From cfb8bc0f5f17b4632fd862baae74aa81168fe074 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Tue, 7 Oct 2025 16:28:37 -0700
Subject: [PATCH 01/16] ACHOO-114: initial stub of email functionality

---
 app/api/email/daily-summary/route.ts | 94 ++++++++++++++++++++++++++++
 vercel.json                          |  8 +++
 2 files changed, 102 insertions(+)
 create mode 100644 app/api/email/daily-summary/route.ts
 create mode 100644 vercel.json

diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
new file mode 100644
index 0000000..05fb2ab
--- /dev/null
+++ b/app/api/email/daily-summary/route.ts
@@ -0,0 +1,94 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { Resend } from 'resend';
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+export async function POST(request: NextRequest) {
+  // Verify cron secret to prevent unauthorized calls
+  const authHeader = request.headers.get('authorization');
+  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    // Calculate current month metrics
+    const now = new Date();
+    const firstOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+    const daysInMonth = new Date(now.getFullYear(), now.getMonth() + 1, 0).getDate();
+    const dayOfMonth = now.getDate();
+    const monthProgress = dayOfMonth / daysInMonth;
+
+    // Get entitlements from env
+    const viewsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VIEWS_ENTITLEMENT || '0');
+    const visitsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VISITS_ENTITLEMENT || '0');
+
+    // Expected usage at this point in month
+    const expectedViews = Math.round(viewsEntitlement * monthProgress);
+    const expectedVisits = Math.round(visitsEntitlement * monthProgress);
+
+    // Fetch actual usage (you'll need to implement this)
+    const actualUsage = await fetchCurrentMonthUsage();
+
+    // Calculate percentages
+    const viewsPercentage = (actualUsage.views / viewsEntitlement) * 100;
+    const visitsPercentage = (actualUsage.visits / visitsEntitlement) * 100;
+
+    const viewsOnTrack = actualUsage.views <= expectedViews;
+    const visitsOnTrack = actualUsage.visits <= expectedVisits;
+
+    // Send email
+    await resend.emails.send({
+      from: 'CHURRO <noreply@yourdomain.com>',
+      to: ['your-email@stanford.edu'],
+      subject: `CHURRO Daily Summary - ${now.toLocaleDateString()}`,
+      html: generateEmailHTML({
+        date: now,
+        monthProgress: monthProgress * 100,
+        dayOfMonth,
+        daysInMonth,
+        actualUsage,
+        expectedViews,
+        expectedVisits,
+        viewsEntitlement,
+        visitsEntitlement,
+        viewsPercentage,
+        visitsPercentage,
+        viewsOnTrack,
+        visitsOnTrack
+      })
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('Email sending failed:', error);
+    return NextResponse.json({ error: 'Failed to send email' }, { status: 500 });
+  }
+}
+
+async function fetchCurrentMonthUsage() {
+  // Implement your logic to fetch current month's views/visits
+  // This would call your existing Acquia API endpoints
+  const subscriptionUuid = process.env.NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID;
+
+  // You'll need to aggregate data across all applications
+  // Return format: { views: number, visits: number }
+  return { views: 0, visits: 0 }; // Placeholder
+}
+
+function generateEmailHTML(data: any) {
+  return `
+    <h1>CHURRO Daily Usage Summary</h1>
+    <p><strong>Date:</strong> ${data.date.toLocaleDateString()}</p>
+    <p><strong>Month Progress:</strong> ${data.dayOfMonth}/${data.daysInMonth} days (${data.monthProgress.toFixed(1)}%)</p>
+
+    <h2>Views Usage</h2>
+    <p><strong>Actual:</strong> ${data.actualUsage.views.toLocaleString()} / ${data.viewsEntitlement.toLocaleString()} (${data.viewsPercentage.toFixed(1)}%)</p>
+    <p><strong>Expected at this point:</strong> ${data.expectedViews.toLocaleString()}</p>
+    <p><strong>Status:</strong> ${data.viewsOnTrack ? '✅ On track' : '⚠️ Over expected usage'}</p>
+
+    <h2>Visits Usage</h2>
+    <p><strong>Actual:</strong> ${data.actualUsage.visits.toLocaleString()} / ${data.visitsEntitlement.toLocaleString()} (${data.visitsPercentage.toFixed(1)}%)</p>
+    <p><strong>Expected at this point:</strong> ${data.expectedVisits.toLocaleString()}</p>
+    <p><strong>Status:</strong> ${data.visitsOnTrack ? '✅ On track' : '⚠️ Over expected usage'}</p>
+  `;
+}
\ No newline at end of file
diff --git a/vercel.json b/vercel.json
new file mode 100644
index 0000000..0772313
--- /dev/null
+++ b/vercel.json
@@ -0,0 +1,8 @@
+{
+  "crons": [
+    {
+      "path": "/api/email/daily-summary",
+      "schedule": "0 9 * * *"
+    }
+  ]
+}
\ No newline at end of file

From fce19ff5b6a2bd5fe9f7c00349222ebcc8bac6c3 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 12:38:29 -0800
Subject: [PATCH 02/16] ACHOO-114: Daily email summaries

---
 .github/copilot-instructions.md      | 277 +++++++++++++++++++++++++++
 app/api/email/daily-summary/route.ts | 196 ++++++++++++++++---
 app/api/test/email/route.ts          |  49 +++++
 docs/EMAIL-CONFIGURATION.md          | 140 ++++++++++++++
 lib/acquia-api.ts                    |   7 +
 package-lock.json                    | 100 +++++++++-
 package.json                         |   3 +-
 7 files changed, 747 insertions(+), 25 deletions(-)
 create mode 100644 .github/copilot-instructions.md
 create mode 100644 app/api/test/email/route.ts
 create mode 100644 docs/EMAIL-CONFIGURATION.md

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 0000000..9fb604d
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,277 @@
+# CHURRO - AI Development Guidelines
+
+## Project Overview
+**CHURRO** (Cloud Hosting Usage Reporting with Recurring Output) is a Next.js 15 dashboard for visualizing Acquia Cloud hosting analytics (views/visits data). Built for Stanford University with Stanford Design System (Decanter) styling, basic HTTP authentication, and daily email reporting.
+
+## Architecture
+
+### Tech Stack
+- **Framework**: Next.js 15.5+ (App Router only, no Pages Router)
+- **Runtime**: Node.js 22.x (enforced via package.json engines)
+- **Styling**: TailwindCSS with Decanter preset (Stanford Design System)
+- **Authentication**: Basic HTTP Authentication via middleware
+- **Data Viz**: Recharts for charts/graphs
+- **Email**: Resend.com for daily summary emails
+- **Deployment**: Vercel
+
+### Key Components
+
+**API Routes** (`app/api/`):
+- `/api/acquia/applications` - Fetches all Acquia applications
+- `/api/acquia/visits` - Fetches visits metrics with pagination
+- `/api/acquia/views` - Fetches views metrics with pagination
+- `/api/email/daily-summary` - Sends daily usage summary emails (cron job)
+- `/api/test/email` - Test endpoint for email functionality
+
+**Core Services** (`lib/`):
+- `lib/acquia-api.ts` - Acquia Cloud API client with 6-hour caching and pagination
+
+**Data Flow**:
+1. User accesses application → Basic auth via middleware
+2. Dashboard fetches from `/api/acquia/*` routes
+3. API routes use `AcquiaApiServiceFixed` with OAuth2 client_credentials flow
+4. Response data parsed from Acquia's nested `_embedded.items[].datapoints[]` structure
+5. Data cached in-memory for 6 hours with cache keys based on query params
+
+## Development Patterns
+
+### Environment Variables
+**Required** (stored in `.env.local`, never committed):
+- `ACQUIA_API_KEY` / `ACQUIA_API_SECRET` - OAuth2 credentials (no quotes)
+- `ACQUIA_API_BASE_URL` / `ACQUIA_AUTH_BASE_URL` - API endpoints (optional, defaults provided)
+- `NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID` - Subscription identifier
+- `NEXT_PUBLIC_ACQUIA_MONTHLY_{VIEWS|VISITS}_ENTITLEMENT` - Usage limits
+
+**Email Reporting** (optional, for daily summary emails):
+- `RESEND_API_KEY` - Resend.com API key for email delivery
+- `FROM_EMAIL` - Sender email address (use onboarding@resend.dev for testing)
+- `ADMIN_EMAIL` - Recipient email for daily summaries
+- `CRON_SECRET` - Protects cron endpoint from unauthorized access
+- `APP_URL` - Application URL for email links (optional, inferred from request)
+
+**Critical**: Values must NOT have surrounding quotes. API key/secret are auto-stripped of quotes in `acquia-api.ts` (lines 91-92).
+
+### Authentication
+
+**Basic HTTP Authentication** (`middleware.ts`):
+- Username: `sws`
+- Password: `sws`
+- Protects all routes except `/_next`, `/api/public`, `/favicon.ico`
+- Allows localhost access (IPv4/IPv6) without authentication
+- Returns 401 with WWW-Authenticate header for protected resources
+
+### Stanford Design System (Decanter)
+
+**Colors** - Use semantic Decanter tokens, NOT hex values:
+- Primary: `cardinal-red` (Stanford brand red)
+- Accents: `digital-blue`, `digital-green`
+- Grays: `black-{10,20,60,80}`, `gc-black`
+- **Never use**: Custom hex colors unless explicitly non-Stanford branding
+
+**Typography**:
+- Headings: `type-{0,1,2,3,4}` classes (defined in Decanter)
+- Body: `Source_Sans_3` (imported in `app/layout.tsx`)
+- Serif: `Source_Serif_4` for emphasis
+- Display: Custom `stanford` font (local woff2)
+
+**Interaction States**:
+- Use `hocus:` prefix for hover+focus states (Decanter utility)
+- Example: `hocus:bg-black hocus:text-white`
+
+**Spacing**:
+- Use Decanter scale: `p-{5,8,10,15,20,25,30,50}` (not arbitrary values)
+- Responsive: `px-20 sm:px-30 md:px-50 lg:px-30`
+
+### Acquia API Integration
+
+**Authentication** (`lib/acquia-api.ts` lines 81-177):
+- OAuth2 client credentials flow with 3 fallback methods
+- Token cached in `this.accessToken`, auto-retries on 401
+- **Debug tip**: Check lines 127-142 for auth method attempts
+
+**Data Parsing** (`lib/acquia-api.ts` lines 312-466):
+- Response structure: `_embedded.items[]` where each item = one application
+- Each item has `metadata.application.uuids[0]` + `datapoints[]` array
+- Datapoints format: `["2025-04-15T00:00:00+00:00", "1124"]` (date, value)
+- **Critical**: ONE item = ONE application, ALL datapoints belong to that app
+
+**Caching**:
+- 6-hour in-memory cache (lines 10-24)
+- Cache keys: `generateCacheKey([endpoint, uuid, from, to, resolution])`
+- Cache hit returns immediately without API call
+
+**Date Filtering** (lines 218-262):
+- API expects ISO 8601: `2025-04-15T23:59:59.000Z`
+- Frontend sends: `YYYY-MM-DD`
+- Conversion adds `T00:00:00.000Z` (start) or `T23:59:59.000Z` (end)
+- Filter format: `filter=from=2025-04-01T00:00:00.000Z,to=2025-04-30T23:59:59.000Z`
+
+### Component Patterns
+
+**Client Components** - Use `'use client'` directive when:
+- Using React hooks (`useState`, `useEffect`)
+- Browser APIs (localStorage, fetch)
+- Example: `components/Dashboard.tsx` (line 1)
+
+**Server Components** - Default for:
+- Page layouts (`app/layout.tsx`, `app/page.tsx`)
+- Static content rendering
+
+**Data Fetching**:
+- Client-side: `fetch('/api/acquia/visits')` from Dashboard
+- Pass query params: `new URLSearchParams({ subscriptionUuid, from, to })`
+- Handle loading states with `CountUpTimer` component
+
+## Email Reporting System
+
+**Daily Summary Emails** (`app/api/email/daily-summary/`):
+- **Trigger**: Vercel cron job runs daily at 9 AM UTC (configured in `vercel.json`)
+- **Data**: Aggregates views/visits across all applications for current month
+- **Calculations**:
+  - Month progress percentage (e.g., day 7 of 31 = 22.6%)
+  - Expected usage at current point vs actual usage
+  - Overage warnings when usage exceeds expected pace
+- **Email Service**: Uses Resend.com for reliable delivery
+- **Security**: Protected by `CRON_SECRET` to prevent unauthorized triggers
+
+**Email Content**:
+- Stanford-branded HTML email with Decanter color scheme
+- Current month usage vs entitlements (Views/Visits)
+- Progress tracking against monthly pace
+- Visual indicators for on-track vs over-usage status
+- Error handling for data collection failures
+
+**Setup Requirements**:
+1. `RESEND_API_KEY` - Sign up at resend.com
+2. `FROM_EMAIL` - Sender address (use onboarding@resend.dev for testing)
+3. `ADMIN_EMAIL` - Recipient for daily summaries
+4. `CRON_SECRET` - Generate with `openssl rand -base64 32`
+5. Configure in Vercel environment variables
+
+**Testing**:
+- Manual trigger: `GET /api/test/email` (requires CRON_SECRET)
+- Check Vercel function logs for debugging
+- Verify email delivery in Resend dashboard
+
+**Cron Schedule Options** (`vercel.json`):
+- `"0 9 * * *"` - 9 AM UTC daily (current)
+- `"0 17 * * *"` - 5 PM UTC daily (9 AM PST)
+- `"0 8 * * 1-5"` - 8 AM UTC, weekdays only
+
+## Common Tasks
+
+### Adding a New Chart Type
+1. Create component in `components/` (e.g., `NewChart.tsx`)
+2. Import Recharts primitives: `{ BarChart, Bar, XAxis, YAxis, Tooltip }`
+3. Accept `data` prop with `{ name: string, value: number, uuid: string }[]`
+4. Use Decanter colors: `className='fill-cardinal-red'`
+5. Add tab to `Dashboard.tsx` TABS array
+6. Add conditional render in tab content section
+
+### Debugging Acquia API Issues
+1. Check auth: Uncomment console.logs in `lib/acquia-api.ts` lines 95-141
+2. Verify date parsing: Check logs at lines 237-251 (date formatting)
+3. Inspect response structure: Logs at lines 320-330 (parsing entry point)
+4. Cache debugging: Search for "Returning cached" logs
+
+### Environment Setup
+
+**Local Development**:
+```bash
+nvm use                     # Ensures Node 22.x
+npm install                 # Install dependencies
+
+# Configure environment
+cp .env.example .env.local  # Create env file
+# Edit .env.local:
+#   ACQUIA_API_KEY=your-api-key
+#   ACQUIA_API_SECRET=your-api-secret
+#   NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID=your-subscription-uuid
+#   RESEND_API_KEY=your-resend-key (optional)
+#   FROM_EMAIL=sws-developers@lists.stanford.edu (optional)
+#   ADMIN_EMAIL=admin@stanford.edu (optional)
+#   CRON_SECRET=generate-with-openssl-rand-base64-32 (optional)
+
+# Start development server
+npm run dev                 # HTTP server (basic development)
+```
+
+### Setting Up Email Reporting
+1. **Get Resend API Key**: Sign up at [resend.com](https://resend.com)
+2. **Configure Environment Variables**:
+   ```bash
+   RESEND_API_KEY=re_xxxxxxxxxx
+   FROM_EMAIL=onboarding@resend.dev  # For testing
+   ADMIN_EMAIL=your-email@stanford.edu
+   CRON_SECRET=your-secure-random-key
+   ```
+3. **Test Email**: Visit `/api/test/email` to send test email
+4. **Deploy**: Cron job automatically runs daily at 9 AM UTC
+5. **Production**: Verify your own domain in Resend or work with Stanford IT for @stanford.edu addresses
+
+### Modifying Email Schedule
+1. Edit `vercel.json` cron schedule
+2. Common patterns:
+   - `"0 9 * * *"` - 9 AM UTC daily
+   - `"0 17 * * *"` - 5 PM UTC daily (9 AM PST)
+   - `"0 8 * * 1-5"` - 8 AM UTC, weekdays only
+
+## File Organization
+
+```
+app/
+  api/              # API routes (Next.js 15 route handlers)
+    acquia/         # Acquia Cloud API proxy routes
+    email/          # Email functionality
+      daily-summary/ # Daily summary cron job
+    test/           # Testing endpoints
+      email/        # Email testing
+  [pages]           # Page components (e.g., page.tsx, layout.tsx)
+components/         # React components
+  [Component]/      # Directory-based components with .styles.ts, .types.ts
+lib/                # Core business logic (API clients)
+docs/               # Technical documentation (EMAIL-CONFIGURATION.md)
+public/fonts/       # Local fonts (stanford.woff2)
+tailwind/plugins/   # Tailwind customizations (font families)
+utilities/          # Helper utilities (datasource color mappings)
+vercel.json         # Vercel configuration including cron jobs
+```
+
+## Testing & Verification
+
+**Local Testing**:
+- Use basic auth credentials: `sws/sws`
+- Test API: Check DevTools Network tab for `/api/acquia/*` responses
+- Test email: Navigate to `/api/test/email`
+
+**Production Checklist**:
+- Verify all environment variables set in Vercel
+- Test basic authentication works
+- Verify email functionality with test endpoint
+- Check Vercel function logs for cron job execution
+- Confirm email delivery in Resend dashboard
+
+## Common Pitfalls
+
+1. **Quoted env vars** - `ACQUIA_API_KEY="abc"` breaks auth (remove quotes)
+2. **Wrong auth method** - This branch uses basic HTTP auth, not SAML
+3. **Date format mismatch** - Frontend sends `YYYY-MM-DD`, API needs ISO 8601
+4. **Cache staleness** - 6-hour cache may hide API issues, check timestamps
+5. **Decanter overrides** - Don't use arbitrary Tailwind values, use Decanter tokens
+6. **Missing email env vars** - `FROM_EMAIL` and `ADMIN_EMAIL` are required for email functionality
+7. **CRON_SECRET** - Must be set for email testing and cron job security
+
+## Key Documentation
+
+- **Email Configuration**: `docs/EMAIL-CONFIGURATION.md` (comprehensive email setup guide)
+- **Acquia API**: https://cloud.acquia.com/api (official docs, requires login)
+- **Decanter**: https://decanter.stanford.edu (Stanford Design System)
+- **Next.js 15**: https://nextjs.org/docs (App Router only)
+- **Resend**: https://resend.com/docs (email service documentation)
+
+## Branch Strategy
+- Main branch: `main` (current development branch)
+- Repository: `SU-SWS/churro` (Stanford University Web Services)
+
+---
+*Last Updated: Based on codebase analysis, November 2025 - Basic HTTP auth with email reporting*
\ No newline at end of file
diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
index 05fb2ab..56e24d9 100644
--- a/app/api/email/daily-summary/route.ts
+++ b/app/api/email/daily-summary/route.ts
@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { Resend } from 'resend';
+import AcquiaApiServiceFixed from '@/lib/acquia-api';
 
