Getting Started
Features
Complete feature list of this SaaS boilerplate — authentication, billing, multi-tenancy, and more
Features are marked as: Implemented (working in code), Partial (scaffolded or basic implementation), or Planned (not yet built).
| Feature | Status | Notes |
|---|
| Email & Password | Implemented | Traditional email/password via Better Auth with email verification |
| OAuth (Google, GitHub) | Implemented | Third-party sign-in via Better Auth plugins |
| Magic Links | Implemented | Passwordless email link authentication (10-min expiry) |
| Email OTP | Implemented | One-time password via email (5-min expiry) |
| Two-Factor Authentication (2FA) | Implemented | TOTP + backup codes at password sign-in. Magic link, email OTP, and OAuth skip 2FA |
| Account Linking | Implemented | Link multiple social providers (Google, GitHub) to one account |
| Multi-Session Support | Implemented | Concurrent sessions with device tracking |
| Session Management | Implemented | Secure cookie-based sessions with IP/UA tracking (7-day expiry) |
| Feature | Status | Notes |
|---|
| Sign-Up | Implemented | User registration with email verification enforced |
| Password Reset | Implemented | Reset-token email, not the verification flow |
| Profile Management | Implemented | Update name at /account/profile (no avatar uploader) |
| Security Settings | Implemented | View active sessions, enable/disable 2FA at /account/security |
| Account Deletion | Implemented | Delete account with confirmation at /account/danger |
| Email Change | Planned | Not yet implemented |
| Page | Route | Description |
|---|
| Sign In | /auth/sign-in | Email, password, social, magic link, OTP options |
| Sign Up | /auth/sign-up | Registration with email verification |
| Forgot Password | /auth/forgot-password | Password reset request |
| Reset Password | /auth/reset-password | Password reset with token |
| Verify Email | /auth/verify-email | Email verification flow |
| Two-Factor | /auth/2fa | 2FA challenge screen |
Staff surface at /admin, gated on platform User.role (not org Member.role). Dual RBAC: see Authentication.
| Feature | Status | Notes |
|---|
| User list and detail | Implemented | /admin/users, /admin/users/[userId] |
| Organization list and detail | Implemented | /admin/organizations, /admin/organizations/[orgId] |
| Impersonation | Implemented | Staff can impersonate a non-admin user |
| Ban / unban | Implemented | Staff can ban a user |
| Feature | Status | Notes |
|---|
| Multiple Organizations per User | Implemented | Up to 10 orgs per user (configurable) |
| Organization Creation | Implemented | Create new orgs at /account/new-org |
| Auto Personal Workspace | Planned | Sign-up creates no organization — no scaffold in the repo |
| Organization Settings | Implemented | Configure name, logo, slug at /[orgSlug]/settings |
| Organization Switcher | Implemented | Sidebar dropdown. /org is a post-login redirect hop, not a switcher UI |
| Default Organization | Implemented | Set and remember preferred org |
| Member Management | Implemented | Invite, remove, and transfer ownership at /[orgSlug]/members |
| Role-Based Access Control | Implemented | Owner, Admin, Member org roles |
| Member Suspension | Planned | No suspendedAt (or similar) on Member — membership is role + org only |
| Member Invitations | Implemented | Email-based invitations with 7-day expiry |
| Bulk Invitations | Implemented | Invite multiple members at once |
| Resend Invitations | Implemented | Re-send pending invitations |
| Invite Links | Implemented | Shareable links with max uses and expiry |
| Revoke Invite Links | Implemented | Deactivate and bulk-revoke links |
| Teams within Organizations | Partial | Schema exists (Team, TeamMember models), UI not built |
| Plan | Members | Storage | Price |
|---|
| Free | 1 | 100 MB | $0 |
| Pro | 10 | 5 GB | $19/mo or $190/yr |
| Enterprise | 50 | 50 GB | $49/mo or $490/yr |
Organization creation isn't plan-gated by count — it's capped at 10 total orgs per user (MAX_ORGS_PER_USER) regardless of plan, and only 1 free-tier org is allowed per user (additional orgs require a paid plan). Teams have no per-plan limit since the feature has no UI yet (see below).
