feat: enhance user management and analytics integration

Author: ayoub3bidi

.github/workflows/deploy-supabase-functions.yml

@@ -51,3 +51,4 @@ jobs:
           supabase functions deploy platform-access
           supabase functions deploy delete-account
           supabase functions deploy waitlist-welcome --no-verify-jwt
+          supabase functions deploy sync-contacts

AGENTS.md

@@ -103,7 +103,10 @@ See reference doc for full checklists (JS, Python, pseudocode, sound, insight, t
 - **OAuth UX** — Google Identity Services (PKCE popup on `/auth/google/callback`); web uses `signInWithIdToken`, not `signInWithOAuth`; `googleIdentity.js` manages GIS script loading, nonce creation, and popup flow
 - **Service layer** — `src/services/authService.js`, `profileService.js`, `entitlementService.js`, `accessService.js`, `googleTokenExchange.js`; components use `AuthContext` / `useAuth`, never import Supabase directly
 - **Platform access** — signed-in users pass through `checkPlatformAccess()` → Supabase Edge Function `platform-access` (account ban gate); **fail-open** on transport/invoke errors, **fail-closed** only when `allowed: false` + `reason: account_banned`; signup path uses `before-signup` / `post-signup` hooks (ban logic fail-closed)
-- **Postgres-portable schema** — `profiles` keyed to `auth.users`; RLS on public tables; client-writable columns: `display_name`, `avatar_preference` only; `avatar_url` is OAuth/trigger-populated (not client-writable); `plan` and future `referral_*` / `pro_*` columns are service role / webhook only
+- **Postgres-portable schema** — `profiles` keyed to `auth.users`; RLS on public tables; client-writable columns: `display_name`, `avatar_preference` only; `avatar_url` is OAuth/trigger-populated (not client-writable); `plan` is service role only. Through 0.5.0: **no** LemonSqueezy, subscriptions, referrals, or `user_sessions` tables in tree
+- **Pro through 0.5.0** — waitlist demand only (`/pro` + `waitlist`); no checkout or Pro entitlements beyond waitlist capture
+- **Analytics (PostHog)** — `src/services/analytics.js` + `analyticsEvents.js`; SPA pageviews via `capture_pageview: 'history_change'`; `disable_surveys: true`; session replay sampled (`sampleRate: 0.2`). Growth events: `waitlist_joined`, `upgrade_limit_hit` (plus existing `sign_in_completed`). Anonymous viz limit stays hardcoded at `12` (no feature-flag A/B)
+- **Email (Resend)** — `waitlist-welcome` (one transactional welcome per waitlist join); `sync-contacts` (JWT-authenticated contact upsert on `SIGNED_IN` only — no broadcasts in 0.5.0). Stay under Resend free daily cap (100/day)
 - **Profile settings** — private route `/settings/profile` (`RequireAuth`); `updateProfile()` in `profileService.js`; security boundary = RLS row scope + `REVOKE UPDATE` + `GRANT UPDATE (display_name, avatar_preference)`; tabbed UI with profile/notifications/connections tabs; DiceBear notionists avatar fallback
 - **Session** — `getSession()`, `onAuthStateChange()`; `AuthProvider` in `src/main.jsx`; request-dedup via `requestRef`
 - **Tiered access model** — Anonymous (no account) gets limited access to drive sign-in conversion; Free account (Google sign-in) unlocks the full platform

docs/AGENTS_REFERENCE.md

@@ -99,7 +99,10 @@
   - `supabase/functions/post-signup/` — post-signup side effects
   - `supabase/functions/platform-access/` — signed-in ban check (`accessService.checkPlatformAccess()`; fail-open on transport)
   - `supabase/functions/waitlist-welcome/` — Pro waitlist confirmation email via Resend (fail-open; invoked after client insert)
+  - `supabase/functions/sync-contacts/` — JWT-authenticated Resend contact upsert on sign-in (fail-open; identity from JWT only)
   - `supabase/functions/delete-account/` — self-service account deletion
+- **Not in 0.5.0:** LemonSqueezy webhook, subscriptions / usage_events / referrals / user_sessions tables (dropped via `20260720180000_drop_premature_saas_scaffolding.sql`)
+- Analytics: `src/services/analytics.js`, `src/services/analyticsEvents.js` — PostHog SPA pageviews + growth events `waitlist_joined`, `upgrade_limit_hit`; surveys disabled in SDK
 - Context: `src/contexts/AuthProvider.jsx`, `src/hooks/useAuth.js`
 - Avatar resolution: `src/utils/resolveUserAvatar.js` (`resolveUserAvatar`, `resolveDisplayName`, DiceBear notionists style)
 - Components: `src/components/UserMenu.jsx`, `src/components/UserAvatar.jsx`, `src/components/RequireAuth.jsx`
@@ -118,7 +121,7 @@
 | `avatar_url` | no | OAuth / trigger-populated HTTPS URL |
 | `avatar_preference` | yes | `google` (default) \| `generated` |
 