 const resend = new Resend(process.env.RESEND_API_KEY);
 
@@ -10,6 +11,23 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
+  // Validate required environment variables
+  const fromEmail = process.env.FROM_EMAIL;
+  if (!fromEmail) {
+    console.error('❌ FROM_EMAIL environment variable not configured');
+    return NextResponse.json({
+      error: 'FROM_EMAIL environment variable is required for email functionality'
+    }, { status: 500 });
+  }
+
+  const adminEmail = process.env.ADMIN_EMAIL;
+  if (!adminEmail) {
+    console.error('❌ ADMIN_EMAIL environment variable not configured');
+    return NextResponse.json({
+      error: 'ADMIN_EMAIL environment variable is required for email functionality'
+    }, { status: 500 });
+  }
+
   try {
     // Calculate current month metrics
     const now = new Date();
@@ -36,11 +54,20 @@ export async function POST(request: NextRequest) {
     const viewsOnTrack = actualUsage.views <= expectedViews;
     const visitsOnTrack = actualUsage.visits <= expectedVisits;
 
+    console.log('🧪 Email configuration:', {
+      hasResendKey: !!process.env.RESEND_API_KEY,
+      resendKeyPreview: process.env.RESEND_API_KEY?.substring(0, 10) + '...',
+      fromEmail,
+      adminEmail
+    });
+
     // Send email
-    await resend.emails.send({
-      from: 'CHURRO <noreply@yourdomain.com>',
-      to: ['your-email@stanford.edu'],
+    console.log('📧 Attempting to send email...');
+    const emailResult = await resend.emails.send({
+      from: fromEmail,
+      to: [adminEmail],
       subject: `CHURRO Daily Summary - ${now.toLocaleDateString()}`,
+      replyTo: 'sws-developers@lists.stanford.edu',
       html: generateEmailHTML({
         date: now,
         monthProgress: monthProgress * 100,
@@ -58,6 +85,19 @@ export async function POST(request: NextRequest) {
       })
     });
 
+    console.log('📧 Full Resend response:', JSON.stringify(emailResult, null, 2));
+
+    if (emailResult.error) {
+      console.error('❌ Resend error:', emailResult.error);
+      throw new Error(`Email sending failed: ${JSON.stringify(emailResult.error)}`);
+    }
+
+    console.log('✅ Email sent successfully!', {
+      messageId: emailResult.data?.id,
+      to: adminEmail,
+      from: fromEmail
+    });
+
     return NextResponse.json({ success: true });
   } catch (error) {
     console.error('Email sending failed:', error);
@@ -66,29 +106,141 @@ export async function POST(request: NextRequest) {
 }
 
 async function fetchCurrentMonthUsage() {
-  // Implement your logic to fetch current month's views/visits
-  // This would call your existing Acquia API endpoints
-  const subscriptionUuid = process.env.NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID;
+  try {
+    const subscriptionUuid = process.env.NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID;
+    if (!subscriptionUuid) {
+      throw new Error('NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID not configured');
+    }
+
+    // Create Acquia API service instance
+    const acquiaService = new AcquiaApiServiceFixed({
+      baseUrl: process.env.ACQUIA_API_BASE_URL || 'https://cloud.acquia.com/api',
+      authUrl: process.env.ACQUIA_AUTH_BASE_URL || 'https://accounts.acquia.com/api',
+      apiKey: process.env.ACQUIA_API_KEY!,
+      apiSecret: process.env.ACQUIA_API_SECRET!,
+    });
+
+    // Calculate current month date range
+    const now = new Date();
+    const firstOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+    // Use yesterday as the end date to avoid "future date" errors
+    const yesterday = new Date(now);
+    yesterday.setDate(yesterday.getDate() - 1);
 
-  // You'll need to aggregate data across all applications
-  // Return format: { views: number, visits: number }
-  return { views: 0, visits: 0 }; // Placeholder
+    const from = firstOfMonth.toISOString().split('T')[0]; // YYYY-MM-DD format
+    const to = yesterday.toISOString().split('T')[0]; // Yesterday
+
+    console.log(`📅 Fetching usage data from ${from} to ${to}`);
+
+    // Fetch all applications to get the list
+    const applications = await acquiaService.getApplications();
+    console.log(`📱 Found ${applications.length} applications`);
+
+    // Fetch all data once (more efficient than per-application calls)
+    const allViewsData = await acquiaService.getViewsDataByApplication(subscriptionUuid, from, to);
+    const allVisitsData = await acquiaService.getVisitsDataByApplication(subscriptionUuid, from, to);
+
+    let totalViews = 0;
+    let totalVisits = 0;
+
+    // Aggregate data across all applications
+    for (const app of applications) {
+      try {
+        // Filter views data for this application
+        const appViews = allViewsData
+          .filter(item => item.applicationUuid === app.uuid)
+          .reduce((sum: number, item: any) => sum + item.views, 0);
+        totalViews += appViews;
+
+        // Filter visits data for this application
+        const appVisits = allVisitsData
+          .filter(item => item.applicationUuid === app.uuid)
+          .reduce((sum: number, item: any) => sum + item.visits, 0);
+        totalVisits += appVisits;
+
+        console.log(`📊 App ${app.name}: ${appViews} views, ${appVisits} visits`);
+      } catch (error) {
+        console.warn(`⚠️ Failed to process data for app ${app.uuid}:`, error);
+        // Continue with other applications
+      }
+    }
+
+    console.log(`📈 Total usage: ${totalViews} views, ${totalVisits} visits`);
+
+    return {
+      views: totalViews,
+      visits: totalVisits
+    };
+  } catch (error) {
+    console.error('❌ Error fetching current month usage:', error);
+    // Return zeros to prevent email failure, but include error in email
+    return {
+      views: 0,
+      visits: 0,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
 }
 
