Team

Private permanent accounts for owner and small team. Invited users only — no public self-registration or anonymous access.

Checking team access

Cloud database, auth and storage are available. Login, reset and sign-out are backed by actual Cloud email/password auth — no fake login. A user with a valid auth account but no approved membership sees Access pending and cannot read research. Active member and role are shown only from a successful server response for the current user; missing, inactive or invalid membership is denied. A request failure is verification unavailable, not no-membership.

Recovery email service is separate from the trading-alert SMTP. Authentication configuration changes require platform approval, never bypass it.

Sign In (Cloud Auth)

Authentication is backed by actual Cloud email/password auth. No public sign-up — accounts are provisioned by an owner/admin.

Session Storage (security design)

The generated Cloud browser SDK persists its session in browser localStorage by default. This app does not add its own tokens to localStorage and does not claim an HttpOnly server session. This is a property of the generated SDK and the platform auth provider, not something this patch changes. Do not store additional secrets in the browser. Server-side role enforcement and RLS remain the authoritative access controls.

Owner

Capability reference

• Read research: Yes
• Approve policies: Yes
• Manage team: Yes
• Upload intake: Yes
• Manage connections: Yes

Full control. Manages team and configuration.

Admin

Capability reference

• Read research: Yes
• Approve policies: Yes
• Manage team: Yes
• Upload intake: Yes
• Manage connections: Yes

Manages team, approves policies, configures connections.

Reviewer

Capability reference

• Read research: Yes
• Approve policies: Yes
• Manage team: No
• Upload intake: Yes
• Manage connections: No

Approves weekly policies. Read/research + intake.

Analyst

Capability reference

• Read research: Yes
• Approve policies: No
• Manage team: No
• Upload intake: Yes
• Manage connections: No

Read/research and intake. No approvals.