="hidden" name="token" value={token} />
+          <div>
+            <label htmlFor="password" className="mb-1.5 block text-sm font-medium text-white/70">
+              New password
+            </label>
+            <input
+              id="password"
+              name="password"
+              type="password"
+              required
+              minLength={8}
+              placeholder="Min 8 characters"
+              className="w-full rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm text-white placeholder-white/30 outline-none ring-indigo-500 transition focus:border-indigo-500/50 focus:ring-1"
+            />
+          </div>
+
+          <button
+            type="submit"
+            className="w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"
+          >
+            Update password
+          </button>
+        </form>
+
+        <p className="mt-6 text-center text-sm text-white/40">
+          <Link href="/login" className="text-indigo-400 hover:text-indigo-300">
+            Back to sign in
+          </Link>
+        </p>
+      </div>
+    </div>
+  )
+}