| Feature | Status | Notes |
|---|
| Subscription Plans | Implemented | Free, Pro ($19/mo), Enterprise ($49/mo) |
| Plan Upgrade/Downgrade | Implemented | First paid sub via Checkout. Existing upgrades use the portal. Paid downgrades use changePlanAction + a period-end schedule |
| Monthly & Annual Billing | Implemented | Annual discount (~17% savings) |
| Cancellation | Implemented | Cancel at period end and reactivate; paused is a Stripe status with no app UI |
| Stripe Integration | Implemented | Checkout, webhooks, customer portal |
| Auto Customer Creation | Implemented | Stripe customer created on first checkout, not on signup (createCustomerOnSignUp: false) |
| Webhook Processing | Implemented | Idempotent Stripe event handling with deduplication |
| Checkout Flow | Implemented | Checkout with success and canceled pages |
| Manage Billing | Implemented | Update payment methods via Stripe portal |
| Usage Stats | Implemented | Display resource usage per org |
| Free Org Limit | Implemented | Max 1 free org per user; additional require paid plan |
| Trial Period | Partial | Schema has trialStart/trialEnd; trialing is in ACTIVE_STATUSES. Checkout does not start trials |
| Invoice History | Planned | View past invoices (via Stripe portal link only) |
| Usage-Based Pricing | Planned | Not implemented |
| Coupon Support | Planned | Not implemented |
| Feature | Status | Notes |
|---|
| Multiple Languages | Implemented | English, Spanish, French, German, Portuguese, Chinese |
| Locale-Based Routing | Implemented | /[locale]/... URL structure |
| Language Switching | Partial | Locale in the URL (/[locale]/…). No language selector in the UI |
| SEO-Friendly URLs | Implemented | Locale in URL path |
| Dictionary-Based Translations | Implemented | Type-safe dictionary access with English fallback |
| Translation Workflow | Implemented | Locale JSON translated by hand or with AI coding agents |
| RTL Support | Planned | Not implemented |
| Feature | Status | Notes |
|---|
| File Upload | Implemented | uploadOrganizationLogoAction server action — MIME/size validation, org permission, per-plan quota |
| Local Storage | Implemented | Local filesystem storage provider |
| S3 Storage | Implemented | AWS S3 provider with configurable credentials |
| Per-Plan Storage Quotas | Implemented | 100 MB / 5 GB / 50 GB per plan |
| File Metadata | Implemented | Tracks filename, size, mime type, provider |
| Allowed Types | Implemented | JPEG, PNG, WebP, GIF |
| Soft Delete | Implemented | Files can be soft-deleted with timestamp |
| File Sharing | Planned | Not implemented |
| File Versioning | Planned | Not implemented |
| Feature | Status | Notes |
|---|
| Email Preview | Implemented | Preview templates in email app (port 3003) |
| Email Templating | Implemented | React Email templates in packages/email/ — wired subset vs preview-only; see Templates |
| Resend Integration | Implemented | Primary email provider via Resend API |
| Nodemailer (SMTP) | Implemented | Fallback SMTP provider |
| Pluggable Providers | Implemented | Swap between Resend and Nodemailer |
Wired today (Better Auth hooks + Stripe hooks): email verification, password reset, magic link, sign-in OTP, verification OTP, 2FA OTP, org invitation, subscription started / upgraded / downgraded / cancelled.
The rest of packages/email/templates/ exist for preview only — they are not sent. See Templates.