 function generateEmailHTML(data: any) {
+  const statusIcon = (isOnTrack: boolean) => isOnTrack ? '✅' : '⚠️';
+  const statusText = (isOnTrack: boolean) => isOnTrack ? 'On track' : 'Over expected usage';
+
   return `
-    <h1>CHURRO Daily Usage Summary</h1>
-    <p><strong>Date:</strong> ${data.date.toLocaleDateString()}</p>
-    <p><strong>Month Progress:</strong> ${data.dayOfMonth}/${data.daysInMonth} days (${data.monthProgress.toFixed(1)}%)</p>
-
-    <h2>Views Usage</h2>
-    <p><strong>Actual:</strong> ${data.actualUsage.views.toLocaleString()} / ${data.viewsEntitlement.toLocaleString()} (${data.viewsPercentage.toFixed(1)}%)</p>
-    <p><strong>Expected at this point:</strong> ${data.expectedViews.toLocaleString()}</p>
-    <p><strong>Status:</strong> ${data.viewsOnTrack ? '✅ On track' : '⚠️ Over expected usage'}</p>
-
-    <h2>Visits Usage</h2>
-    <p><strong>Actual:</strong> ${data.actualUsage.visits.toLocaleString()} / ${data.visitsEntitlement.toLocaleString()} (${data.visitsPercentage.toFixed(1)}%)</p>
-    <p><strong>Expected at this point:</strong> ${data.expectedVisits.toLocaleString()}</p>
-    <p><strong>Status:</strong> ${data.visitsOnTrack ? '✅ On track' : '⚠️ Over expected usage'}</p>
+    <!DOCTYPE html>
+    <html>
+    <head>
+      <meta charset="utf-8">
+      <style>
+        body { font-family: 'Source Sans Pro', Arial, sans-serif; line-height: 1.6; color: #333; max-width: 600px; margin: 0 auto; padding: 20px; }
+        h1 { color: #8C1515; border-bottom: 3px solid #8C1515; padding-bottom: 10px; }
+        h2 { color: #2e2d29; margin-top: 30px; }
+        .metric-box { background: #f8f9fa; border-left: 4px solid #8C1515; padding: 15px; margin: 10px 0; }
+        .on-track { border-left-color: #28a745; }
+        .over-usage { border-left-color: #dc3545; }
+        .footer { margin-top: 30px; padding-top: 20px; border-top: 1px solid #ddd; font-size: 0.9em; color: #666; }
+      </style>
+    </head>
+    <body>
+      <h1>🥧 CHURRO Daily Usage Summary</h1>
+      <p><strong>Date:</strong> ${data.date.toLocaleDateString('en-US', {
+        weekday: 'long',
+        year: 'numeric',
+        month: 'long',
+        day: 'numeric'
+      })}</p>
+      <p><strong>Month Progress:</strong> Day ${data.dayOfMonth} of ${data.daysInMonth} (${data.monthProgress.toFixed(1)}% complete)</p>
+
+      <h2>📈 Views Usage</h2>
+      <div class="metric-box ${data.viewsOnTrack ? 'on-track' : 'over-usage'}">
+        <p><strong>Current Usage:</strong> ${data.actualUsage.views.toLocaleString()} / ${data.viewsEntitlement.toLocaleString()} total (${data.viewsPercentage.toFixed(1)}%)</p>
+        <p><strong>Expected at this point:</strong> ${data.expectedViews.toLocaleString()} (${((data.expectedViews / data.viewsEntitlement) * 100).toFixed(1)}%)</p>
+        <p><strong>Status:</strong> ${statusIcon(data.viewsOnTrack)} ${statusText(data.viewsOnTrack)}</p>
+        ${!data.viewsOnTrack ? `<p><strong>Overage:</strong> ${(data.actualUsage.views - data.expectedViews).toLocaleString()} views over expected</p>` : ''}
+      </div>
+
+      <h2>👥 Visits Usage</h2>
+      <div class="metric-box ${data.visitsOnTrack ? 'on-track' : 'over-usage'}">
+        <p><strong>Current Usage:</strong> ${data.actualUsage.visits.toLocaleString()} / ${data.visitsEntitlement.toLocaleString()} total (${data.visitsPercentage.toFixed(1)}%)</p>
+        <p><strong>Expected at this point:</strong> ${data.expectedVisits.toLocaleString()} (${((data.expectedVisits / data.visitsEntitlement) * 100).toFixed(1)}%)</p>
+        <p><strong>Status:</strong> ${statusIcon(data.visitsOnTrack)} ${statusText(data.visitsOnTrack)}</p>
+        ${!data.visitsOnTrack ? `<p><strong>Overage:</strong> ${(data.actualUsage.visits - data.expectedVisits).toLocaleString()} visits over expected</p>` : ''}
+      </div>
+
+      ${data.actualUsage.error ? `
+        <div style="background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; margin: 20px 0; border-radius: 5px;">
+          <p><strong>⚠️ Data Collection Warning:</strong></p>
+          <p>There was an issue collecting usage data: ${data.actualUsage.error}</p>
+          <p>Values shown may be incomplete. Please check the dashboard manually.</p>
+        </div>
+      ` : ''}
+
+      <div class="footer">
+        <p><strong>Generated by CHURRO</strong> - Stanford University Cloud Hosting Usage Reporting</p>
+        <p>For more details, visit the <a href="${process.env.APP_URL || 'https://churro.stanford.edu'}">CHURRO Dashboard</a></p>
+      </div>
+    </body>
+    </html>
   `;
 }
\ No newline at end of file
diff --git a/app/api/test/email/route.ts b/app/api/test/email/route.ts
new file mode 100644
index 0000000..b47ff36
--- /dev/null
+++ b/app/api/test/email/route.ts
@@ -0,0 +1,49 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function GET(request: NextRequest) {
+  try {
+    // Get the current URL to construct the cron endpoint
+    const { origin } = new URL(request.url);
+    const cronSecret = process.env.CRON_SECRET;
+
+    if (!cronSecret) {
+      return NextResponse.json({
+        error: 'CRON_SECRET not configured. Add this environment variable to test email functionality.'
+      }, { status: 500 });
+    }
+
+    console.log('🧪 Triggering test email...');
+
+    // Call the daily summary endpoint
+    const response = await fetch(`${origin}/api/email/daily-summary`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${cronSecret}`,
+        'Content-Type': 'application/json',
+      },
+    });
+
+    const result = await response.json();
+
+    if (response.ok) {
+      return NextResponse.json({
+        success: true,
+        message: 'Test email sent successfully!',
+        details: result
+      });
+    } else {
+      return NextResponse.json({
+        success: false,
+        message: 'Failed to send test email',
+        error: result
+      }, { status: response.status });
+    }
+  } catch (error) {
+    console.error('❌ Test email failed:', error);
+    return NextResponse.json({
+      success: false,
+      message: 'Error sending test email',
+      error: error instanceof Error ? error.message : String(error)
+    }, { status: 500 });
+  }
+}
\ No newline at end of file
diff --git a/docs/EMAIL-CONFIGURATION.md b/docs/EMAIL-CONFIGURATION.md
new file mode 100644
index 0000000..b4f9c5d
--- /dev/null
+++ b/docs/EMAIL-CONFIGURATION.md
@@ -0,0 +1,140 @@
+# CHURRO Environment Variables Configuration
+
+## Required Environment Variables
+
+Add these to your Vercel project environment variables or `.env.local` for development:
+
+### Acquia API Configuration
+```bash
+# Acquia Cloud API credentials (OAuth2)
+ACQUIA_API_KEY=your-api-key-uuid
+ACQUIA_API_SECRET=your-api-secret
+
+# API endpoints (optional - uses defaults if not specified)
+ACQUIA_API_BASE_URL=https://cloud.acquia.com/api
+ACQUIA_AUTH_BASE_URL=https://accounts.acquia.com/api
+
+# Subscription and entitlements
+NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID=your-subscription-uuid
+NEXT_PUBLIC_ACQUIA_MONTHLY_VIEWS_ENTITLEMENT=30000000
+NEXT_PUBLIC_ACQUIA_MONTHLY_VISITS_ENTITLEMENT=9000000
+```
+
+### SAML Authentication (if using)
+```bash
+# SAML certificates and configuration
+SAML_CERT=your-stanford-cert
+SAML_SP_CERT=your-sp-cert
+SAML_SP_PRIVATE_KEY=your-sp-private-key
+
+# Application URLs
+APP_URL=https://your-domain.vercel.app
+SAML_ENTITY_ID=https://your-entity-id
+
+# JWT for session management
+JWT_SECRET=your-jwt-secret-generate-with-openssl-rand-base64-32
+```
+
+### Email Reporting Configuration
+```bash
+# Email service (Resend.com)
+RESEND_API_KEY=re_xxxxxxxxxx
+
+# Email configuration
+FROM_EMAIL=onboarding@resend.dev  # Use for testing, or verify your own domain
+ADMIN_EMAIL=your-email@stanford.edu
+
+# For production with verified domain
+# FROM_EMAIL=noreply@your-verified-domain.com
+
+# Note: Stanford DMARC requires Stanford IT to configure DKIM for @stanford.edu addresses
+# See Stanford email authentication docs for production setup
+
+# Cron job security
+CRON_SECRET=your-secure-random-key-for-cron-protection
+```
+
+## Setup Instructions
+
+### 1. Resend Email Service
+1. Sign up at [resend.com](https://resend.com)
+2. Create an API key
+3. Add `RESEND_API_KEY` to your environment
+
+### 2. Generate CRON_SECRET
+```bash
+# Generate a secure random key
+openssl rand -base64 32
+```
+
+### 3. Configure Vercel Environment Variables
+1. Go to Vercel Dashboard → Your Project → Settings → Environment Variables
+2. Add each variable with appropriate values
+3. Set environment scope (Development/Preview/Production as needed)
+
+## Email Testing
+
+To test the daily summary email manually:
+
+```bash
+# Test via the test endpoint (recommended)
+curl -X GET "http://localhost:3000/api/test/email" \
+  -H "Authorization: Bearer your-cron-secret"
+
+# Or call the cron endpoint directly
+curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
+  -H "Authorization: Bearer your-cron-secret" \
+  -H "Content-Type: application/json"
+```
+
+## Data Collection Details
+
+**Date Range**: The email uses data from the 1st of the current month through yesterday (to avoid "future date" API errors from Acquia)
+
+**Data Aggregation**: Combines views and visits across all applications in your Acquia subscription
+
+**Calculations**:
+- Month progress: Current day / Total days in month
+- Expected usage: Entitlement × Month progress percentage
+- Status: "On track" if actual usage ≤ expected usage
+
+## Cron Schedule
+
+The current schedule in `vercel.json` runs daily at 9 AM UTC:
+```json
+{
+  "crons": [
+    {
+      "path": "/api/email/daily-summary",
+      "schedule": "0 9 * * *"
+    }
+  ]
+}
+```
+
+### Common Cron Schedules
+- `0 9 * * *` - 9 AM UTC daily
+- `0 17 * * *` - 5 PM UTC daily (9 AM PST)
+- `0 8 * * 1-5` - 8 AM UTC, Monday-Friday only
+- `0 10 * * *` - 10 AM UTC daily
+
+## Security Notes
+
+1. **CRON_SECRET**: Prevents unauthorized access to the email endpoint
+2. **Environment Variables**: Never commit secrets to version control
+3. **API Keys**: Use environment-specific keys (dev/staging/prod)
+4. **Email Recipients**: Consider using distribution lists for multiple recipients
+
+## Troubleshooting
+
+### Common Issues
+1. **Email not sending**: Check `RESEND_API_KEY` is valid
+2. **Unauthorized cron calls**: Verify `CRON_SECRET` matches
+3. **No data in email**: Check Acquia API credentials and permissions
+4. **Wrong timezone**: Cron runs in UTC, adjust schedule accordingly
+
+### Logs
+Check Vercel function logs for:
+- Authentication errors with Acquia API
+- Email sending failures
+- Data aggregation issues
\ No newline at end of file
diff --git a/lib/acquia-api.ts b/lib/acquia-api.ts
index 5278f0f..3bb85e6 100644
--- a/lib/acquia-api.ts
+++ b/lib/acquia-api.ts
@@ -255,6 +255,13 @@ class AcquiaApiServiceFixed {
       return response;
     } catch (error) {
       if (axios.isAxiosError(error)) {
+        console.error('❌ Acquia API Error Details:', {
+          url: fullUrl,
+          status: error.response?.status,
+          statusText: error.response?.statusText,
+          data: error.response?.data
+        });
+
         if (error.response?.status === 401) {
           // console.log('🔄 Token expired, retrying...');
           this.accessToken = null;
diff --git a/package-lock.json b/package-lock.json
index c7e3de9..6aa0712 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,7 +15,8 @@
         "next": "^15.5.2",
         "react": "18.3.1",
         "react-dom": "18.3.1",
-        "recharts": "^2.12.7"
+        "recharts": "^2.12.7",
+        "resend": "^6.5.2"
       },
       "devDependencies": {
         "@types/basic-auth": "^1.1.8",
@@ -912,6 +913,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@stablelib/base64": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.1.tgz",
+      "integrity": "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==",
+      "license": "MIT"
+    },
     "node_modules/@swc/helpers": {
       "version": "0.5.15",
       "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
@@ -2900,6 +2907,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/es6-promise": {
+      "version": "4.2.8",
+      "resolved": "https://registry.npmjs.org/es6-promise/-/es6-promise-4.2.8.tgz",
+      "integrity": "sha512-HJDGx5daxeIvxdBxvG2cb9g4tEvwIk3i8+nhX0yGrYmZUzbkdg8QbDevheDB8gd0//uPj4c1EQua8Q+MViT0/w==",
+      "license": "MIT"
+    },
     "node_modules/escalade": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
@@ -3437,6 +3450,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-sha256": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/fast-sha256/-/fast-sha256-1.3.0.tgz",
+      "integrity": "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==",
+      "license": "Unlicense"
+    },
     "node_modules/fastq": {
       "version": "1.19.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.19.1.tgz",
@@ -5374,6 +5393,12 @@
         "node": ">=6"
       }
     },
+    "node_modules/querystringify": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
+      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
+      "license": "MIT"
+    },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
@@ -5559,6 +5584,32 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/requires-port": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
+      "license": "MIT"
+    },
+    "node_modules/resend": {
+      "version": "6.5.2",
+      "resolved": "https://registry.npmjs.org/resend/-/resend-6.5.2.tgz",
+      "integrity": "sha512-Yl83UvS8sYsjgmF8dVbNPzlfpmb3DkLUk3VwsAbkaEFo9UMswpNuPGryHBXGk+Ta4uYMv5HmjVk3j9jmNkcEDg==",
+      "license": "MIT",
+      "dependencies": {
+        "svix": "1.76.1"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "@react-email/render": "*"
+      },
+      "peerDependenciesMeta": {
+        "@react-email/render": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/resolve": {
       "version": "1.22.10",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.10.tgz",
@@ -6313,6 +6364,29 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/svix": {
+      "version": "1.76.1",
+      "resolved": "https://registry.npmjs.org/svix/-/svix-1.76.1.tgz",
+      "integrity": "sha512-CRuDWBTgYfDnBLRaZdKp9VuoPcNUq9An14c/k+4YJ15Qc5Grvf66vp0jvTltd4t7OIRj+8lM1DAgvSgvf7hdLw==",
+      "license": "MIT",
+      "dependencies": {
+        "@stablelib/base64": "^1.0.0",
+        "@types/node": "^22.7.5",
+        "es6-promise": "^4.2.8",
+        "fast-sha256": "^1.3.0",
+        "url-parse": "^1.5.10",
+        "uuid": "^10.0.0"
+      }
+    },
+    "node_modules/svix/node_modules/@types/node": {
+      "version": "22.19.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.1.tgz",
+      "integrity": "sha512-LCCV0HdSZZZb34qifBsyWlUmok6W7ouER+oQIGBScS8EsZsQbrtFTUrDX4hOl+CS6p7cnNC4td+qrSVGSCTUfQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
     "node_modules/tailwindcss": {
       "version": "3.4.17",
       "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.17.tgz",
@@ -6686,7 +6760,6 @@
       "version": "6.21.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/unrs-resolver": {
@@ -6765,12 +6838,35 @@
         "punycode": "^2.1.0"
       }
     },
+    "node_modules/url-parse": {
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "querystringify": "^2.1.1",
+        "requires-port": "^1.0.0"
+      }
+    },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
+    "node_modules/uuid": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
+      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
     "node_modules/victory-vendor": {
       "version": "36.9.2",
       "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-36.9.2.tgz",
diff --git a/package.json b/package.json
index 9243a6a..61168f4 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,8 @@
     "next": "^15.5.2",
     "react": "18.3.1",
     "react-dom": "18.3.1",
-    "recharts": "^2.12.7"
+    "recharts": "^2.12.7",
+    "resend": "^6.5.2"
   },
   "devDependencies": {
     "@types/basic-auth": "^1.1.8",

From 71091660de959c84bbd69a7c3312d3c2b87a8862 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 12:54:54 -0800
Subject: [PATCH 03/16] Update basic auth handling

---
 app/api/email/daily-summary/route.ts |  7 ++++++-
 app/api/test/email/route.ts          | 14 ++++++++++++--
 middleware.ts                        |  4 ++--
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
index 56e24d9..fb9ab5f 100644
--- a/app/api/email/daily-summary/route.ts
+++ b/app/api/email/daily-summary/route.ts
@@ -7,7 +7,12 @@ const resend = new Resend(process.env.RESEND_API_KEY);
 export async function POST(request: NextRequest) {
   // Verify cron secret to prevent unauthorized calls
   const authHeader = request.headers.get('authorization');
-  if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
+  const cronSecretHeader = request.headers.get('x-cron-secret');
+
+  // Accept cron secret from either Authorization header or X-Cron-Secret header
+  const providedSecret = authHeader?.replace('Bearer ', '') || cronSecretHeader;
+
+  if (providedSecret !== process.env.CRON_SECRET) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
diff --git a/app/api/test/email/route.ts b/app/api/test/email/route.ts
index b47ff36..7539a9a 100644
--- a/app/api/test/email/route.ts
+++ b/app/api/test/email/route.ts
@@ -14,12 +14,22 @@ export async function GET(request: NextRequest) {
 
     console.log('🧪 Triggering test email...');
 
-    // Call the daily summary endpoint
+    // Call the daily summary endpoint with basic auth credentials
+    const basicAuthUsername = process.env.BASIC_AUTH_USERNAME;
+    const basicAuthPassword = process.env.BASIC_AUTH_PASSWORD;
+
+    if (!basicAuthUsername || !basicAuthPassword) {
+      return NextResponse.json({
+        error: 'BASIC_AUTH_USERNAME and BASIC_AUTH_PASSWORD environment variables are required'
+      }, { status: 500 });
+    }
+
     const response = await fetch(`${origin}/api/email/daily-summary`, {
       method: 'POST',
       headers: {
-        'Authorization': `Bearer ${cronSecret}`,
+        'Authorization': `Basic ${Buffer.from(`${basicAuthUsername}:${basicAuthPassword}`).toString('base64')}`,
         'Content-Type': 'application/json',
+        'X-Cron-Secret': cronSecret, // Use custom header for cron secret
       },
     });
 
diff --git a/middleware.ts b/middleware.ts
index 92a20e1..380c24e 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -1,8 +1,8 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
-const USERNAME = 'sws';
-const PASSWORD = 'sws';
+const USERNAME = process.env.BASIC_AUTH_USERNAME;
+const PASSWORD = process.env.BASIC_AUTH_PASSWORD;
 
 export function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;

From 2787f76ffc4fcc00655e978a1a0df4cef22d67d2 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 13:00:17 -0800
Subject: [PATCH 04/16] WIP: debugging basic auth

---
 app/api/test/email/route.ts | 20 +++++++++++++++++++-
 middleware.ts               |  8 ++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/app/api/test/email/route.ts b/app/api/test/email/route.ts
index 7539a9a..58840f1 100644
--- a/app/api/test/email/route.ts
+++ b/app/api/test/email/route.ts
@@ -33,7 +33,25 @@ export async function GET(request: NextRequest) {
       },
     });
 
-    const result = await response.json();
+    console.log('📊 Response status:', response.status);
+    console.log('📊 Response headers:', Object.fromEntries(response.headers.entries()));
+
+    // Check if response is HTML (indicating middleware rejection)
+    const responseText = await response.text();
+    console.log('📊 Response text preview:', responseText.substring(0, 200));
+
+    let result;
+    try {
+      result = JSON.parse(responseText);
+    } catch (parseError) {
+      console.error('❌ Failed to parse response as JSON:', parseError);
+      return NextResponse.json({
+        success: false,
+        message: 'Received non-JSON response (likely HTML from middleware)',
+        responseStatus: response.status,
+        responsePreview: responseText.substring(0, 500)
+      }, { status: 500 });
+    }
 
     if (response.ok) {
       return NextResponse.json({
diff --git a/middleware.ts b/middleware.ts
index 380c24e..ac2279c 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -29,6 +29,14 @@ export function middleware(request: NextRequest) {
     return NextResponse.next();
   }
 
+  // Check if basic auth environment variables are configured
+  if (!USERNAME || !PASSWORD) {
+    console.error('❌ BASIC_AUTH_USERNAME or BASIC_AUTH_PASSWORD environment variables not configured');
+    return new NextResponse('Server configuration error - basic auth not configured', {
+      status: 500,
+    });
+  }
+
   // Get the Authorization header
   const authHeader = request.headers.get('authorization');
   if (!authHeader) {

From 7fb93d1bfef2465f669ce62e07aca0a6845aab2d Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 13:24:12 -0800
Subject: [PATCH 05/16] ACHOO-114: move to shared function

