feat(M3): Phase 3 — Clerk auth, superadmin, email templates, polish

[parva3105]

Summary

• Real Clerk auth — replaced all hardcoded lib/auth-helpers.ts stubs with requireAgencyAuth() / requireCreatorAuth() / requireBrandAuth() helpers in 10+ API routes; superadmin returns test IDs for transparent passthrough
• Superadmin perspective switcher — RoleSwitcher component renders only for publicMetadata.role === 'superadmin'; sets active_perspective cookie and routes to the correct portal; lazy state init avoids lint violations
• ClerkProvider — app/layout.tsx now wraps the app in <ClerkProvider>; RoleProvider and lib/role-context.tsx removed; Header.tsx uses useUser() from Clerk
• Auth pages — /login, /signup, /signup/agency, /signup/creator, /signup/brand, /signup/complete all use Clerk-hosted or custom flows
• 8 new React Email templates — deal-assigned, content-submitted, contract-available, changes-requested, content-approved, payment-received, deadline-warning, partnership-request/accepted/declined, new-brief; fire-and-forget via Trigger.dev sendEmailJob
• Cookie forwarding — lib/api.ts exposes serverFetch() that forwards next/headers cookies; all protected server components use it so Clerk middleware no longer intercepts internal fetches
• Upload rate limiting — getUploadRateLimit() on /api/v1/deals/[id]/submissions; getAuthRateLimit() on /api/v1/auth/set-role; both use lazy singleton pattern
• Empty states, loading, error boundaries — loading.tsx + error.tsx added to all three route groups; components/ui/skeleton.tsx added
• 3 Playwright smoke tests — e2e/smoke.spec.ts covering public discover page, protected dashboard redirect, and brief submission flow
• CI fix — lazy-init Redis and Resend so next build no longer crashes when env vars are absent in CI

Why

Milestone M3: wire real auth, unblock the superadmin test path, deliver async email notifications, and harden the app with rate limiting and error boundaries before moving to M4 (creator portal completeness).

How to test

1. Set NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY + CLERK_SECRET_KEY in .env.local
2. npm run dev
3. Visit /discover — should load creator cards without auth
4. Visit /dashboard — should redirect to /login if unauthenticated
5. Sign up, complete onboarding, verify role routing (/dashboard for agency, /creator/deals for creator)
6. In Clerk dashboard set publicMetadata.role = "superadmin" → RoleSwitcher appears in header
7. Playwright: npx playwright test e2e/smoke.spec.ts

Env vars added / changed

Var	Purpose
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY	Clerk frontend key (already in .env.example)
CLERK_SECRET_KEY	Clerk backend key (already in .env.example)
NEXT_PUBLIC_APP_URL	Base URL for serverFetch() (already existed)
UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN	Rate limiting (lazy init, no build-time crash)
RESEND_API_KEY	Email sending (lazy init, no build-time crash)

Both CI workflows (ci.yml, prod.yml) already have CLERK_SECRET_KEY added.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
project-alpha	Ready	Preview, Comment	Mar 21, 2026 7:28am