Accounts, roles, dashboards, saved work

Secure Account Center

Server-side authentication scaffolding for customer users, owner/admin, staff, paralegals, attorneys, and community partners. Each account can hold saved progress, named drafts, uploaded document groups, finished item records, review orders, referral code ownership, and audit history.

Roles supported
  • Public/customer user
  • Owner/admin
  • Staff
  • Paralegal
  • Attorney
  • Community partner/referral account
Backend endpoints added
  • POST /api/auth/register
  • POST /api/auth/login
  • GET /api/auth/me
  • POST /api/role-workspace/save-progress
  • POST /api/referrals/server-account
What the dashboard should show
  • Recent matter and draft
  • Uploaded-copy groups
  • Finished wills, trusts, POAs, directives, probate organizers
  • Review add-ons and engagement status
  • Referral QR and reward ledger when applicable

Security defaults for production

Passwords are hashed server-side with PBKDF2 in the backend scaffold. Sessions are signed tokens. Production should move from the JSON development store to managed Postgres, enforce HTTPS-only secure cookies, add rate limiting, email verification, password reset, two-factor authentication for staff/attorneys, and database-backed role permissions before open launch.