---
 app/api/email/daily-summary/route.ts | 241 +----------------
 app/api/test/email/route.ts          |  49 +---
 lib/email-service.ts                 | 384 +++++++++++++++++++++++++++
 3 files changed, 397 insertions(+), 277 deletions(-)
 create mode 100644 lib/email-service.ts

diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
index fb9ab5f..11a9539 100644
--- a/app/api/email/daily-summary/route.ts
+++ b/app/api/email/daily-summary/route.ts
@@ -1,8 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { Resend } from 'resend';
-import AcquiaApiServiceFixed from '@/lib/acquia-api';
-
-const resend = new Resend(process.env.RESEND_API_KEY);
+import { sendDailySummaryEmail } from '@/lib/email-service';
 
 export async function POST(request: NextRequest) {
   // Verify cron secret to prevent unauthorized calls
@@ -16,236 +13,12 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
-  // Validate required environment variables
-  const fromEmail = process.env.FROM_EMAIL;
-  if (!fromEmail) {
-    console.error('❌ FROM_EMAIL environment variable not configured');
-    return NextResponse.json({
-      error: 'FROM_EMAIL environment variable is required for email functionality'
-    }, { status: 500 });
-  }
-
-  const adminEmail = process.env.ADMIN_EMAIL;
-  if (!adminEmail) {
-    console.error('❌ ADMIN_EMAIL environment variable not configured');
-    return NextResponse.json({
-      error: 'ADMIN_EMAIL environment variable is required for email functionality'
-    }, { status: 500 });
-  }
-
-  try {
-    // Calculate current month metrics
-    const now = new Date();
-    const firstOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
-    const daysInMonth = new Date(now.getFullYear(), now.getMonth() + 1, 0).getDate();
-    const dayOfMonth = now.getDate();
-    const monthProgress = dayOfMonth / daysInMonth;
-
-    // Get entitlements from env
-    const viewsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VIEWS_ENTITLEMENT || '0');
-    const visitsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VISITS_ENTITLEMENT || '0');
-
-    // Expected usage at this point in month
-    const expectedViews = Math.round(viewsEntitlement * monthProgress);
-    const expectedVisits = Math.round(visitsEntitlement * monthProgress);
-
-    // Fetch actual usage (you'll need to implement this)
-    const actualUsage = await fetchCurrentMonthUsage();
-
-    // Calculate percentages
-    const viewsPercentage = (actualUsage.views / viewsEntitlement) * 100;
-    const visitsPercentage = (actualUsage.visits / visitsEntitlement) * 100;
-
-    const viewsOnTrack = actualUsage.views <= expectedViews;
-    const visitsOnTrack = actualUsage.visits <= expectedVisits;
-
-    console.log('🧪 Email configuration:', {
-      hasResendKey: !!process.env.RESEND_API_KEY,
-      resendKeyPreview: process.env.RESEND_API_KEY?.substring(0, 10) + '...',
-      fromEmail,
-      adminEmail
-    });
-
-    // Send email
-    console.log('📧 Attempting to send email...');
-    const emailResult = await resend.emails.send({
-      from: fromEmail,
-      to: [adminEmail],
-      subject: `CHURRO Daily Summary - ${now.toLocaleDateString()}`,
-      replyTo: 'sws-developers@lists.stanford.edu',
-      html: generateEmailHTML({
-        date: now,
-        monthProgress: monthProgress * 100,
-        dayOfMonth,
-        daysInMonth,
-        actualUsage,
-        expectedViews,
-        expectedVisits,
-        viewsEntitlement,
-        visitsEntitlement,
-        viewsPercentage,
-        visitsPercentage,
-        viewsOnTrack,
-        visitsOnTrack
-      })
-    });
-
-    console.log('📧 Full Resend response:', JSON.stringify(emailResult, null, 2));
-
-    if (emailResult.error) {
-      console.error('❌ Resend error:', emailResult.error);
-      throw new Error(`Email sending failed: ${JSON.stringify(emailResult.error)}`);
-    }
-
-    console.log('✅ Email sent successfully!', {
-      messageId: emailResult.data?.id,
-      to: adminEmail,
-      from: fromEmail
-    });
-
-    return NextResponse.json({ success: true });
-  } catch (error) {
-    console.error('Email sending failed:', error);
-    return NextResponse.json({ error: 'Failed to send email' }, { status: 500 });
-  }
-}
-
-async function fetchCurrentMonthUsage() {
-  try {
-    const subscriptionUuid = process.env.NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID;
-    if (!subscriptionUuid) {
-      throw new Error('NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID not configured');
-    }
+  // Call the shared email service function
+  const result = await sendDailySummaryEmail();
 
-    // Create Acquia API service instance
-    const acquiaService = new AcquiaApiServiceFixed({
-      baseUrl: process.env.ACQUIA_API_BASE_URL || 'https://cloud.acquia.com/api',
-      authUrl: process.env.ACQUIA_AUTH_BASE_URL || 'https://accounts.acquia.com/api',
-      apiKey: process.env.ACQUIA_API_KEY!,
-      apiSecret: process.env.ACQUIA_API_SECRET!,
-    });
-
-    // Calculate current month date range
-    const now = new Date();
-    const firstOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
-
-    // Use yesterday as the end date to avoid "future date" errors
-    const yesterday = new Date(now);
-    yesterday.setDate(yesterday.getDate() - 1);
-
-    const from = firstOfMonth.toISOString().split('T')[0]; // YYYY-MM-DD format
-    const to = yesterday.toISOString().split('T')[0]; // Yesterday
-
-    console.log(`📅 Fetching usage data from ${from} to ${to}`);
-
-    // Fetch all applications to get the list
-    const applications = await acquiaService.getApplications();
-    console.log(`📱 Found ${applications.length} applications`);
-
-    // Fetch all data once (more efficient than per-application calls)
-    const allViewsData = await acquiaService.getViewsDataByApplication(subscriptionUuid, from, to);
-    const allVisitsData = await acquiaService.getVisitsDataByApplication(subscriptionUuid, from, to);
-
-    let totalViews = 0;
-    let totalVisits = 0;
-
-    // Aggregate data across all applications
-    for (const app of applications) {
-      try {
-        // Filter views data for this application
-        const appViews = allViewsData
-          .filter(item => item.applicationUuid === app.uuid)
-          .reduce((sum: number, item: any) => sum + item.views, 0);
-        totalViews += appViews;
-
-        // Filter visits data for this application
-        const appVisits = allVisitsData
-          .filter(item => item.applicationUuid === app.uuid)
-          .reduce((sum: number, item: any) => sum + item.visits, 0);
-        totalVisits += appVisits;
-
-        console.log(`📊 App ${app.name}: ${appViews} views, ${appVisits} visits`);
-      } catch (error) {
-        console.warn(`⚠️ Failed to process data for app ${app.uuid}:`, error);
-        // Continue with other applications
-      }
-    }
-
-    console.log(`📈 Total usage: ${totalViews} views, ${totalVisits} visits`);
-
-    return {
-      views: totalViews,
-      visits: totalVisits
-    };
-  } catch (error) {
-    console.error('❌ Error fetching current month usage:', error);
-    // Return zeros to prevent email failure, but include error in email
-    return {
-      views: 0,
-      visits: 0,
-      error: error instanceof Error ? error.message : String(error)
-    };
+  if (result.success) {
+    return NextResponse.json(result);
+  } else {
+    return NextResponse.json(result, { status: 500 });
   }
-}
-
-function generateEmailHTML(data: any) {
-  const statusIcon = (isOnTrack: boolean) => isOnTrack ? '✅' : '⚠️';
-  const statusText = (isOnTrack: boolean) => isOnTrack ? 'On track' : 'Over expected usage';
-
-  return `
-    <!DOCTYPE html>
-    <html>
-    <head>
-      <meta charset="utf-8">
-      <style>
-        body { font-family: 'Source Sans Pro', Arial, sans-serif; line-height: 1.6; color: #333; max-width: 600px; margin: 0 auto; padding: 20px; }
-        h1 { color: #8C1515; border-bottom: 3px solid #8C1515; padding-bottom: 10px; }
-        h2 { color: #2e2d29; margin-top: 30px; }
-        .metric-box { background: #f8f9fa; border-left: 4px solid #8C1515; padding: 15px; margin: 10px 0; }
-        .on-track { border-left-color: #28a745; }
-        .over-usage { border-left-color: #dc3545; }
-        .footer { margin-top: 30px; padding-top: 20px; border-top: 1px solid #ddd; font-size: 0.9em; color: #666; }
-      </style>
-    </head>
-    <body>
-      <h1>🥧 CHURRO Daily Usage Summary</h1>
-      <p><strong>Date:</strong> ${data.date.toLocaleDateString('en-US', {
-        weekday: 'long',
-        year: 'numeric',
-        month: 'long',
-        day: 'numeric'
-      })}</p>
-      <p><strong>Month Progress:</strong> Day ${data.dayOfMonth} of ${data.daysInMonth} (${data.monthProgress.toFixed(1)}% complete)</p>
-
-      <h2>📈 Views Usage</h2>
-      <div class="metric-box ${data.viewsOnTrack ? 'on-track' : 'over-usage'}">
-        <p><strong>Current Usage:</strong> ${data.actualUsage.views.toLocaleString()} / ${data.viewsEntitlement.toLocaleString()} total (${data.viewsPercentage.toFixed(1)}%)</p>
-        <p><strong>Expected at this point:</strong> ${data.expectedViews.toLocaleString()} (${((data.expectedViews / data.viewsEntitlement) * 100).toFixed(1)}%)</p>
-        <p><strong>Status:</strong> ${statusIcon(data.viewsOnTrack)} ${statusText(data.viewsOnTrack)}</p>
-        ${!data.viewsOnTrack ? `<p><strong>Overage:</strong> ${(data.actualUsage.views - data.expectedViews).toLocaleString()} views over expected</p>` : ''}
-      </div>
-
-      <h2>👥 Visits Usage</h2>
-      <div class="metric-box ${data.visitsOnTrack ? 'on-track' : 'over-usage'}">
-        <p><strong>Current Usage:</strong> ${data.actualUsage.visits.toLocaleString()} / ${data.visitsEntitlement.toLocaleString()} total (${data.visitsPercentage.toFixed(1)}%)</p>
-        <p><strong>Expected at this point:</strong> ${data.expectedVisits.toLocaleString()} (${((data.expectedVisits / data.visitsEntitlement) * 100).toFixed(1)}%)</p>
-        <p><strong>Status:</strong> ${statusIcon(data.visitsOnTrack)} ${statusText(data.visitsOnTrack)}</p>
-        ${!data.visitsOnTrack ? `<p><strong>Overage:</strong> ${(data.actualUsage.visits - data.expectedVisits).toLocaleString()} visits over expected</p>` : ''}
-      </div>
-
-      ${data.actualUsage.error ? `
-        <div style="background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; margin: 20px 0; border-radius: 5px;">
-          <p><strong>⚠️ Data Collection Warning:</strong></p>
-          <p>There was an issue collecting usage data: ${data.actualUsage.error}</p>
-          <p>Values shown may be incomplete. Please check the dashboard manually.</p>
-        </div>
-      ` : ''}
-
-      <div class="footer">
-        <p><strong>Generated by CHURRO</strong> - Stanford University Cloud Hosting Usage Reporting</p>
-        <p>For more details, visit the <a href="${process.env.APP_URL || 'https://churro.stanford.edu'}">CHURRO Dashboard</a></p>
-      </div>
-    </body>
-    </html>
-  `;
 }
\ No newline at end of file
diff --git a/app/api/test/email/route.ts b/app/api/test/email/route.ts
index 58840f1..2deb089 100644
--- a/app/api/test/email/route.ts
+++ b/app/api/test/email/route.ts
@@ -1,9 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { sendDailySummaryEmail } from '@/lib/email-service';
 
 export async function GET(request: NextRequest) {
   try {
-    // Get the current URL to construct the cron endpoint
-    const { origin } = new URL(request.url);
     const cronSecret = process.env.CRON_SECRET;
 
     if (!cronSecret) {
@@ -12,48 +11,12 @@ export async function GET(request: NextRequest) {
       }, { status: 500 });
     }
 
-    console.log('🧪 Triggering test email...');
+    console.log('🧪 Triggering test email via direct function call...');
 
-    // Call the daily summary endpoint with basic auth credentials
-    const basicAuthUsername = process.env.BASIC_AUTH_USERNAME;
-    const basicAuthPassword = process.env.BASIC_AUTH_PASSWORD;
+    // Call the shared email service function directly (no HTTP request needed)
+    const result = await sendDailySummaryEmail();
 
