# League Master portal (hidden from public UI)

The home page and manager signup only show the **Team Manager** flow. League Master access is via direct URLs (bookmark these).

| Page | URL |
|------|-----|
| Sign in | `/login/master` |
| Forgot password | `/forgot-password/master` |
| Sign up | `/signup/master` |
| Dashboard | `/master` |
| Leagues | `/master/leagues` |
| Players | `/master/players` |
| Issues inbox | `/master/issues` |

## Layout (same shell as managers)

```
┌──────────────┬─────────────────────────────────────────────┐
│ Sidebar      │ Top bar: search · notifications · settings  │
│ · Dashboard  ├─────────────────────────────────────────────┤
│ · Leagues    │ Page title + actions                        │
│ · Players    │ KPI cards (4-col grid)                      │
│ · Issues     │ Main content cards / tables                 │
│              │ Footer (Yaltopia link)                      │
│ [User]       │                                             │
│ Sign out     │                                             │
└──────────────┴─────────────────────────────────────────────┘
```

Accounts must have `profiles.portal_role = 'league_master'`.

## Signup 500 / "Database error saving new user"

If master signup fails with **500**, Supabase could not insert the `profiles` row (auth trigger).

1. Apply migrations: `npm run db:push` (includes `20250524000008_fix_signup_trigger.sql`)
2. Or paste `supabase/scripts/fix-signup-trigger.sql` into the SQL Editor and run it
3. Add to `.env.local` for reliable dev signup (never commit):

```env
SUPABASE_SERVICE_ROLE_KEY=...   # Dashboard → Settings → API → service_role
SUPABASE_AUTO_CONFIRM_EMAIL=true   # optional: skip email confirm in dev
```

Restart `npm run dev`, then try `/signup/master` again.

**Team Manager forgot password:** `/forgot-password/manager` (linked from manager sign-in).

### Supabase Auth redirect URLs

Add these under **Authentication → URL configuration → Redirect URLs**:

```
http://localhost:3000/auth/callback
http://localhost:3000/reset-password
```

Use your production domain in production (e.g. `https://your-app.com/auth/callback`).