Authentication, Onboarding & User Lifecycle

Target Audience: All Staff, Partner Admins, Organization Admins & Volunteers

This manual details the entire user identity lifecycle from initial invitation and phone verification through daily operations and session logout.

Overview

Dream Center Connect utilizes a role-based identity system with multi-factor verification to secure constituent data, prevent unauthorized access, and ensure traceability across all actions.

graph TD
    Start["User Journey"] --> Signin["1. Sign In (/sign-in)"]
    Signin --> ProfileCheck{"Is Profile Complete & Phone Verified?"}
    ProfileCheck -->|No| CompleteProfile["2. Complete Profile & SMS OTP Verification (/complete-profile)"]
    ProfileCheck -->|Yes| OrgCheck{"Is Org / Partner Assigned?"}
    OrgCheck -->|No| PendingScreen["3. Pending Org Approval (/pending)"]
    OrgCheck -->|Yes| Workspace["4. Assigned Workspace (/staff, /partner-admin, /org-admin)"]
    Workspace --> ProfileUpdate["5. Profile Settings (/profile)"]
    ProfileUpdate --> Logout["6. Sign Out & Token Revocation"]

---

1. Staff & Admin Sign-in

1. Open the application and navigate to /sign-in.
2. Choose your preferred authentication method:
   • Email & Password: Enter your registered Email Address and Password, then click Sign In.
   • Single Sign-On (SSO): Click Sign in with Google for one-click corporate identity authentication.
3. The system evaluates your session token, role claims, and organization mapping:
   • Organization Admins → /org-admin/home
   • Partner Admins → /partner-admin/home
   • Staff Members → /staff/home

First-Time Google Sign-In

Users signing in with Google for the first time must still complete the mandatory 2-step phone OTP verification sequence below (/complete-profile) before access to organizational workspaces is granted.

---

2. Profile Setup & Mandatory 2-Step Phone OTP Verification

When an invited user or newly registered administrator first signs in, they are automatically routed to /complete-profile:

1. Personal Name Details

   Enter your First Name and Last Name.

2. Mobile Phone Number Entry & SMS OTP Dispatch

   Enter your 10-digit mobile phone number and click Send Verification Code.

   • The backend dispatches an SMS message containing a 6-digit one-time passcode (OTP).
   • Rate Limiting: OTP requests are throttled (maximum 3 attempts per 5 minutes) to protect SMS capacity.

3. Verification Code Confirmation

   Enter the 6-digit code into the verification input and click Verify & Continue.

   • Upon successful verification, the phone number is permanently verified and linked to your user identity for kiosk check-in validation.

4. Password Setting (For Email Invitations)

   Set and confirm a compliant password meeting security complexity rules:

   • Minimum 8 characters.
   • At least 1 uppercase letter and 1 lowercase letter.
   • At least 1 numeric digit and 1 special character.

5. Complete Setup & Workspace Entry

   Click Complete Setup to activate your profile and proceed to your dashboard.

---

3. Password Reset & Recovery Exchange

If a user forgets their password:

1. Click Forgot Password? on the /sign-in screen.
2. Enter your registered email address and submit.
3. You will receive an email containing a secure password reset link.
4. Clicking the link opens /reset-password with an embedded recovery token exchange parameter (#access_token or ?code=).
5. Enter a new compliant password, confirm, and click Update Password.
6. The active session updates automatically, and you are routed to your workspace.

---

4. Pending Approval State

If a user authenticates successfully but has not yet been assigned to an organization or partner program:

• The application displays the Pending Approval Screen (/pending).
• Displays a notification indicating that an Organization Administrator must assign an active partner role before sensitive records can be viewed.
• Users can click Refresh Status or Sign Out.

---

5. User Profile Settings & Session Sign-Out

Every signed-in user can manage their account settings:

Accessing Profile Settings

1. Click your User Avatar / Initials in the top navigation bar or sidebar footer.
2. Select Profile Settings (or open /profile).

Modifying Profile Information

• Update First Name and Last Name.
• Change your Mobile Phone Number (triggers the SMS OTP verification sequence for the new number).
• Review read-only account metadata: Email Address, Assigned Roles, and Organization Affiliation.
• Click Save Changes.

Logging Out

1. Open the user dropdown menu in the top bar or sidebar.
2. Click Sign Out.
3. The platform clears local session tokens, revokes client authentication headers, and redirects to the public landing page.

---

6. Kiosk & Volunteer Authentication Nuances

• Kiosk Tablets: Physical terminals authenticate using a 6-Character Join Code generated by administrators. No staff username or password is stored on walk-up devices (→ Kiosk Pairing Manual).
• Volunteers: Volunteers authenticate exclusively at kiosks using their 10-digit mobile phone number. They do not require portal login credentials or email invitations.