-    if (!basicAuthUsername || !basicAuthPassword) {
-      return NextResponse.json({
-        error: 'BASIC_AUTH_USERNAME and BASIC_AUTH_PASSWORD environment variables are required'
-      }, { status: 500 });
-    }
-
-    const response = await fetch(`${origin}/api/email/daily-summary`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Basic ${Buffer.from(`${basicAuthUsername}:${basicAuthPassword}`).toString('base64')}`,
-        'Content-Type': 'application/json',
-        'X-Cron-Secret': cronSecret, // Use custom header for cron secret
-      },
-    });
-
-    console.log('📊 Response status:', response.status);
-    console.log('📊 Response headers:', Object.fromEntries(response.headers.entries()));
-
-    // Check if response is HTML (indicating middleware rejection)
-    const responseText = await response.text();
-    console.log('📊 Response text preview:', responseText.substring(0, 200));
-
-    let result;
-    try {
-      result = JSON.parse(responseText);
-    } catch (parseError) {
-      console.error('❌ Failed to parse response as JSON:', parseError);
-      return NextResponse.json({
-        success: false,
-        message: 'Received non-JSON response (likely HTML from middleware)',
-        responseStatus: response.status,
-        responsePreview: responseText.substring(0, 500)
-      }, { status: 500 });
-    }
-
-    if (response.ok) {
+    if (result.success) {
       return NextResponse.json({
         success: true,
         message: 'Test email sent successfully!',
@@ -64,7 +27,7 @@ export async function GET(request: NextRequest) {
         success: false,
         message: 'Failed to send test email',
         error: result
-      }, { status: response.status });
+      }, { status: 500 });
     }
   } catch (error) {
     console.error('❌ Test email failed:', error);
diff --git a/lib/email-service.ts b/lib/email-service.ts
new file mode 100644
index 0000000..40572ec
--- /dev/null
+++ b/lib/email-service.ts
@@ -0,0 +1,384 @@
+import { Resend } from 'resend';
+import AcquiaApiServiceFixed from '@/lib/acquia-api';
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+interface EmailServiceResult {
+  success: boolean;
+  message: string;
+  emailId?: string;
+  data?: any;
+  error?: string;
+}
+
+export async function sendDailySummaryEmail(): Promise<EmailServiceResult> {
+  try {
+    // Validate required environment variables
+    const fromEmail = process.env.FROM_EMAIL;
+    if (!fromEmail) {
+      console.error('❌ FROM_EMAIL environment variable not configured');
+      return {
+        success: false,
+        message: 'FROM_EMAIL environment variable is required for email functionality',
+        error: 'Missing FROM_EMAIL'
+      };
+    }
+
+    const adminEmail = process.env.ADMIN_EMAIL;
+    if (!adminEmail) {
+      console.error('❌ ADMIN_EMAIL environment variable not configured');
+      return {
+        success: false,
+        message: 'ADMIN_EMAIL environment variable is required for email functionality',
+        error: 'Missing ADMIN_EMAIL'
+      };
+    }
+
+    const subscriptionUuid = process.env.NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID;
+    if (!subscriptionUuid) {
+      console.error('❌ NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID environment variable not configured');
+      return {
+        success: false,
+        message: 'NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID environment variable is required',
+        error: 'Missing subscription UUID'
+      };
+    }
+
+    // Get monthly entitlements
+    const monthlyViewsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VIEWS_ENTITLEMENT || '30000000', 10);
+    const monthlyVisitsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VISITS_ENTITLEMENT || '9000000', 10);
+
+    console.log('📧 Starting daily summary email generation...');
+
+    // Fetch current month usage data
+    const usageData = await fetchCurrentMonthUsage(subscriptionUuid);
+
+    if (!usageData) {
+      console.error('❌ Failed to fetch usage data from Acquia API');
+      return {
+        success: false,
+        message: 'Failed to fetch usage data from Acquia API',
+        error: 'API fetch failed'
+      };
+    }
+
+    // Calculate month progress and expected usage
+    const now = new Date();
+    const currentDay = now.getDate();
+    const daysInMonth = new Date(now.getFullYear(), now.getMonth() + 1, 0).getDate();
+    const monthProgress = (currentDay / daysInMonth) * 100;
+
+    // Calculate expected usage at this point in the month
+    const expectedViews = Math.round(monthlyViewsEntitlement * (currentDay / daysInMonth));
+    const expectedVisits = Math.round(monthlyVisitsEntitlement * (currentDay / daysInMonth));
+
+    // Calculate percentages of entitlements used
+    const viewsPercentage = (usageData.totalViews / monthlyViewsEntitlement) * 100;
+    const visitsPercentage = (usageData.totalVisits / monthlyVisitsEntitlement) * 100;
+
+    // Determine status
+    const viewsStatus = usageData.totalViews <= expectedViews ? 'On track' : 'Over expected pace';
+    const visitsStatus = usageData.totalVisits <= expectedVisits ? 'On track' : 'Over expected pace';
+
+    const emailData = {
+      views: {
+        actual: usageData.totalViews,
+        percentage: viewsPercentage,
+        expected: expectedViews,
+        entitlement: monthlyViewsEntitlement,
+        status: viewsStatus
+      },
+      visits: {
+        actual: usageData.totalVisits,
+        percentage: visitsPercentage,
+        expected: expectedVisits,
+        entitlement: monthlyVisitsEntitlement,
+        status: visitsStatus
+      },
+      monthProgress: monthProgress,
+      currentDay: currentDay,
+      daysInMonth: daysInMonth,
+      reportDate: now.toLocaleDateString('en-US', {
+        weekday: 'long',
+        year: 'numeric',
+        month: 'long',
+        day: 'numeric'
+      })
+    };
+
+    // Generate and send email
+    const emailHTML = generateEmailHTML(emailData);
+
+    console.log('📧 Sending daily summary email...');
+    const result = await resend.emails.send({
+      from: fromEmail,
+      to: [adminEmail],
+      subject: `CHURRO Daily Usage Summary - ${emailData.reportDate}`,
+      html: emailHTML,
+    });
+
+    if (result.error) {
+      console.error('❌ Failed to send email:', result.error);
+      return {
+        success: false,
+        message: 'Failed to send email',
+        error: result.error.message || 'Unknown email error'
+      };
+    }
+
+    console.log('✅ Daily summary email sent successfully!', result.data?.id);
+
+    return {
+      success: true,
+      message: 'Daily summary email sent successfully',
+      emailId: result.data?.id,
+      data: emailData
+    };
+
+  } catch (error) {
+    console.error('❌ Error in sendDailySummaryEmail:', error);
+    return {
+      success: false,
+      message: 'Error sending daily summary email',
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+async function fetchCurrentMonthUsage(subscriptionUuid: string) {
+  try {
+    console.log('📊 Fetching current month usage data...');
+
+    // Get current month date range (from 1st to yesterday to avoid "future date" API errors)
+    const now = new Date();
+    const firstDayOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+    const yesterday = new Date(now);
+    yesterday.setDate(yesterday.getDate() - 1);
+
+    const fromDate = firstDayOfMonth.toISOString().split('T')[0]; // YYYY-MM-DD format
+    const toDate = yesterday.toISOString().split('T')[0]; // YYYY-MM-DD format
+
+    console.log(`📊 Fetching data from ${fromDate} to ${toDate}`);
+
+    // Initialize Acquia API service
+    const acquiaService = new AcquiaApiServiceFixed({
+      baseUrl: process.env.ACQUIA_API_BASE_URL || 'https://cloud.acquia.com/api',
+      authUrl: process.env.ACQUIA_AUTH_BASE_URL || 'https://accounts.acquia.com/api',
+      apiKey: process.env.ACQUIA_API_KEY || '',
+      apiSecret: process.env.ACQUIA_API_SECRET || ''
+    });
+
+    // Fetch data for current month
+    const [viewsData, visitsData] = await Promise.all([
+      acquiaService.getViewsDataByApplication(subscriptionUuid, fromDate, toDate),
+      acquiaService.getVisitsDataByApplication(subscriptionUuid, fromDate, toDate)
+    ]);
+
+    // Calculate totals
+    const totalViews = viewsData.reduce((sum, item) => sum + (item.views || 0), 0);
+    const totalVisits = visitsData.reduce((sum, item) => sum + (item.visits || 0), 0);
+
+    console.log(`📊 Current month usage: ${totalViews.toLocaleString()} views, ${totalVisits.toLocaleString()} visits`);
+
+    return {
+      totalViews,
+      totalVisits,
+      viewsData,
+      visitsData,
+      dateRange: { from: fromDate, to: toDate }
+    };
+
+  } catch (error) {
+    console.error('❌ Error fetching current month usage:', error);
+    return null;
+  }
+}
+
+function generateEmailHTML(data: any): string {
+  const { views, visits, monthProgress, currentDay, daysInMonth, reportDate } = data;
+
+  return `
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>CHURRO Daily Usage Summary</title>
+      <style>
+        body {
+          font-family: 'Source Sans Pro', Arial, sans-serif;
+          line-height: 1.6;
+          color: #2e2d29;
+          background-color: #f4f4f1;
+          margin: 0;
+          padding: 20px;
+        }
+        .container {
+          max-width: 600px;
+          margin: 0 auto;
+          background-color: #ffffff;
+          border-radius: 8px;
+          box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1);
+          overflow: hidden;
+        }
+        .header {
+          background-color: #8c1515;
+          color: #ffffff;
+          text-align: center;
+          padding: 30px 20px;
+        }
+        .header h1 {
+          margin: 0;
+          font-size: 24px;
+          font-weight: 700;
+        }
+        .content {
+          padding: 30px;
+        }
+        .metric-row {
+          display: flex;
+          justify-content: space-between;
+          align-items: center;
+          padding: 20px;
+          margin: 15px 0;
+          border-radius: 6px;
+          border-left: 4px solid #8c1515;
+        }
+        .metric-row.views {
+          background-color: #f9f6f2;
+        }
+        .metric-row.visits {
+          background-color: #f4f1f9;
+        }
+        .metric-label {
+          font-weight: 600;
+          font-size: 18px;
+          color: #8c1515;
+        }
+        .metric-value {
+          text-align: right;
+          flex: 1;
+          margin-left: 20px;
+        }
+        .metric-number {
+          font-size: 24px;
+          font-weight: 700;
+          color: #2e2d29;
+          display: block;
+        }
+        .metric-percentage {
+          font-size: 14px;
+          color: #767676;
+          display: block;
+        }
+        .status-indicator {
+          padding: 4px 12px;
+          border-radius: 20px;
+          font-size: 12px;
+          font-weight: 600;
+          text-transform: uppercase;
+          margin-top: 5px;
+          display: inline-block;
+        }
+        .status-on-track {
+          background-color: #d4edda;
+          color: #155724;
+        }
+        .status-over {
+          background-color: #f8d7da;
+          color: #721c24;
+        }
+        .progress-section {
+          background-color: #f9f9f9;
+          padding: 20px;
+          border-radius: 6px;
+          margin: 20px 0;
+          text-align: center;
+        }
+        .progress-bar {
+          background-color: #e0e0e0;
+          height: 20px;
+          border-radius: 10px;
+          overflow: hidden;
+          margin: 10px 0;
+        }
+        .progress-fill {
+          background-color: #8c1515;
+          height: 100%;
+          transition: width 0.3s ease;
+        }
+        .footer {
+          background-color: #f8f8f8;
+          padding: 20px;
+          text-align: center;
+          font-size: 12px;
+          color: #767676;
+        }
+        .stanford-branding {
+          color: #8c1515;
+          font-weight: 600;
+        }
+      </style>
+    </head>
+    <body>
+      <div class="container">
+        <div class="header">
+          <h1>📊 CHURRO Daily Usage Summary</h1>
+          <p style="margin: 10px 0 0 0; opacity: 0.9;">${reportDate}</p>
+        </div>
+
+        <div class="content">
+          <div class="progress-section">
+            <h3 style="margin: 0 0 10px 0; color: #8c1515;">Month Progress</h3>
+            <p style="margin: 0; font-size: 16px;">Day ${currentDay} of ${daysInMonth} (${monthProgress.toFixed(1)}% complete)</p>
+            <div class="progress-bar">
+              <div class="progress-fill" style="width: ${Math.min(monthProgress, 100)}%;"></div>
+            </div>
+          </div>
+
+          <div class="metric-row views">
+            <div class="metric-label">
+              📈 Views
+            </div>
+            <div class="metric-value">
+              <span class="metric-number">${views.actual.toLocaleString()}</span>
+              <span class="metric-percentage">${views.percentage.toFixed(1)}% of ${views.entitlement.toLocaleString()} monthly limit</span>
+              <span class="status-indicator ${views.status === 'On track' ? 'status-on-track' : 'status-over'}">
+                ${views.status}
+              </span>
+            </div>
+          </div>
+
+          <div class="metric-row visits">
+            <div class="metric-label">
+              👥 Visits
+            </div>
+            <div class="metric-value">
+              <span class="metric-number">${visits.actual.toLocaleString()}</span>
+              <span class="metric-percentage">${visits.percentage.toFixed(1)}% of ${visits.entitlement.toLocaleString()} monthly limit</span>
+              <span class="status-indicator ${visits.status === 'On track' ? 'status-on-track' : 'status-over'}">
+                ${visits.status}
+              </span>
+            </div>
+          </div>
+
+          <div style="margin-top: 30px; padding: 15px; background-color: #f0f8ff; border-radius: 6px; border-left: 4px solid #0066cc;">
+            <p style="margin: 0; font-size: 14px; color: #2e2d29;">
+              <strong>Expected usage at ${monthProgress.toFixed(1)}% through month:</strong><br>
+              Views: ${views.expected.toLocaleString()} | Visits: ${visits.expected.toLocaleString()}
+            </p>
+          </div>
+        </div>
+
+        <div class="footer">
+          <p style="margin: 0;">
+            Generated by <span class="stanford-branding">CHURRO</span>
+            (Cloud Hosting Usage Reporting with Recurring Output)<br>
+            Stanford University Web Services
+          </p>
+        </div>
+      </div>
+    </body>
+    </html>
+  `;
+}
\ No newline at end of file

From 1c2c2af25fe5da97b0e1f421d1a165f4c669d13b Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 14:57:12 -0800
Subject: [PATCH 06/16] ACHOO-114: Updates from Copilot PR review

---
 .github/copilot-instructions.md      |   5 +-
 app/api/email/daily-summary/route.ts |  14 +-
 app/api/test/email/route.ts          |   8 -
 docs/EMAIL-CONFIGURATION.md          |  35 ++--
 lib/email-service.ts                 | 249 ++++++++++++++++++++-------
 middleware.ts                        |   2 +-
 vercel.json                          |   3 +-
 7 files changed, 228 insertions(+), 88 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 9fb604d..1cb87f4 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -41,6 +41,7 @@
 - `ACQUIA_API_BASE_URL` / `ACQUIA_AUTH_BASE_URL` - API endpoints (optional, defaults provided)
 - `NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID` - Subscription identifier
 - `NEXT_PUBLIC_ACQUIA_MONTHLY_{VIEWS|VISITS}_ENTITLEMENT` - Usage limits
+- `BASIC_AUTH_USERNAME` / `BASIC_AUTH_PASSWORD` - Basic HTTP authentication credentials
 
 **Email Reporting** (optional, for daily summary emails):
 - `RESEND_API_KEY` - Resend.com API key for email delivery
@@ -54,8 +55,8 @@
 ### Authentication
 
 **Basic HTTP Authentication** (`middleware.ts`):
-- Username: `sws`
-- Password: `sws`
+- Credentials: Configured via `BASIC_AUTH_USERNAME` and `BASIC_AUTH_PASSWORD` environment variables
+- **Required**: Must set both environment variables (no fallback values)
 - Protects all routes except `/_next`, `/api/public`, `/favicon.ico`
 - Allows localhost access (IPv4/IPv6) without authentication
 - Returns 401 with WWW-Authenticate header for protected resources
diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
index 11a9539..c19dc68 100644
--- a/app/api/email/daily-summary/route.ts
+++ b/app/api/email/daily-summary/route.ts
@@ -2,17 +2,21 @@ import { NextRequest, NextResponse } from 'next/server';
 import { sendDailySummaryEmail } from '@/lib/email-service';
 
 export async function POST(request: NextRequest) {
-  // Verify cron secret to prevent unauthorized calls
+  // Verify cron authentication using Vercel's native mechanism
   const authHeader = request.headers.get('authorization');
-  const cronSecretHeader = request.headers.get('x-cron-secret');
 
-  // Accept cron secret from either Authorization header or X-Cron-Secret header
-  const providedSecret = authHeader?.replace('Bearer ', '') || cronSecretHeader;
+  // Vercel cron jobs inject: Authorization: Bearer <CRON_SECRET>
+  // Extract the token from "Bearer <token>" format
+  const cronToken = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
 
-  if (providedSecret !== process.env.CRON_SECRET) {
+  // Verify against environment variable
+  if (!cronToken || cronToken !== process.env.CRON_SECRET) {
+    console.error('❌ Unauthorized cron call - invalid or missing CRON_SECRET');
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
+  console.log('✅ Cron authentication successful - executing daily summary...');
+
   // Call the shared email service function
   const result = await sendDailySummaryEmail();
 
diff --git a/app/api/test/email/route.ts b/app/api/test/email/route.ts
index 2deb089..ea78067 100644
--- a/app/api/test/email/route.ts
+++ b/app/api/test/email/route.ts
@@ -3,14 +3,6 @@ import { sendDailySummaryEmail } from '@/lib/email-service';
 
 export async function GET(request: NextRequest) {
   try {
-    const cronSecret = process.env.CRON_SECRET;
-
-    if (!cronSecret) {
-      return NextResponse.json({
-        error: 'CRON_SECRET not configured. Add this environment variable to test email functionality.'
-      }, { status: 500 });
-    }
-
     console.log('🧪 Triggering test email via direct function call...');
 
     // Call the shared email service function directly (no HTTP request needed)
diff --git a/docs/EMAIL-CONFIGURATION.md b/docs/EMAIL-CONFIGURATION.md
index b4f9c5d..5de5ce3 100644
--- a/docs/EMAIL-CONFIGURATION.md
+++ b/docs/EMAIL-CONFIGURATION.md
@@ -77,17 +77,24 @@ openssl rand -base64 32
 To test the daily summary email manually:
 
 ```bash
-# Test via the test endpoint (recommended)
-curl -X GET "http://localhost:3000/api/test/email" \
-  -H "Authorization: Bearer your-cron-secret"
+# Test endpoint - simple browser-accessible testing (no auth required beyond basic auth)
+# Visit in browser: http://localhost:3000/api/test/email
+curl -X GET "http://localhost:3000/api/test/email"
 
-# Or call the cron endpoint directly
+# Production cron endpoint - requires CRON_SECRET for security
 curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
   -H "Authorization: Bearer your-cron-secret" \
   -H "Content-Type: application/json"
+
+# Alternative cron auth method:
+curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
+  -H "X-Cron-Secret: your-cron-secret" \
+  -H "Content-Type: application/json"
 ```
 
-## Data Collection Details
+**Security Note**:
+- **Test endpoint** (`/api/test/email`): Protected by basic auth middleware only - easy for development
+- **Cron endpoint** (`/api/email/daily-summary`): Uses Vercel's native cron authentication with `@CRON_SECRET`## Data Collection Details
 
 **Date Range**: The email uses data from the 1st of the current month through yesterday (to avoid "future date" API errors from Acquia)
 
@@ -100,18 +107,25 @@ curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
 
 ## Cron Schedule
 
-The current schedule in `vercel.json` runs daily at 9 AM UTC:
+The current schedule in `vercel.json` runs daily at 9 AM UTC with Vercel's native cron authentication:
 ```json
 {
   "crons": [
     {
       "path": "/api/email/daily-summary",
-      "schedule": "0 9 * * *"
+      "schedule": "0 9 * * *",
+      "secret": "@CRON_SECRET"
     }
   ]
 }
 ```
 
+**How Vercel Cron Authentication Works**:
+- Vercel automatically injects `Authorization: Bearer <CRON_SECRET>` header
+- The `@CRON_SECRET` references your environment variable
+- No manual header configuration needed - Vercel handles this automatically
+```
+
 ### Common Cron Schedules
 - `0 9 * * *` - 9 AM UTC daily
 - `0 17 * * *` - 5 PM UTC daily (9 AM PST)
@@ -129,9 +143,10 @@ The current schedule in `vercel.json` runs daily at 9 AM UTC:
 
 ### Common Issues
 1. **Email not sending**: Check `RESEND_API_KEY` is valid
-2. **Unauthorized cron calls**: Verify `CRON_SECRET` matches
-3. **No data in email**: Check Acquia API credentials and permissions
-4. **Wrong timezone**: Cron runs in UTC, adjust schedule accordingly
+2. **Unauthorized cron calls**: Verify `CRON_SECRET` matches between environment and request header
+3. **Test endpoint 401 error**: Ensure `CRON_SECRET` is provided in Authorization or X-Cron-Secret header
+4. **No data in email**: Check Acquia API credentials and permissions
+5. **Wrong timezone**: Cron runs in UTC, adjust schedule accordingly
 
 ### Logs
 Check Vercel function logs for:
diff --git a/lib/email-service.ts b/lib/email-service.ts
index 40572ec..aef267f 100644
--- a/lib/email-service.ts
+++ b/lib/email-service.ts
@@ -3,11 +3,47 @@ import AcquiaApiServiceFixed from '@/lib/acquia-api';
 
 const resend = new Resend(process.env.RESEND_API_KEY);
 