-Future (v0.6.0, not shipped): `username` (unique, set-once RLS), public `/u/:username` route; referral/billing columns (`referral_code`, `referred_by`, `referral_count`, `pro_months_earned`, `pro_expires_at`) — service role only.
+Future (post-0.5.0, not shipped): `username` (unique, set-once RLS), public `/u/:username` route; any referral/billing columns — new migrations then, not restore of dropped scaffolding. Through 0.5.0 Pro remains waitlist-only.
 
 ### Personal learning tables
 

public/_headers

@@ -5,7 +5,7 @@
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: camera=(), microphone=(), geolocation=(), identity-credentials-get=(self "https://accounts.google.com")
   # Pyodide CDN origins: jsDelivr below; custom VITE_PYODIDE_CDN_BASE origins appended at build (vite.config.js)
-  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://*.posthog.com https://static.cloudflareinsights.com https://cdn.jsdelivr.net https://accounts.google.com https://app.lemonsqueezy.com; connect-src 'self' blob: https://*.posthog.com https://e.bayanflow.com https://e.dev.bayanflow.com https://cloudflareinsights.com https://api.github.com https://cdn.jsdelivr.net https://www.remotion.pro https://qketsapzqpzmccljfjcm.supabase.co https://accounts.google.com https://oauth2.googleapis.com https://api.lemonsqueezy.com; img-src 'self' data: blob: https://api.producthunt.com https://lh3.googleusercontent.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; font-src 'self' data:; worker-src 'self' blob:; media-src 'self' blob:; frame-src https://www.youtube-nocookie.com https://accounts.google.com https://app.lemonsqueezy.com; object-src 'none'; base-uri 'self'; form-action 'self'
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob: https://*.posthog.com https://static.cloudflareinsights.com https://cdn.jsdelivr.net https://accounts.google.com; connect-src 'self' blob: https://*.posthog.com https://e.bayanflow.com https://e.dev.bayanflow.com https://cloudflareinsights.com https://api.github.com https://cdn.jsdelivr.net https://www.remotion.pro https://qketsapzqpzmccljfjcm.supabase.co https://accounts.google.com https://oauth2.googleapis.com; img-src 'self' data: blob: https://api.producthunt.com https://lh3.googleusercontent.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; font-src 'self' data:; worker-src 'self' blob:; media-src 'self' blob:; frame-src https://www.youtube-nocookie.com https://accounts.google.com; object-src 'none'; base-uri 'self'; form-action 'self'
   Link: <https://bayanflow.com/sitemap.xml>; rel="sitemap"
   Link: </.well-known/api-catalog>; rel="api-catalog"
   Link: </.well-known/agent-card.json>; rel="service-desc"

scripts/cspHeaders.js

@@ -173,36 +173,3 @@ export function assertAuthCspDirectives(csp, source) {
 
   return { connectSrc: connectSrc ?? '', imgSrc: imgSrc ?? '' };
 }
-
-/**
- * Assert CSP directives required for LemonSqueezy billing integration.
- * @param {string} csp
- * @param {string} source - Label for error messages (e.g. "public/_headers")
- * @returns {{ scriptSrc: string; connectSrc: string; frameSrc: string }}
- */
-export function assertBillingCspDirectives(csp, source) {
-  const directives = parseCspDirectives(csp);
-
-  const scriptSrc = directives.get('script-src') ?? '';
-  if (!scriptSrc.includes('https://app.lemonsqueezy.com')) {
-    throw new Error(
-      `${source}: script-src must include https://app.lemonsqueezy.com (LemonSqueezy checkout)`
-    );
-  }
-
-  const connectSrc = directives.get('connect-src') ?? '';
-  if (!connectSrc.includes('https://api.lemonsqueezy.com')) {
-    throw new Error(
-      `${source}: connect-src must include https://api.lemonsqueezy.com (LemonSqueezy API)`
-    );
-  }
-
-  const frameSrc = directives.get('frame-src') ?? '';
-  if (!frameSrc.includes('https://app.lemonsqueezy.com')) {
-    throw new Error(
-      `${source}: frame-src must include https://app.lemonsqueezy.com (LemonSqueezy checkout overlay)`
-    );
-  }
-
-  return { scriptSrc, connectSrc, frameSrc };
-}

src/contexts/AuthProvider.jsx

@@ -23,22 +23,20 @@ import { getSupabaseClient } from '@/lib/supabaseClient';
 /** @typedef {'account_banned' | null} AccessBlockReason */
 
