meet.boas.dev/dashboard
ACCESS GATE operator surface · sign-in required

Sign in

This surface is restricted to provisioned boas.dev operators.

sign-in failed — email or password incorrect. Attempts are logged and rate-limited.
session ended — you were signed out. Sign in again to continue to /dashboard.

After sign-in you return to the exact path you requested (?next=/dashboard contract — see design notes).

Operator access

meet.boas.dev/admin

Provisioned users, surface grants, and the access audit trail. Supabase Auth is the backing store — this console is the scoped view of it.

PROVISIONED USERS · 3
USERROLESURFACESLAST SIGN-INSTATUS
boas@boas.dev
provisioned 12 Jun 2026		 ADMIN meet calendar admin today · 21:14
meet.boas.dev/dashboard		 ACTIVE
ops@boas.dev
provisioned 12 Jun 2026		 OPERATOR meet calendar admin yesterday · 09:32
pantheon /calendar		 ACTIVE
contractor@example.is
provisioned 02 Jun 2026		 OPERATOR meet calendar admin 28 May · 14:02
meet.boas.dev/dashboard		 REVOKED

Password is handed over out-of-band (you tell them — no email is sent). User must change it at first sign-in. Nothing here ever emails anyone.

ACCESS AUDIT · last 24h filter: all surfaces
12 Jun · 21:14:02✓ sign-in boas@boas.dev → meet.boas.dev/dashboard
12 Jun · 21:13:48× sign-in failed boas@boas.dev (bad password, 1st attempt)
12 Jun · 18:40:11× blocked unprovisioned someone@gmail.com tried meet.boas.dev/dashboard
12 Jun · 14:22:39✓ sign-in ops@boas.dev → pantheon /calendar
12 Jun · 09:01:55⟳ session expired ops@boas.dev (12h limit) — re-authenticated
11 Jun · 23:54:10∆ grant change boas@boas.dev revoked contractor@example.is

Where the wall is

Operator ruling 2026-06-12: auth gates operator surfaces only. Recipient-facing routes stay public — the unguessable slug is the credential.

PUBLIC — recipients, no accounts capability-link model · unchanged
○meet.boas.dev/p/<slug>proposal negotiation page — recipients click from email
○meet.boas.dev/room/<slug>meeting room join — guests
○cal.boas.dev/boaspublic booker — proposal escape hatch links here
○cal.boas.dev/mebranded booking entry page
○/api/proposals/<slug>/respondaccept/vote/decline — slug-scoped, rate-limited
○hooks.boas.dev/webhook/cal-bookingCal webhook — HMAC-shielded (not auth'd by session)
WALLED — Supabase email+password provisioned operators only · no signup
●meet.boas.dev/dashboardmeeting review surface (replaces CF Access)
●meet.boas.dev/meoperator meeting view (replaces CF Access)
●meet.boas.dev/adminthis console — ADMIN role required
●pantheon /calendaroperator calendar app
●/api/meetings · /api/eventsoperator data APIs — session required
cal.boas.dev app routes (/auth/*, dashboard, settings) keep Cal.com's own native login — out of scope for this wall. CF Access stays up until the Supabase gate is live on each walled route — no window where a surface is open.