# Mega Plant accounts

Open **Account → Settings** at the top right. The users table lists names, emails, active/inactive status and whether first sign-in is pending. **Make inactive** blocks app login and existing sessions on their next request, while retaining the user's password and onboarding state. **Reactivate** restores access. **Delete** opens a confirmation and permanently removes the user and their private access state. You cannot disable or delete your own account. All users have the same permissions, including managing other users.

Add users in **Settings → Add user**, using their name and email. The app assigns **mega2026**. They must choose a different password of at least eight characters on their first sign-in. No uppercase, number or special-character rules apply.

You can also create accounts directly in PocketBase's **users** auth collection: set name, email, password and password confirmation to **mega2026**. Use a regular `users` account for the app; PocketBase `_superusers` accounts are for database administration. Every manually created account also goes through the password-change step.

Run `npm run setup:auth` once per PocketBase environment, and again when upgrading an environment with the original login feature. It adds or upgrades the private `user_onboarding` collection, including a `disabled` boolean, without changing existing users or collection permissions. Missing access state means active with first sign-in pending. Onboarding records are created after password changes or access changes, and are removed when the related user is deleted.

The app server needs `NEXT_PUBLIC_PB_URL`, `PB_ADMIN` and `PB_PASS` at runtime. `PB_ADMIN` and `PB_PASS` remain server-only and are used for provisioning accounts and maintaining private onboarding state. Keep the existing PocketBase URL build argument for deployment. No seed/reimport is needed.

App pages and API routes require a signed-in user who has completed onboarding; `/api/health` stays public, and POST `/api/auth/logout` only validates the origin and removes the local cookie. Existing direct PocketBase endpoint rules were deliberately deferred, so the login does not restrict direct access to those public database APIs. This change adds application authentication only.

The PWA precaches static assets only. Protected pages and API responses use the network, and sign-out removes the session cookie and browser caches.

Verification: `npm test`, `npm run typecheck`, `npm run build`. For disposable real-backend integration tests: `MEGA_AUTH_INTEGRATION=1 node --env-file=.env.local --import tsx --test lib/auth-service.test.ts`. The tests remove their users, with onboarding state cascading on deletion.