Reference
Routes and Server Actions
The route tree and the inventory of server actions in kredal-app.
Public routes
| Route | Purpose |
|---|---|
/ | Landing page. |
/login | Sign in. Redirects to /app if already authenticated. |
/signup | Create an account. |
/pricing | Pilot-phase pricing. |
/security | Security & data-handling overview. |
Authenticated routes (/app/**, gated by proxy.ts)
| Route | Purpose |
|---|---|
/app | Dashboard: workspace's companies (or clients, for consultants). |
/app/companies/new | Create a company. |
/app/companies/[companyId] | Company detail + progress checklist. |
/app/companies/[companyId]/edit | Edit company profile. |
/app/companies/[companyId]/documents | Document vault + required-doc checklist. |
/app/companies/[companyId]/questionnaire | 8-section readiness questionnaire. |
/app/companies/[companyId]/assessment | Run and view the rejection-risk assessment. |
/app/companies/[companyId]/reports | Generate reports. |
/app/companies/[companyId]/reports/[reportId] | View / copy / export a report. |
Server actions
All mutations run server-side as the signed-in user (RLS-enforced). Each writes an
audit_events row. Located in kredal-app/src/app/actions/.
| Action | File | What it does |
|---|---|---|
signUp, signIn, signOut | auth.ts | Supabase email auth. |
createWorkspace | workspace.ts | Create a workspace + owner membership. |
createCompany, updateCompany | company.ts | Company CRUD. |
uploadDocument, deleteDocument, createSignedDocumentUrl | documents.ts | Private-storage upload, delete, and short-lived signed preview URLs. |
addOwner, deleteOwner | owners.ts | UBO / shareholder management. |
saveQuestionnaireSection | questionnaire.ts | Upsert answers for one section. |
runReadinessAssessment | assessment.ts | Score the company, snapshot the assessment, update status. |
generateReport | reports.ts | Render and store a Markdown report. |
Convention: forms and server actions
In a Server Component, always pass a server action to a form as a direct or bound reference:
<form action={createSignedDocumentUrl.bind(null, doc.storage_path)}>Never pass an inline closure (action={() => createSignedDocumentUrl(...)}) from a Server
Component — it is not serializable across the RSC boundary and throws "Functions cannot be
passed directly to Client Components". Client components ("use client") do not have this
restriction. This was a real bug fixed during live verification.