+/**
+ * Escapes HTML characters to prevent XSS attacks
+ * @param text - Text to escape
+ * @returns Escaped text safe for HTML insertion
+ */
+function escapeHtml(text: string | number): string {
+  const str = String(text);
+  const htmlEscapeMap: Record<string, string> = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;',
+    '/': '&#x2F;',
+  };
+
+  return str.replace(/[&<>"'\/]/g, (char) => htmlEscapeMap[char] || char);
+}
+
+interface UsageMetric {
+  actual: number;
+  percentage: number;
+  expected: number;
+  entitlement: number;
+  status: 'On track' | 'Over expected pace';
+}
+
+interface EmailData {
+  views: UsageMetric;
+  visits: UsageMetric;
+  monthProgress: number;
+  currentDay: number;
+  daysInMonth: number;
+  reportDate: string;
+}
+
 interface EmailServiceResult {
   success: boolean;
   message: string;
   emailId?: string;
-  data?: any;
+  data?: EmailData;
   error?: string;
 }
 
@@ -48,6 +84,25 @@ export async function sendDailySummaryEmail(): Promise<EmailServiceResult> {
     const monthlyViewsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VIEWS_ENTITLEMENT || '30000000', 10);
     const monthlyVisitsEntitlement = parseInt(process.env.NEXT_PUBLIC_ACQUIA_MONTHLY_VISITS_ENTITLEMENT || '9000000', 10);
 
+    // Validate entitlement values to prevent division by zero
+    if (monthlyViewsEntitlement <= 0) {
+      console.error('❌ NEXT_PUBLIC_ACQUIA_MONTHLY_VIEWS_ENTITLEMENT must be greater than zero');
+      return {
+        success: false,
+        message: 'Invalid views entitlement configuration - must be greater than zero',
+        error: 'Invalid views entitlement'
+      };
+    }
+
+    if (monthlyVisitsEntitlement <= 0) {
+      console.error('❌ NEXT_PUBLIC_ACQUIA_MONTHLY_VISITS_ENTITLEMENT must be greater than zero');
+      return {
+        success: false,
+        message: 'Invalid visits entitlement configuration - must be greater than zero',
+        error: 'Invalid visits entitlement'
+      };
+    }
+
     console.log('📧 Starting daily summary email generation...');
 
     // Fetch current month usage data
@@ -77,8 +132,8 @@ export async function sendDailySummaryEmail(): Promise<EmailServiceResult> {
     const visitsPercentage = (usageData.totalVisits / monthlyVisitsEntitlement) * 100;
 
     // Determine status
-    const viewsStatus = usageData.totalViews <= expectedViews ? 'On track' : 'Over expected pace';
-    const visitsStatus = usageData.totalVisits <= expectedVisits ? 'On track' : 'Over expected pace';
+    const viewsStatus: 'On track' | 'Over expected pace' = usageData.totalViews <= expectedViews ? 'On track' : 'Over expected pace';
+    const visitsStatus: 'On track' | 'Over expected pace' = usageData.totalVisits <= expectedVisits ? 'On track' : 'Over expected pace';
 
     const emailData = {
       views: {
@@ -194,16 +249,36 @@ async function fetchCurrentMonthUsage(subscriptionUuid: string) {
   }
 }
 
-function generateEmailHTML(data: any): string {
+function generateEmailHTML(data: EmailData): string {
   const { views, visits, monthProgress, currentDay, daysInMonth, reportDate } = data;
 
+  // Escape all dynamic content for security
+  const safeReportDate = escapeHtml(reportDate);
+  const safeCurrentDay = escapeHtml(currentDay);
+  const safeDaysInMonth = escapeHtml(daysInMonth);
+  const safeMonthProgress = escapeHtml(monthProgress.toFixed(1));
+
+  // Views data with escaping
+  const safeViewsActual = escapeHtml(views.actual.toLocaleString());
+  const safeViewsPercentage = escapeHtml(views.percentage.toFixed(1));
+  const safeViewsEntitlement = escapeHtml(views.entitlement.toLocaleString());
+  const safeViewsStatus = escapeHtml(views.status);
+  const safeViewsExpected = escapeHtml(views.expected.toLocaleString());
+
+  // Visits data with escaping
+  const safeVisitsActual = escapeHtml(visits.actual.toLocaleString());
+  const safeVisitsPercentage = escapeHtml(visits.percentage.toFixed(1));
+  const safeVisitsEntitlement = escapeHtml(visits.entitlement.toLocaleString());
+  const safeVisitsStatus = escapeHtml(visits.status);
+  const safeVisitsExpected = escapeHtml(visits.expected.toLocaleString());
+
   return `
     <!DOCTYPE html>
     <html lang="en">
     <head>
       <meta charset="UTF-8">
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <title>CHURRO Daily Usage Summary</title>
+      <title>CHURRO Daily Usage Summary - ${safeReportDate}</title>
       <style>
         body {
           font-family: 'Source Sans Pro', Arial, sans-serif;
@@ -235,30 +310,33 @@ function generateEmailHTML(data: any): string {
         .content {
           padding: 30px;
         }
-        .metric-row {
-          display: flex;
-          justify-content: space-between;
-          align-items: center;
-          padding: 20px;
+        .metric-table {
+          width: 100%;
           margin: 15px 0;
           border-radius: 6px;
           border-left: 4px solid #8c1515;
+          border-collapse: collapse;
+          overflow: hidden;
         }
-        .metric-row.views {
+        .metric-table.views {
           background-color: #f9f6f2;
         }
-        .metric-row.visits {
+        .metric-table.visits {
           background-color: #f4f1f9;
         }
+        .metric-table td {
+          padding: 20px;
+          vertical-align: middle;
+        }
         .metric-label {
           font-weight: 600;
           font-size: 18px;
           color: #8c1515;
+          width: 120px;
         }
         .metric-value {
           text-align: right;
-          flex: 1;
-          margin-left: 20px;
+          width: auto;
         }
         .metric-number {
           font-size: 24px;
@@ -318,65 +396,114 @@ function generateEmailHTML(data: any): string {
           color: #8c1515;
           font-weight: 600;
         }
+        .sr-only {
+          position: absolute;
+          width: 1px;
+          height: 1px;
+          padding: 0;
+          margin: -1px;
+          overflow: hidden;
+          clip: rect(0, 0, 0, 0);
+          white-space: nowrap;
+          border: 0;
+        }
+        .skip-link {
+          position: absolute;
+          top: -40px;
+          left: 6px;
+          background: #000;
+          color: #fff;
+          padding: 8px;
+          text-decoration: none;
+          z-index: 1000;
+        }
+        .skip-link:focus {
+          top: 6px;
+        }
       </style>
     </head>
     <body>
-      <div class="container">
-        <div class="header">
-          <h1>📊 CHURRO Daily Usage Summary</h1>
-          <p style="margin: 10px 0 0 0; opacity: 0.9;">${reportDate}</p>
-        </div>
-
-        <div class="content">
-          <div class="progress-section">
-            <h3 style="margin: 0 0 10px 0; color: #8c1515;">Month Progress</h3>
-            <p style="margin: 0; font-size: 16px;">Day ${currentDay} of ${daysInMonth} (${monthProgress.toFixed(1)}% complete)</p>
-            <div class="progress-bar">
+      <a href="#main-content" class="skip-link">Skip to main content</a>
+      <div class="container" role="main">
+        <header class="header" role="banner">
+          <h1><span aria-hidden="true">📊</span> CHURRO Daily Usage Summary</h1>
+          <p style="margin: 10px 0 0 0; opacity: 0.9;">${safeReportDate}</p>
+        </header>
+
+        <main class="content" id="main-content">
+          <section class="progress-section" aria-labelledby="progress-heading">
+            <h2 id="progress-heading" style="margin: 0 0 10px 0; color: #8c1515; font-size: 18px;">Month Progress</h2>
+            <p style="margin: 0; font-size: 16px;">Day ${safeCurrentDay} of ${safeDaysInMonth} (${safeMonthProgress}% complete)</p>
+            <div class="progress-bar" role="progressbar" aria-valuenow="${Math.round(monthProgress)}" aria-valuemin="0" aria-valuemax="100" aria-label="Month progress: ${safeMonthProgress}% complete">
               <div class="progress-fill" style="width: ${Math.min(monthProgress, 100)}%;"></div>
             </div>
-          </div>
-
-          <div class="metric-row views">
-            <div class="metric-label">
-              📈 Views
-            </div>
-            <div class="metric-value">
-              <span class="metric-number">${views.actual.toLocaleString()}</span>
-              <span class="metric-percentage">${views.percentage.toFixed(1)}% of ${views.entitlement.toLocaleString()} monthly limit</span>
-              <span class="status-indicator ${views.status === 'On track' ? 'status-on-track' : 'status-over'}">
-                ${views.status}
-              </span>
-            </div>
-          </div>
-
-          <div class="metric-row visits">
-            <div class="metric-label">
-              👥 Visits
-            </div>
-            <div class="metric-value">
-              <span class="metric-number">${visits.actual.toLocaleString()}</span>
-              <span class="metric-percentage">${visits.percentage.toFixed(1)}% of ${visits.entitlement.toLocaleString()} monthly limit</span>
-              <span class="status-indicator ${visits.status === 'On track' ? 'status-on-track' : 'status-over'}">
-                ${visits.status}
-              </span>
-            </div>
-          </div>
-
-          <div style="margin-top: 30px; padding: 15px; background-color: #f0f8ff; border-radius: 6px; border-left: 4px solid #0066cc;">
+            <p class="sr-only">Progress bar showing ${safeMonthProgress}% of the month has elapsed</p>
+          </section>
+
+          <table class="metric-table views" cellpadding="0" cellspacing="0" role="table" aria-labelledby="views-caption">
+            <caption id="views-caption" class="sr-only">Website Views Usage Summary</caption>
+            <thead class="sr-only">
+              <tr>
+                <th scope="col">Metric Type</th>
+                <th scope="col">Current Usage and Status</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr>
+                <th scope="row" class="metric-label">
+                  <span aria-hidden="true">📈</span> Views
+                </th>
+                <td class="metric-value">
+                  <span class="metric-number">${safeViewsActual}</span>
+                  <span class="metric-percentage">${safeViewsPercentage}% of ${safeViewsEntitlement} monthly limit</span>
+                  <span class="status-indicator ${views.status === 'On track' ? 'status-on-track' : 'status-over'}" role="status" aria-label="Status: ${safeViewsStatus}">
+                    <span aria-hidden="true">${views.status === 'On track' ? '✓' : '⚠'}</span> ${safeViewsStatus}
+                  </span>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+
+          <table class="metric-table visits" cellpadding="0" cellspacing="0" role="table" aria-labelledby="visits-caption">
+            <caption id="visits-caption" class="sr-only">Website Visits Usage Summary</caption>
+            <thead class="sr-only">
+              <tr>
+                <th scope="col">Metric Type</th>
+                <th scope="col">Current Usage and Status</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr>
+                <th scope="row" class="metric-label">
+                  <span aria-hidden="true">👥</span> Visits
+                </th>
+                <td class="metric-value">
+                  <span class="metric-number">${safeVisitsActual}</span>
+                  <span class="metric-percentage">${safeVisitsPercentage}% of ${safeVisitsEntitlement} monthly limit</span>
+                  <span class="status-indicator ${visits.status === 'On track' ? 'status-on-track' : 'status-over'}" role="status" aria-label="Status: ${safeVisitsStatus}">
+                    <span aria-hidden="true">${visits.status === 'On track' ? '✓' : '⚠'}</span> ${safeVisitsStatus}
+                  </span>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+
+          <section style="margin-top: 30px; padding: 15px; background-color: #f0f8ff; border-radius: 6px; border-left: 4px solid #0066cc;" aria-labelledby="expected-usage">
+            <h3 id="expected-usage" style="margin: 0 0 5px 0; font-size: 14px; font-weight: bold; color: #2e2d29;">Expected Usage Comparison</h3>
             <p style="margin: 0; font-size: 14px; color: #2e2d29;">
-              <strong>Expected usage at ${monthProgress.toFixed(1)}% through month:</strong><br>
-              Views: ${views.expected.toLocaleString()} | Visits: ${visits.expected.toLocaleString()}
+              At ${safeMonthProgress}% through the month, expected usage should be:<br>
+              <span role="definition">Views: ${safeViewsExpected}</span> | <span role="definition">Visits: ${safeVisitsExpected}</span>
             </p>
-          </div>
-        </div>
+          </section>
+        </main>
 
-        <div class="footer">
+        <footer class="footer" role="contentinfo">
           <p style="margin: 0;">
             Generated by <span class="stanford-branding">CHURRO</span>
-            (Cloud Hosting Usage Reporting with Recurring Output)<br>
+            <span class="sr-only">(</span><abbr title="Cloud Hosting Usage Reporting with Recurring Output">CHURRO</abbr><span class="sr-only">)</span><br>
             Stanford University Web Services
           </p>
-        </div>
+        </footer>
       </div>
     </body>
     </html>
diff --git a/middleware.ts b/middleware.ts
index ac2279c..14b16aa 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -32,7 +32,7 @@ export function middleware(request: NextRequest) {
   // Check if basic auth environment variables are configured
   if (!USERNAME || !PASSWORD) {
     console.error('❌ BASIC_AUTH_USERNAME or BASIC_AUTH_PASSWORD environment variables not configured');
-    return new NextResponse('Server configuration error - basic auth not configured', {
+    return new NextResponse('Server configuration error - authentication not configured', {
       status: 500,
     });
   }
diff --git a/vercel.json b/vercel.json
index 0772313..23e4f63 100644
--- a/vercel.json
+++ b/vercel.json
@@ -2,7 +2,8 @@
   "crons": [
     {
       "path": "/api/email/daily-summary",
-      "schedule": "0 9 * * *"
+      "schedule": "0 9 * * *",
+      "secret": "@CRON_SECRET"
     }
   ]
 }
\ No newline at end of file

From 2a4b7b4f024d58582f08d2ec802cf042393282e0 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 15:03:15 -0800
Subject: [PATCH 07/16] fixup! Vercel cron implementation

---
 app/api/email/daily-summary/route.ts | 47 ++++++++++++++++++----------
 docs/EMAIL-CONFIGURATION.md          | 14 ++++-----
 vercel.json                          |  3 +-
 3 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
index c19dc68..ba52d23 100644
--- a/app/api/email/daily-summary/route.ts
+++ b/app/api/email/daily-summary/route.ts
@@ -2,27 +2,40 @@ import { NextRequest, NextResponse } from 'next/server';
 import { sendDailySummaryEmail } from '@/lib/email-service';
 
 export async function POST(request: NextRequest) {
-  // Verify cron authentication using Vercel's native mechanism
-  const authHeader = request.headers.get('authorization');
+  try {
+    // Verify this is a legitimate Vercel cron job request
+    const userAgent = request.headers.get('user-agent');
+    const authHeader = request.headers.get('authorization');
 
-  // Vercel cron jobs inject: Authorization: Bearer <CRON_SECRET>
-  // Extract the token from "Bearer <token>" format
-  const cronToken = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
+    // Check for Vercel cron user agent OR manual auth with CRON_SECRET
+    const isVercelCron = userAgent?.includes('vercel-cron/1.0');
+    const manualAuth = authHeader?.startsWith('Bearer ') &&
+                      authHeader.slice(7) === process.env.CRON_SECRET;
 
-  // Verify against environment variable
-  if (!cronToken || cronToken !== process.env.CRON_SECRET) {
-    console.error('❌ Unauthorized cron call - invalid or missing CRON_SECRET');
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-  }
+    if (!isVercelCron && !manualAuth) {
+      console.error('❌ Unauthorized cron call - not from Vercel cron and no valid CRON_SECRET');
+      return NextResponse.json({
+        error: 'Unauthorized - must be Vercel cron job or provide valid CRON_SECRET'
+      }, { status: 401 });
+    }
 
-  console.log('✅ Cron authentication successful - executing daily summary...');
+    const requestSource = isVercelCron ? 'Vercel Cron' : 'Manual (authenticated)';
+    console.log(`✅ ${requestSource} authentication successful - executing daily summary...`);
 
-  // Call the shared email service function
-  const result = await sendDailySummaryEmail();
+    // Call the shared email service function
+    const result = await sendDailySummaryEmail();
 