| Feature | Status | Notes |
|---|
| Security Headers | Implemented | HSTS, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection |
| Content Security Policy | Implemented | Per-request nonce-based CSP |
| CSRF Protection | Implemented | Origin header validation on server actions |
| Permissions Policy | Implemented | Disables camera, microphone, geolocation, payment, USB |
| Password Hashing | Implemented | Via Better Auth's default hasher (scrypt) |
| Session Security | Implemented | Secure cookies, 7-day expiry, revocation on password reset |
| Webhook Signature Verification | Implemented | Stripe webhook signature validation |
| Idempotent Webhook Processing | Implemented | WebhookEvent deduplication model |
| SQL Injection Prevention | Implemented | All queries via Prisma ORM (parameterized); one static $queryRaw health check with no user input |
| Edge Route Protection | Implemented | middleware.ts — optimistic cookie-presence gate; real auth checks happen server-side |
| Rate Limiting | Implemented | Per-route limits (sign-in, sign-up, password reset, 2FA) via Better Auth, backed by a database-stored RateLimit model |
| Feature | Status | Notes |
|---|
| Structured Logging | Implemented | Pino logger (separate server + client exports) |
| Health Check | Implemented | /api/health endpoint with database + auth validation |
| Error Boundaries | Implemented | React error boundary components |
| Feature | Status | Notes |
|---|
| Per-Page Metadata | Implemented | Static export const metadata on several pages overrides the root title template; no route uses generateMetadata for param-based dynamic titles |
| Open Graph | Implemented | OG tags for social sharing (root layout only) |
| Twitter Cards | Implemented | Twitter card metadata (root layout only) |
| JSON-LD | Implemented | Organization + WebSite schemas only (see SEO) |
| Sitemap | Partial | sitemap.ts returns a single static homepage entry, no dynamic route enumeration |
| Canonical URLs | Implemented | Canonical link tag (root layout only) |
| Feature | Status | Notes |
|---|
| UI Components | Implemented | 50+ shadcn/ui components (Radix-based) |
| Landing Page Blocks | Implemented | 12 blocks: hero, pricing, testimonials, FAQ, CTA banner, features grid, feature showcase, code preview, tech stack, deps table, social proof bar, stats section (footer is components/molecules/footer/) |
| Dark Mode | Partial | ThemeProvider follows the system preference. No in-app toggle |
| Responsive Design | Implemented | Mobile-first responsive layouts |
| Direct Imports | Partial | Convention is no barrel imports. Remaining package entry: packages/design-system/index.tsx (@repo/auth also has a main of ./index.ts — prefer @repo/auth/server etc.) |
| Feature | Status | Notes |
|---|
| TypeScript | Implemented | Full type safety across all packages |
| Turborepo | Implemented | Build orchestration with caching |
| Component Library | Implemented | shadcn/ui components via design-system package |
| Storybook | Implemented | Component documentation (port 6006) |
| Documentation Site | Implemented | Customer docs: Fumadocs starter apps/docs (port 3004). Kit docs: root docs/ / kit-docs (port 3006), excluded from pnpm dev |
| Email Preview | Implemented | React Email preview app (port 3003) |
| Prisma Studio | Implemented | Database inspection (port 3005) |
| Biome Linting | Implemented | Automated linting and formatting via ultracite |
| Hot Module Reload | Implemented | Fast development refresh via Turbopack |
| Code Generation | Implemented | Prisma schema to TypeScript types |
| Feature | Status | Notes |
|---|
| Unit Tests | Partial | Vitest in @repo/auth, apps/web, and @repo/database (redact.test.ts). @repo/storage / @repo/utils have no test setup. See Testing |
| E2E Tests | Implemented | Playwright specs under apps/web/e2e/ (see Testing) |
| Integration Tests | Planned | Not yet implemented |
| Feature | Status | Notes |
|---|
| Monorepo Setup | Implemented | pnpm workspaces with Turborepo |
| Database Migrations | Implemented | pnpm migrate = format + generate + db push. Not prisma migrate dev |
| Database Seeding | Implemented | Comprehensive seed script |
| CI/CD | Implemented | GitHub Actions workflows |
| Docker Support | Partial | Dockerfiles exist for web and docs; email, storybook, studio do not have one |
| Package | Features |
|---|
@repo/auth | Authentication, dual RBAC (admin + org), permissions, 2FA, magic links, email OTP, Stripe billing, subscriptions, plan management, checkout |
@repo/database | Prisma schema, client, types, migrations |
@repo/email | React Email templates with Resend + Nodemailer |
@repo/design-system | 50+ shadcn/ui components, 12 landing page blocks, dark mode |
@repo/storage | File uploads with local + S3 providers, quota management |
@repo/seo | Site metadata, Organization + WebSite JSON-LD schemas |
@repo/internationalization | 6 languages, locale routing, dictionary translations |
@repo/logger | Console-backed logging, one universal export (@repo/logger/log) |
@repo/utils | Date, payment, slug, organization, storage, user utilities |
| App | Port | Features |
|---|
web | 3000 | Authentication, billing, org management, account settings, file uploads, platform /admin |
docs | 3004 | Customer's product documentation (empty Fumadocs starter) |
email | 3003 | Email template preview (React Email) |
storybook | 6006 | Component showcase and design system |
studio | 3005 | Database inspection (Prisma Studio) |
kit-docs (root docs/) | 3006 | SaaSProKit's own documentation; excluded from pnpm dev / pnpm build |