 /**
- * Sync user contact to Resend for email automation (fire-and-forget).
- * @param {object} user
- * @param {object} profile
+ * Sync signed-in user to Resend (fire-and-forget).
+ * Identity is taken from the JWT inside the edge function — body is metadata only.
+ * @param {object} [profile]
  */
-function syncContactToResend(user, profile) {
+function syncContactToResend(profile) {
   const supabase = getSupabaseClient();
   if (!supabase) return;
 
   void supabase.functions.invoke('sync-contacts', {
     method: 'POST',
     body: {
-      email: user.email,
-      userId: user.id,
       plan: profile?.plan || 'free',
       displayName: profile?.displayName || '',
-      language: document.documentElement.lang,
+      language: document.documentElement.lang || 'en',
     },
   });
 }
@@ -216,7 +214,8 @@ export function AuthProvider({ children }) {
             plan: null,
           });
           trackSignInCompleted();
-          syncContactToResend(nextSession.user, {
+          syncContactToResend({
+            plan: null,
             displayName:
               nextSession.user.user_metadata?.full_name ||
               nextSession.user.user_metadata?.name,

src/contexts/AuthProvider.test.jsx

@@ -7,6 +7,7 @@ import {
   resetSupabaseMocks,
   supabaseAuthMock,
   supabaseFromMock,
+  supabaseFunctionsInvokeMock,
   authStateChangeCallbackRef,
 } from '../test/supabaseMock.js';
 
@@ -339,6 +340,15 @@ describe('AuthProvider', () => {
     });
     expect(screen.getByTestId('display-name')).toHaveTextContent('New User');
     expect(resetAllSessionCounters).toHaveBeenCalledTimes(1);
+    expect(supabaseFunctionsInvokeMock).toHaveBeenCalledWith(
+      'sync-contacts',
+      expect.objectContaining({
+        method: 'POST',
+        body: expect.objectContaining({
+          displayName: 'New User',
+        }),
+      })
+    );
   });
 
   it('does not reset session counters on INITIAL_SESSION hydrate', async () => {

src/security/cspHeaders.test.js

@@ -7,12 +7,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, vi, beforeEach } from 'vitest';
 import {
   assertAnalyticsCspDirectives,
   assertAuthCspDirectives,
   assertVideoExportCspDirectives,
-  assertBillingCspDirectives,
   extractCspFromHeadersFile,
   parseCspDirectives,
 } from '../../scripts/cspHeaders.js';
@@ -46,8 +45,4 @@ describe('CSP security headers', () => {
   it('public/_headers allows PostHog analytics', () => {
     assertAnalyticsCspDirectives(headersCsp, 'public/_headers');
   });
-
-  it('public/_headers allows LemonSqueezy billing', () => {
-    assertBillingCspDirectives(headersCsp, 'public/_headers');
-  });
 });

src/services/analytics.js

@@ -52,6 +52,8 @@ export function initPostHog() {
     rageclick: true,
     person_profiles: 'identified_only',
     session_recording: {
+      // Sample to stretch the free-tier 5k recordings/month.
+      sampleRate: 0.2,
       maskTextSelector: '.ph-no-capture, [data-sensitive]',
       maskAllInputs: true,
       maskAllMedia: true,

src/services/analyticsEvents.growth.test.js

@@ -0,0 +1,39 @@
+/**
+ * Copyright (c) 2025 Bayan Flow
+ * Licensed under Elastic License 2.0 OR Commercial
+ * See LICENSE for details.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import {
+  trackWaitlistJoined,
+  trackUpgradeLimitHit,
+  WAITLIST_JOINED,
+  UPGRADE_LIMIT_HIT,
+} from './analyticsEvents.js';
+import { captureEvent } from './analytics.js';
+
+vi.mock('./analytics.js', () => ({
+  captureEvent: vi.fn(),
+}));
+
+describe('analyticsEvents growth conversions', () => {
+  beforeEach(() => {
+    vi.mocked(captureEvent).mockClear();
+  });
+
+  it('tracks waitlist_joined with source and position', () => {
+    trackWaitlistJoined('pro_page', 3);
+    expect(captureEvent).toHaveBeenCalledWith(WAITLIST_JOINED, {
+      source: 'pro_page',
+      position: 3,
+    });
+  });
+
+  it('tracks upgrade_limit_hit with limit', () => {
+    trackUpgradeLimitHit(12);
+    expect(captureEvent).toHaveBeenCalledWith(UPGRADE_LIMIT_HIT, {
+      limit: 12,
+    });
+  });
+});