-  if (result.success) {
-    return NextResponse.json(result);
-  } else {
-    return NextResponse.json(result, { status: 500 });
+    if (result.success) {
+      return NextResponse.json(result);
+    } else {
+      return NextResponse.json(result, { status: 500 });
+    }
+  } catch (error) {
+    console.error('❌ Error in daily summary cron job:', error);
+    return NextResponse.json({
+      success: false,
+      message: 'Error executing daily summary cron job',
+      error: error instanceof Error ? error.message : String(error)
+    }, { status: 500 });
   }
 }
\ No newline at end of file
diff --git a/docs/EMAIL-CONFIGURATION.md b/docs/EMAIL-CONFIGURATION.md
index 5de5ce3..3db0ffd 100644
--- a/docs/EMAIL-CONFIGURATION.md
+++ b/docs/EMAIL-CONFIGURATION.md
@@ -94,7 +94,7 @@ curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
 
 **Security Note**:
 - **Test endpoint** (`/api/test/email`): Protected by basic auth middleware only - easy for development
-- **Cron endpoint** (`/api/email/daily-summary`): Uses Vercel's native cron authentication with `@CRON_SECRET`## Data Collection Details
+- **Cron endpoint** (`/api/email/daily-summary`): Accepts Vercel cron jobs (via User-Agent) OR manual requests with `CRON_SECRET`## Data Collection Details
 
 **Date Range**: The email uses data from the 1st of the current month through yesterday (to avoid "future date" API errors from Acquia)
 
@@ -107,23 +107,23 @@ curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
 
 ## Cron Schedule
 
-The current schedule in `vercel.json` runs daily at 9 AM UTC with Vercel's native cron authentication:
+The current schedule in `vercel.json` runs daily at 9 AM UTC:
 ```json
 {
   "crons": [
     {
       "path": "/api/email/daily-summary",
-      "schedule": "0 9 * * *",
-      "secret": "@CRON_SECRET"
+      "schedule": "0 9 * * *"
     }
   ]
 }
 ```
 
