# Sponzza — Backend & Auth Setup (v0.2)

This version adds two things that need a backend:
- **SOC + salary match** (Salary tab) → a Cloudflare Worker that calls Claude.
- **Sign-in** (Google + email) → Supabase.

Both have free tiers. Do the four steps below, fill in `src/config.js`, reload the extension.

---

## 1. Deploy the Cloudflare Worker (SOC-AI)

```bash
cd worker
npm install
npx wrangler login                       # opens browser, free account
npx wrangler secret put ANTHROPIC_API_KEY # paste your Anthropic API key
npx wrangler deploy
```

Wrangler prints a URL like `https://sponzza-soc.<you>.workers.dev`. Copy it.

> The Anthropic key lives only in the Worker secret — never in the extension.
> Cloudflare Workers free tier = 100,000 requests/day, no cold start.
> The Claude calls themselves are metered by Anthropic (cheap on Haiku; each role is analysed once).

If you ever change the going-rates CSV, re-run `node build-rates.js your.csv` (regenerates `worker/soc-list.js`) and `npx wrangler deploy` again.

---

## 2. Create the Supabase project (auth)

1. Create a free project at supabase.com.
2. **Project Settings → API**: copy the **Project URL** and the **anon public** key.
3. **Authentication → Providers → Email**: ensure it's enabled (on by default).
4. To get a **6-digit code** instead of a magic link in the email: **Authentication → Email Templates → Magic Link**, and make sure the template includes the token, e.g. add a line with `{{ .Token }}`.

## 3. (Optional) Google sign-in

1. In Supabase: **Authentication → Providers → Google** → enable, and paste a Google OAuth **client ID + secret** (create them in Google Cloud Console → Credentials → OAuth client → Web application).
2. In Supabase **Authentication → URL Configuration → Redirect URLs**, add your extension's redirect:
   `https://<EXTENSION_ID>.chromiumapp.org/`
   (the extension ID is shown on `chrome://extensions` after you load it).
3. In Google Cloud, add that same redirect URL to the OAuth client's authorised redirect URIs.

Email sign-in works without any of step 3.

---

## 4. Fill in config and reload

Edit `src/config.js`:

```js
WORKER_URL: 'https://sponzza-soc.<you>.workers.dev',
SUPABASE_URL: 'https://<project>.supabase.co',
SUPABASE_ANON_KEY: '<anon public key>',
```

Then `chrome://extensions` → reload Sponzza → refresh LinkedIn (Cmd+R).

---

## Using it

- **Salary tab** → open a job → **Analyse this role with AI** → shows the SOC 2020 code, official title, going rate, the required salary (higher of the £41,700 general threshold or the going rate), and a pass/fail if a salary is on the listing. Toggle **new entrant** for the reduced £30,960 / lower-rate path — relevant for under-26s and Graduate-visa switchers.
- **Account icon** (top right) → sign in by email code or Google.

## Keep accurate

The thresholds in `config.js` (`£41,700` standard, `£30,960` new entrant, `£17.13/hr`) and the going-rates CSV are uprated by the Home Office each April — update them yearly. Figures are indicative; always verify against gov.uk Appendix Skilled Occupations before relying on them.

---

## 5. Per-user storage (Tracker + résumés)

Run the schema once: Supabase → **SQL Editor → New query** → paste the contents of
`supabase-schema.sql` → **Run**. This creates a private `activity` table and a
`resumes` storage bucket, both locked to each signed-in user by row-level security.

After that, every role a signed-in user opens is saved automatically (company, title,
sponsorship status), surfaced in the **Tracker** tab; "Mark as applied" updates the row,
and résumés upload to the user's private folder from the account screen.

> Sign-in is **Google-only** and gates the panel — users sign in first, then see the tabs.
