# Implementation Plan

## Checklist

1. Add core server modules:
   - JSON store read/write helpers.
   - Account/session/password helpers.
   - Role and permission definitions.
   - Audit logging helper.
   - Shared API response helpers.

2. Add auth APIs:
   - `GET /api/auth/bootstrap`
   - `POST /api/auth/setup`
   - `POST /api/auth/login`
   - `POST /api/auth/logout`
   - `GET /api/auth/session`

3. Migrate auth UI:
   - Update `AuthPanel` to call server APIs.
   - Update `SignOutButton` to call logout API.
   - Replace or bypass localStorage-only `AuthGate` with server session protection in the app layout.
   - Keep unauthenticated redirects and setup redirects working.

4. Add elder APIs and UI:
   - Create elder types and input validators.
   - Implement list/create/update/delete Route Handlers.
   - Replace `app/(app)/app/elders/page.tsx` static content with server-loaded CRUD UI.

5. Add settings/audit UI:
   - Implement settings/account, role, and audit APIs.
   - Replace `app/(app)/app/settings/page.tsx` static content with server-loaded tables.

6. Wire audit events:
   - Account setup/create.
   - Login/logout.
   - Elder create/update/delete.
   - Denied permission checks.

7. Verification:
   - Run `pnpm lint`.
   - Run `pnpm type-check`.
   - Run `pnpm build`.
   - Start dev server and manually exercise setup/login/CRUD/settings if build passes.

## Files Expected to Change

- `modules/auth/components/AuthPanel.tsx`
- `modules/auth/components/AuthGate.tsx`
- `modules/auth/components/SignOutButton.tsx`
- `app/(app)/app/layout.tsx`
- `app/(app)/app/elders/page.tsx`
- `app/(app)/app/settings/page.tsx`

## Files Expected to Be Created

- `modules/core/server/store.ts`
- `modules/core/server/auth.ts`
- `modules/core/server/permissions.ts`
- `modules/core/server/audit.ts`
- `modules/core/server/api.ts`
- `modules/elders/types.ts`
- `modules/elders/components/EldersClient.tsx`
- `modules/settings/components/SettingsOverview.tsx`
- `app/api/auth/bootstrap/route.ts`
- `app/api/auth/setup/route.ts`
- `app/api/auth/login/route.ts`
- `app/api/auth/logout/route.ts`
- `app/api/auth/session/route.ts`
- `app/api/elders/route.ts`
- `app/api/elders/[id]/route.ts`
- `app/api/settings/accounts/route.ts`
- `app/api/settings/roles/route.ts`
- `app/api/audit-logs/route.ts`

## Validation Commands

```bash
pnpm lint
pnpm type-check
pnpm build
pnpm dev
```

## Rollback Points

- If server auth blocks all app routes, revert only layout/AuthGate changes while keeping APIs.
- If elder CRUD UI is unstable, keep APIs and temporarily render a read-only server table.
- If file store causes build/runtime issues, move the data directory to `/tmp` behind the same store API for verification, then restore `.data` once filesystem assumptions are fixed.