Gate tools login with Caveau access

README.md

@@ -1,10 +1,10 @@
 # Do Better Norge Legal Tools Hub
 
-MVP docroot for `tools.dobetternorge.com`.
+MVP docroot for `tools.dobetternorge.no`.
 
 ## Required environment
 
-- `DBN_TOOLS_PASSCODE_HASH`
+- CaveauAI client access for `DBN_CAVEAU_CLIENT_SLUG` and `DBN_CAVEAU_PACKAGE_SLUG`
 - `DBN_AZURE_OPENAI_ENDPOINT`
 - `DBN_AZURE_OPENAI_API_KEY`
 - `DBN_AZURE_OPENAI_API_VERSION`
@@ -14,15 +14,21 @@ MVP docroot for `tools.dobetternorge.com`.
 Optional:
 
 - `DBN_AI_PORTAL_ROOT` (defaults to sibling `ai-portal`)
-- `DBN_CAVEAU_CLIENT_SLUG` (defaults to `dave-jr-legal`)
+- `DBN_CAVEAU_CLIENT_SLUG` (defaults to `dobetter`)
+- `DBN_CAVEAU_PACKAGE_SLUG` (defaults to `family-legal`)
 - `DBN_TOOLS_SUPPORT_DIR`
 - `DBN_TOOLS_METADATA_LOG`
 
-Create the passcode hash with:
+## Authentication
 
-```bash
-php -r "echo password_hash('replace-this-passcode', PASSWORD_DEFAULT), PHP_EOL;"
-```
+The login form authenticates against Caveau `client_users` for the configured
+client slug. The client must be active, the user must be active, and the client
+must have an active subscription to the configured corpus package.
+
+Use `scripts/setup-caveau-access.php` for repeatable local/production setup of
+the Do Better Norge Caveau owner account, family-legal subscription, and
+white-label domain mappings. Pass the account password through
+`DBN_SETUP_PASSWORD` at runtime only; do not commit it.
 
 The APIs process pasted text in memory and write only metadata such as tool name,
 latency, language, source count, chunk count, deployment, and anonymous session id.