Auth Entry

Pavri supports two dashboard entry modes:

• Local credentials for local development, evaluation, and self-hosted installs that are not using WorkOS SSO
• WorkOS-backed SSO for deployments that route sign-in through an identity provider

Current readiness

Area	Status	Notes
Protected-route redirect to /login	Live	Unauthenticated users are redirected before entering the dashboard shell.
Local username/password sign-in	Live	Used when WorkOS is not enabled.
WorkOS SSO entry	Live	The login screen routes users into the IdP flow when WorkOS is enabled.
SSO failure retry screen	Live	state=error now renders an SSO retry/support screen instead of a dead-end credential form.
Invite acceptance	Live	Invite flows are supported for tenant members.
Password reset / provider-specific recovery	Mixed	SSO tenants should use their IdP recovery flow; local-auth deployments can use the Pavri reset flow when enabled in their install.

What users see

• Unauthenticated requests to protected dashboard routes redirect to /login.
• Successful sign-in lands inside the dashboard shell, typically on Agents unless a specific next route was requested.
• If WorkOS is enabled, the login page presents an SSO-first entry experience.
• If the SSO flow fails and returns with state=error, the user now sees:
  • an explanation that SSO failed
  • a Retry SSO action
  • a support path

Pavri no longer renders a local credential form in WorkOS mode just because state=error is present.

Role-aware behavior after sign-in

Pavri currently separates post-login access into three dashboard roles:

Role	Typical access pattern
Admin	Full tenant access including members, tenant settings, detection configuration, policies, alert rules, and reports browse/export
Security Analyst	Operational and governance access including policies, alert rules, discovery, MCP review, protection profiles, and reports browse/export
Viewer	Read-only operational access with explicit denied/read-only states on protected write surfaces

The product now prefers explicit Access denied and Read-only states instead of silent redirects when a signed-in user reaches a page outside their role.

Local development

For local development and Playwright/E2E, the seeded dashboard accounts are:

• root.sec / super-secret-password
• analyst.one / analyst-password
• viewer.readonly / viewer-password

These seeded accounts are intended for non-production environments only.