 **How Vercel Cron Authentication Works**:
-- Vercel automatically injects `Authorization: Bearer <CRON_SECRET>` header
-- The `@CRON_SECRET` references your environment variable
-- No manual header configuration needed - Vercel handles this automatically
+- Vercel cron jobs include `vercel-cron/1.0` in the User-Agent header
+- The endpoint validates this header to ensure requests come from Vercel
+- Manual testing still requires `CRON_SECRET` for security
+- No additional configuration needed in `vercel.json`
 ```
 
 ### Common Cron Schedules
diff --git a/vercel.json b/vercel.json
index 23e4f63..0772313 100644
--- a/vercel.json
+++ b/vercel.json
@@ -2,8 +2,7 @@
   "crons": [
     {
       "path": "/api/email/daily-summary",
-      "schedule": "0 9 * * *",
-      "secret": "@CRON_SECRET"
+      "schedule": "0 9 * * *"
     }
   ]
 }
\ No newline at end of file

From e2cda16831124f55183cfdee410db216bbc145d8 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 15:34:24 -0800
Subject: [PATCH 08/16] Update logic, error handling, doxn

---
 .github/copilot-instructions-caching.md | 295 ++++++++++++++++++++++++
 .github/copilot-instructions-saml.md    | 282 ++++++++++++++++++++++
 .github/copilot-instructions.md         |  24 +-
 app/api/email/daily-summary/route.ts    |  28 ++-
 docs/EMAIL-CONFIGURATION.md             |  11 +-
 middleware.ts                           |  24 +-
 6 files changed, 642 insertions(+), 22 deletions(-)
 create mode 100644 .github/copilot-instructions-caching.md
 create mode 100644 .github/copilot-instructions-saml.md

diff --git a/.github/copilot-instructions-caching.md b/.github/copilot-instructions-caching.md
new file mode 100644
index 0000000..675c872
--- /dev/null
+++ b/.github/copilot-instructions-caching.md
@@ -0,0 +1,295 @@
+# CHURRO - AI Development Guidelines
+
+## Project Overview
+**CHURRO** (Cloud Hosting Usage Reporting with Recurring Output) is a Next.js 15 dashboard for visualizing Acquia Cloud hosting analytics (views/visits data). Built for Stanford University with Stanford Design System (Decanter) styling and basic HTTP authentication.
+
+## Architecture
+
+### Tech Stack
+- **Framework**: Next.js 15.5+ (App Router only, no Pages Router)
+- **Runtime**: Node.js 22.x (enforced via package.json engines)
+- **Styling**: TailwindCSS with Decanter preset (Stanford Design System)
+- **Authentication**: Basic HTTP Authentication via middleware
+- **Data Viz**: Recharts for charts/graphs
+- **Deployment**: Vercel
+
+### Key Components
+
+**API Routes** (`app/api/`):
+- `/api/acquia/applications` - Fetches all Acquia applications
+- `/api/acquia/visits` - Fetches visits metrics with pagination
+- `/api/acquia/views` - Fetches views metrics with pagination
+- `/api/cache` - Cache management endpoint (GET/DELETE)
+
+**Core Services** (`lib/`):
+- `lib/acquia-api.ts` - Acquia Cloud API client with hybrid caching and pagination
+- `lib/cache-hybrid.ts` - Hybrid caching system (file-based local, unstable_cache production)
+- `lib/cache.ts` - File-based caching for local development
+
+**Main Pages**:
+- `/` - Dashboard with date filtering and tabbed views (Dashboard component)
+- `/applications` - Applications overview table (auto-loading, filtered)
+- `/applications/[uuid]` - Individual application detail with daily charts
+
+**Data Flow**:
+1. User accesses application → Basic auth via middleware
+2. Dashboard/pages fetch from `/api/acquia/*` routes
+3. API routes use `AcquiaApiServiceFixed` with OAuth2 client_credentials flow
+4. Response data parsed from Acquia's nested `_embedded.items[].datapoints[]` structure
+5. Data cached using hybrid cache system for 5 minutes
+
+## Development Patterns
+
+### Environment Variables
+**Required** (stored in `.env.local`, never committed):
+- `ACQUIA_API_KEY` / `ACQUIA_API_SECRET` - OAuth2 credentials (no quotes)
+- `NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID` - Subscription identifier
+- `NEXT_PUBLIC_ACQUIA_MONTHLY_{VIEWS|VISITS}_ENTITLEMENT` - Usage limits
+- `ACQUIA_API_BASE_URL` - API base URL (defaults to https://cloud.acquia.com/api)
+- `ACQUIA_AUTH_BASE_URL` - Auth base URL (defaults to https://accounts.acquia.com/api)
+
+**Critical**: Values must NOT have surrounding quotes. API key/secret are auto-stripped of quotes in `acquia-api.ts`.
+
+### Authentication
+
+**Basic HTTP Authentication** (`middleware.ts`):
+- Username: `sws`
+- Password: `sws`
+- Protects all routes except `/_next`, `/api/public`, `/favicon.ico`
+- Allows localhost access (IPv4/IPv6) without authentication
+- Returns 401 with WWW-Authenticate header for protected resources
+
+### Stanford Design System (Decanter)
+
+**Colors** - Use semantic Decanter tokens, NOT hex values:
+- Primary: `cardinal-red` (Stanford brand red)
+- Accents: `digital-blue`, `digital-green`
+- Grays: `black-{10,20,60,80}`, `gc-black`
+- **Never use**: Custom hex colors unless explicitly non-Stanford branding
+
+**Typography**:
+- Headings: `type-{0,1,2,3,4}` classes (defined in Decanter)
+- Body: `Source_Sans_3` (imported in `app/layout.tsx`)
+- Serif: `Source_Serif_4` for emphasis
+- Display: Custom `stanford` font (local woff2)
+
+**Interaction States**:
+- Use `hocus:` prefix for hover+focus states (Decanter utility)
+- Example: `hocus:bg-black hocus:text-white`
+
+**Spacing**:
+- Use Decanter scale: `p-{5,8,10,15,20,25,30,50}` (not arbitrary values)
+- Responsive: `px-20 sm:px-30 md:px-50 lg:px-30`
+
+### Acquia API Integration
+
+**Authentication** (`lib/acquia-api.ts`):
+- OAuth2 client credentials flow with 3 fallback methods
+- Token cached in `this.accessToken`, auto-retries on 401
+- Credentials auto-cleaned of quotes
+
+**Data Parsing**:
+- Response structure: `_embedded.items[]` where each item = one application
+- Each item has `metadata.application.uuids[0]` + `datapoints[]` array
+- Datapoints format: `["2025-04-15T00:00:00+00:00", "1124"]` (date, value)
+- **Critical**: ONE item = ONE application, ALL datapoints belong to that app
+
+**Caching**:
+- Hybrid cache system: file-based (local) vs unstable_cache (production)
+- 5-minute cache duration with deployment-based invalidation
+- Cache keys based on deployment ID for automatic invalidation
+- Browser cache prevention via `cache: 'reload'` and unique timestamps
+
+**Date Filtering**:
+- API expects ISO 8601: `2025-04-15T23:59:59.000Z`
+- Frontend sends: `YYYY-MM-DD` (conditional - only if user sets dates)
+- No default date filtering (fetches all available data)
+
+### Hybrid Caching System
+
+**Local Development** (`lib/cache.ts`):
+- File-based caching in `.cache/` directory
+- 5-minute TTL with file timestamps
+- Persists across server restarts
+- Manual clearing via file deletion
+
+**Production** (`lib/cache-hybrid.ts`):
+- Next.js `unstable_cache` with deployment versioning
+- Cache keys include `VERCEL_DEPLOYMENT_ID` for auto-invalidation
+- Application-layer timestamp validation (5 minutes)
+- Browser cache prevention via headers and unique URLs
+
+**Key Features**:
+- Environment detection at runtime
+- Deployment-based cache invalidation
+- Cross-instance cache sharing on Vercel
+- Manual cache clearing via `/api/cache` DELETE endpoint
+
+### Component Patterns
+
+**Client Components** - Use `'use client'` directive when:
+- Using React hooks (`useState`, `useEffect`)
+- Browser APIs (localStorage, fetch)
+- Timer components (`CountUpTimer`)
+
+**Server Components** - Default for:
+- Page layouts (`app/layout.tsx`)
+- Static content rendering
+
+**Data Fetching**:
+- Client-side: `fetch('/api/acquia/visits')` with cache-busting timestamps
+- Pass query params: `new URLSearchParams({ subscriptionUuid, from, to })`
+- Handle loading states with `CountUpTimer` component
+
+## Page Architecture
+
+### Dashboard (`/`)
+- **Purpose**: Main analytics dashboard with date filtering
+- **Features**:
+  - User-configurable date range inputs
+  - Subscription UUID input field
+  - Tabbed interface (pie charts, bar charts, data tables)
+  - Manual "Fetch Analytics Data" button
+  - Cache clearing functionality
+- **Data**: Fetches all apps, views, and visits with optional date filtering
+
+### Applications Page (`/applications`)
+- **Purpose**: Overview table of all applications with statistics
+- **Features**:
+  - Auto-loads on page mount (no manual refresh needed)
+  - Shows current Pacific time timestamp
+  - Displays views/visits totals and percentages
+  - Links to individual application pages
+  - Excludes specific UUIDs: `2b2d2517-3839-414e-85a4-7183adc22283`, `1ef402a7-c301-42d7-9b63-f226fa1b2329`
+- **Data**: Fetches all available data (no date filtering)
+- **Styling**: Stanford Design System table with alternating rows
+
+### Application Detail (`/applications/[uuid]`)
+- **Purpose**: Individual application analytics with daily resolution
+- **Features**:
+  - Date range picker for custom filtering
+  - Daily resolution charts (line charts)
+  - Application name resolution from UUID
+  - Cache clearing functionality
+- **Data**: Fetches daily data with `resolution=day` parameter
+
+## Common Tasks
+
+### Adding a New Chart Type
+1. Create component in `components/` (e.g., `NewChart.tsx`)
+2. Import Recharts primitives: `{ BarChart, Bar, XAxis, YAxis, Tooltip }`
+3. Accept `data` prop with `{ name: string, value: number, uuid: string }[]`
+4. Use Decanter colors: `className='fill-cardinal-red'`
+5. Add tab to Dashboard TABS array
+6. Add conditional render in tab content section
+
+### Debugging Acquia API Issues
+1. Check API route error responses for detailed error info including envCheck
+2. Verify auth credentials are set correctly (no quotes)
+3. Monitor cache behavior via console logs
+4. Use "Clear Cache" functionality to force fresh data
+
+### Environment Setup
+
+**Local Development**:
+```bash
+nvm use                     # Ensures Node 22.x
+npm install                 # Install dependencies
+
+# Configure environment
+cp .env.example .env.local  # Create env file if needed
+# Edit .env.local with required Acquia credentials
+
+npm run dev                 # Start development server
+```
+
+### Adding New Application Exclusions
+1. Edit the `EXCLUDED_UUIDS` array in `/app/applications/page.tsx`
+2. Add UUID string to the array
+3. Applications will be filtered from both table display and statistics
+
+### Cache Management
+1. **Local**: Cache stored in `.cache/` directory (gitignored)
+2. **Production**: Cache cleared automatically on deployment
+3. **Manual**: Use "Clear Cache" buttons in UI or `DELETE /api/cache`
+4. **TTL**: 5 minutes across all environments
+
+## File Organization
+
+```
+app/
+  api/              # API routes (Next.js 15 route handlers)
+    acquia/         # Acquia Cloud API proxy routes
+    cache/          # Cache management endpoint
+  applications/     # Applications pages
+    [uuid]/         # Individual application detail
+    page.tsx        # Applications overview table
+  page.tsx          # Home page (Dashboard component)
+  layout.tsx        # Root layout with Stanford fonts
+components/         # React components
+  Dashboard.tsx     # Main dashboard with tabs and charts
+  CountUpTimer.tsx  # Loading timer component
+  [Charts]/         # Recharts-based chart components
+  [UI]/             # Stanford Design System components
+lib/                # Core business logic
+  acquia-api.ts     # Acquia API client with OAuth2 and caching
+  cache-hybrid.ts   # Hybrid caching system
+  cache.ts          # File-based cache (local development)
+docs/               # Documentation
+  caching.md        # Comprehensive caching system docs
+middleware.ts       # Basic HTTP authentication
+utilities/          # Helper utilities
+```
+
+## Testing & Verification
+
+**Local Testing**:
+- Use basic auth credentials: sws/sws
+- Test API endpoints directly via browser DevTools
+- Check cache behavior via console logs
+- Check API error responses for envCheck debugging info
+
+**Production Checklist**:
+- Verify all environment variables set in Vercel
+- Test basic authentication works
+- Confirm caching behavior (5-minute TTL)
+- Check that excluded applications don't appear in `/applications`
+
+## Common Pitfalls
+
+1. **Quoted env vars** - `ACQUIA_API_KEY="abc"` breaks auth (remove quotes)
+2. **Wrong auth method** - This branch uses basic HTTP auth, not SAML
+3. **Date format mismatch** - Frontend sends `YYYY-MM-DD`, API needs ISO 8601
+4. **Cache staleness** - 5-minute cache may hide API issues, use cache clearing
+5. **Decanter overrides** - Don't use arbitrary Tailwind values, use Decanter tokens
+6. **Application filtering** - Remember to add UUIDs to exclusion list when needed
+
+## Dependencies
+
+**Core Dependencies**:
+- `next` ^15.5.2 - Next.js framework
+- `react` 18.3.1 - React library
+- `axios` ^1.12.0 - HTTP client for API calls
+- `recharts` ^2.12.7 - Chart components
+- `decanter` ^7.4.0 - Stanford Design System
+- `basic-auth` ^2.0.1 - Basic authentication utilities
+
+**Development Dependencies**:
+- `typescript` ^5.5.2 - TypeScript support
+- `tailwindcss` ^3.4.17 - Utility-first CSS
+- `eslint` ^8.57.0 - Code linting
+
+## Key Documentation
+
+- **Caching System**: `docs/caching.md` (comprehensive caching guide)
+- **Acquia API**: https://cloud.acquia.com/api (official docs, requires login)
+- **Acquia API Rate Limits**: https://docs.acquia.com/acquia-cloud-platform/developing-cloud-platform-api (rate limiting information)
+- **Decanter**: https://decanter.stanford.edu (Stanford Design System)
+- **Next.js 15**: https://nextjs.org/docs (App Router only)
+
+## Branch Strategy
+- Current branch: `ACHOO-119-20251015`
+- Repository: `SU-SWS/churro` (Stanford University Web Services)
+
+---
+*Last Updated: November 2025 - Reflects current implementation with basic HTTP auth and hybrid caching*
diff --git a/.github/copilot-instructions-saml.md b/.github/copilot-instructions-saml.md
new file mode 100644
index 0000000..91b87e5
--- /dev/null
+++ b/.github/copilot-instructions-saml.md
@@ -0,0 +1,282 @@
+# CHURRO - AI Development Guidelines
+
+## Project Overview
+**CHURRO** (Cloud Hosting Usage Reporting with Recurring Output) is a Next.js 15 dashboard for visualizing Acquia Cloud hosting analytics (views/visits data). Built for Stanford University with Stanford Design System (Decanter) styling and Stanford SAML SSO integration.
+
+## Architecture
+
+### Tech Stack
+- **Framework**: Next.js 15.5+ (App Router only, no Pages Router)
+- **Runtime**: Node.js 22.x (enforced via package.json engines)
+- **Styling**: TailwindCSS with Decanter preset (Stanford Design System)
+- **Authentication**: Stanford SAML SSO via `@node-saml/node-saml`
+- **Data Viz**: Recharts for charts/graphs
+- **Deployment**: Vercel
+
+### Key Components
+
+**API Routes** (`app/api/`):
+- `/api/acquia/applications` - Fetches all Acquia applications
+- `/api/acquia/visits` - Fetches visits metrics with pagination
+- `/api/acquia/views` - Fetches views metrics with pagination
+- `/api/saml/login` - Initiates SAML authentication flow
+- `/api/saml/acs` - Assertion Consumer Service for SAML callbacks
+- `/api/saml/metadata` - Generates SP metadata XML
+
+**Core Services** (`lib/`):
+- `lib/acquia-api.ts` - Acquia Cloud API client with 6-hour caching and pagination
+- `lib/saml-config.ts` - SAML configuration with signed requests
+
+**Data Flow**:
+1. User selects date range → Dashboard component
+2. Dashboard fetches from `/api/acquia/*` routes
+3. API routes use `AcquiaApiServiceFixed` with OAuth2 client_credentials flow
+4. Response data parsed from Acquia's nested `_embedded.items[].datapoints[]` structure
+5. Data cached in-memory for 6 hours with cache keys based on query params
+
+## Development Patterns
+
+### Environment Variables
+**Required** (stored in `.env.local`, never committed):
+- `ACQUIA_API_KEY` / `ACQUIA_API_SECRET` - OAuth2 credentials (no quotes)
+- `NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID` - Subscription identifier
+- `NEXT_PUBLIC_ACQUIA_MONTHLY_{VIEWS|VISITS}_ENTITLEMENT` - Usage limits
+- `SAML_CERT`, `SAML_SP_CERT`, `SAML_SP_PRIVATE_KEY` - SAML certificates
+- `APP_URL` - Base URL (production URL, or inferred from request in dev)
+- `JWT_SECRET` - JWT signing secret (generate with `openssl rand -base64 32`)
+
+**Critical**: Values must NOT have surrounding quotes. API key/secret are auto-stripped of quotes in `acquia-api.ts` (lines 91-92).
+
+### Stanford Design System (Decanter)
+
+**Colors** - Use semantic Decanter tokens, NOT hex values:
+- Primary: `cardinal-red` (Stanford brand red)
+- Accents: `digital-blue`, `digital-green`
+- Grays: `black-{10,20,60,80}`, `gc-black`
+- **Never use**: Custom hex colors unless explicitly non-Stanford branding
+
+**Typography**:
+- Headings: `type-{0,1,2,3,4}` classes (defined in Decanter)
+- Body: `Source_Sans_3` (imported in `app/layout.tsx`)
+- Serif: `Source_Serif_4` for emphasis
+- Display: Custom `stanford` font (local woff2)
+
+**Interaction States**:
+- Use `hocus:` prefix for hover+focus states (Decanter utility)
+- Example: `hocus:bg-black hocus:text-white`
+
+**Spacing**:
+- Use Decanter scale: `p-{5,8,10,15,20,25,30,50}` (not arbitrary values)
+- Responsive: `px-20 sm:px-30 md:px-50 lg:px-30`
+
+### Acquia API Integration
+
+**Authentication** (`lib/acquia-api.ts` lines 81-177):
+- OAuth2 client credentials flow with 3 fallback methods
+- Token cached in `this.accessToken`, auto-retries on 401
+- **Debug tip**: Check lines 127-142 for auth method attempts
+
+**Data Parsing** (`lib/acquia-api.ts` lines 312-466):
+- Response structure: `_embedded.items[]` where each item = one application
+- Each item has `metadata.application.uuids[0]` + `datapoints[]` array
+- Datapoints format: `["2025-04-15T00:00:00+00:00", "1124"]` (date, value)
+- **Critical**: ONE item = ONE application, ALL datapoints belong to that app
+
+**Caching**:
+- 6-hour in-memory cache (lines 10-24)
+- Cache keys: `generateCacheKey([endpoint, uuid, from, to, resolution])`
+- Cache hit returns immediately without API call
+
+**Date Filtering** (lines 218-262):
+- API expects ISO 8601: `2025-04-15T23:59:59.000Z`
+- Frontend sends: `YYYY-MM-DD`
+- Conversion adds `T00:00:00.000Z` (start) or `T23:59:59.000Z` (end)
+- Filter format: `filter=from=2025-04-01T00:00:00.000Z,to=2025-04-30T23:59:59.000Z`
+
+### SAML Authentication
+
+**Flow** (detailed in `docs/SAML.md`):
+1. User clicks "Sign In with Stanford SAML" → `/api/saml/login`
+2. `saml.getAuthorizeUrlAsync()` generates signed AuthnRequest
+3. Redirect to Stanford IdP (`login-uat.stanford.edu` or `login.stanford.edu`)
+4. Stanford returns signed+encrypted assertion to `/api/saml/acs`
+5. `saml.validatePostResponseAsync()` verifies signature and decrypts
+6. Extract attributes via OID mappings (e.g., `urn:oid:0.9.2342.19200300.100.1.1` = SUNet ID)
+7. Generate JWT token from user profile using `jose` library (`lib/jwt-auth.ts`)
+8. Set JWT in HTTP-only cookie (`churro-auth-token`) with 24-hour expiration
+9. Redirect to application (no user data in URL params - security best practice)
+
+**JWT Cookie Authentication** (`lib/jwt-auth.ts`):
+- Uses `jose` library for JWT signing/verification with HS256 algorithm
+- Secret from `JWT_SECRET` environment variable (required, no default)
+- Cookie options: `httpOnly: true`, `secure: true` (production), `sameSite: 'lax'`
+- Token expires in 24 hours
+- Helper functions: `generateJWT()`, `verifyJWT()`, `getJWTCookieName()`
+
+**Middleware Protection** (`middleware.ts`):
+- Checks JWT cookie on protected routes (e.g., `/protected/*`)
+- Verifies token validity and redirects to `/api/saml/login` if invalid
+- Adds user info to request headers (`x-user-id`, `x-user-sunetid`, `x-user-email`)
+- Non-protected routes pass through without checks
+
+**Client-Side Auth Checking**:
+- Use `/api/auth/status` to check authentication (reads HTTP-only cookie server-side)
+- Returns `{ authenticated: boolean, user: {...} }`
+- Use `/api/auth/logout` to clear JWT cookie
+- Never pass user data in URL params - security risk!
+
+**Attribute Parsing** (`app/api/saml/acs/route.ts` lines 27-34):
+```typescript
+const getAttr = (key: string): string | undefined => {
+  const value = attributes[key]
+  if (Array.isArray(value)) return value[0] as string
+  return value as string | undefined
+}
+```
+**Always handle arrays** - Stanford may send single values or arrays.
+
+**Security**:
+- Private key (`SAML_SP_PRIVATE_KEY`) signs requests and decrypts assertions
+- Public cert (`SAML_SP_CERT`) verified by Stanford IdP
+- JWT tokens stored in HTTP-only cookies (not accessible to JavaScript)
+- Clock skew: 5 minutes (`acceptedClockSkewMs: 300000`)
+
+### Component Patterns
+
+**Client Components** - Use `'use client'` directive when:
+- Using React hooks (`useState`, `useEffect`)
+- Browser APIs (localStorage, fetch)
+- Example: `components/Dashboard.tsx` (line 1)
+
+**Server Components** - Default for:
+- Page layouts (`app/layout.tsx`, `app/page.tsx`)
+- Static content rendering
+
+**Data Fetching**:
+- Client-side: `fetch('/api/acquia/visits')` from Dashboard
+- Pass query params: `new URLSearchParams({ subscriptionUuid, from, to })`
+- Handle loading states with `CountUpTimer` component
+
+## Common Tasks
+
+### Adding a New Chart Type
+1. Create component in `components/` (e.g., `NewChart.tsx`)
+2. Import Recharts primitives: `{ BarChart, Bar, XAxis, YAxis, Tooltip }`
+3. Accept `data` prop with `{ name: string, value: number, uuid: string }[]`
+4. Use Decanter colors: `className='fill-cardinal-red'`
+5. Add tab to `Dashboard.tsx` TABS array
+6. Add conditional render in tab content section
+
+### Debugging Acquia API Issues
+1. Check auth: Uncomment console.logs in `lib/acquia-api.ts` lines 95-141
+2. Verify date parsing: Check logs at lines 237-251 (date formatting)
+3. Inspect response structure: Logs at lines 320-330 (parsing entry point)
+4. Cache debugging: Search for "Returning cached" logs
+
+### Environment Setup
+
+**Local Development with HTTPS** (required for SAML):
+```bash
+nvm use                     # Ensures Node 22.x
+npm install                 # Install dependencies
+
+# Set up local HTTPS
+brew install mkcert
+mkcert -install
+mkdir -p .cert
+mkcert -key-file .cert/localhost-key.pem -cert-file .cert/localhost-cert.pem localhost 127.0.0.1 ::1
+
+# Configure environment
+cp .env.example .env.local  # Create env file
+# Edit .env.local:
+#   APP_URL=https://localhost:3000
+#   SAML_ENTITY_ID=https://churro-test.stanford.edu (if needed)
+#   JWT_SECRET=<generate with: openssl rand -base64 32>
+
+# Start development server
+npm run dev:https           # HTTPS server (required for SAML)
+# OR
+npm run dev                 # HTTP server (basic development, no SAML)
+```
+
+**SAML Entity ID Configuration**:
+- `APP_URL` - Where your app runs (e.g., `https://localhost:3000`)
+- `SAML_ENTITY_ID` - (Optional) What Stanford expects (e.g., `https://churro-test.stanford.edu`)
+- If `SAML_ENTITY_ID` is not set, it defaults to `APP_URL`
+- Use `SAML_ENTITY_ID` for local dev when SPDB registration differs from local URL
+
+### Adding New SAML Attributes
+1. Find OID from Stanford docs: https://uit.stanford.edu/service/authentication/saml
+2. Add to `user` object in `app/api/saml/acs/route.ts` (lines 36-71)
+3. Use `getAttr()` helper to handle arrays
+4. Example: `newAttr: getAttr('urn:oid:x.x.x.x.x')`
+5. User data is automatically included in JWT token payload
+
+### Protecting Routes with Authentication
+1. Add route pattern to middleware matcher if needed
+2. Check for protected path prefix in `middleware.ts` (default: `/protected/*`)
+3. Middleware automatically redirects unauthenticated users to `/api/saml/login`
+4. Access user info in API routes via request headers: `x-user-id`, `x-user-sunetid`, `x-user-email`
+
+### Checking Auth Status Client-Side
+```typescript
+// Check if user is authenticated
+const response = await fetch('/api/auth/status')
+const { authenticated, user } = await response.json()
+
+// Logout
+window.location.href = '/api/auth/logout'
+```
+
+## File Organization
+
+```
+app/
+  api/              # API routes (Next.js 15 route handlers)
+  [pages]           # Page components (e.g., page.tsx, layout.tsx)
+components/         # React components
+  [Component]/      # Directory-based components with .styles.ts, .types.ts
+lib/                # Core business logic (API clients, configs)
+docs/               # Technical documentation (SAML.md)
+public/fonts/       # Local fonts (stanford.woff2)
+tailwind/plugins/   # Tailwind customizations (font families)
+utilities/          # Helper utilities (datasource color mappings)
+```
+
+## Testing & Verification
+
+**Local Testing**:
+- Use Stanford UAT environment: `SAML_ENTRY_POINT=https://login-uat.stanford.edu/...`
+- Test SAML: Navigate to `/auth/test` page
+- Test API: Check DevTools Network tab for `/api/acquia/*` responses
+
+**Production Checklist**:
+- Switch to production IdP endpoint (remove `-uat`)
+- Update `APP_URL` to production domain
+- Verify SPDB registration: https://spdb.stanford.edu
+- Check Vercel env vars match `.env.local` structure
+
+## Common Pitfalls
+
+1. **Quoted env vars** - `ACQUIA_API_KEY="abc"` breaks auth (remove quotes)
+2. **Wrong SAML cert** - Must match environment (UAT ≠ production cert)
+3. **Date format mismatch** - Frontend sends `YYYY-MM-DD`, API needs ISO 8601
+4. **Array vs single value** - SAML attributes may be arrays, use `getAttr()` helper
+5. **Cache staleness** - 6-hour cache may hide API issues, check timestamps
+6. **Decanter overrides** - Don't use arbitrary Tailwind values, use Decanter tokens
+7. **User data in URLs** - Never pass sensitive user data in query params; use HTTP-only cookies
+8. **JWT secret missing** - Ensure `JWT_SECRET` is set (required for JWT signing)
+
+## Key Documentation
+
+- **SAML Setup**: `docs/SAML.md` (comprehensive Stanford SSO guide)
+- **Acquia API**: https://cloud.acquia.com/api (official docs, requires login)
+- **Decanter**: https://decanter.stanford.edu (Stanford Design System)
+- **Next.js 15**: https://nextjs.org/docs (App Router only)
+
+## Branch Strategy
+- Main branch: `main` (current development branch)
+- Repository: `SU-SWS/churro` (Stanford University Web Services)
+
+---
+*Last Updated: Based on codebase analysis, November 2025*
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 1cb87f4..e5e9aa4 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -25,6 +25,7 @@
 
 **Core Services** (`lib/`):
 - `lib/acquia-api.ts` - Acquia Cloud API client with 6-hour caching and pagination
+- `lib/email-service.ts` - Shared email functionality with accessibility and security features
 
 **Data Flow**:
 1. User accesses application → Basic auth via middleware
@@ -56,10 +57,11 @@
 
 **Basic HTTP Authentication** (`middleware.ts`):
 - Credentials: Configured via `BASIC_AUTH_USERNAME` and `BASIC_AUTH_PASSWORD` environment variables
-- **Required**: Must set both environment variables (no fallback values)
+- **Required**: Must set both environment variables (validated at startup)
 - Protects all routes except `/_next`, `/api/public`, `/favicon.ico`
 - Allows localhost access (IPv4/IPv6) without authentication
-- Returns 401 with WWW-Authenticate header for protected resources
+- Returns 503 Service Unavailable if auth not configured (security hardened)
+- No information disclosure about configuration status
 
 ### Stanford Design System (Decanter)
 
@@ -133,7 +135,7 @@
   - Expected usage at current point vs actual usage
   - Overage warnings when usage exceeds expected pace
 - **Email Service**: Uses Resend.com for reliable delivery
-- **Security**: Protected by `CRON_SECRET` to prevent unauthorized triggers
+- **Security**: Vercel cron jobs authenticated via User-Agent header; manual calls require CRON_SECRET
 
 **Email Content**:
 - Stanford-branded HTML email with Decanter color scheme
@@ -141,6 +143,8 @@
 - Progress tracking against monthly pace
 - Visual indicators for on-track vs over-usage status
 - Error handling for data collection failures
+- Full accessibility compliance (WCAG 2.1 AA)
+- HTML escaping for XSS protection
 
 **Setup Requirements**:
 1. `RESEND_API_KEY` - Sign up at resend.com
@@ -150,7 +154,8 @@
 5. Configure in Vercel environment variables
 
 **Testing**:
-- Manual trigger: `GET /api/test/email` (requires CRON_SECRET)
+- Manual trigger: `GET /api/test/email` (browser accessible, basic auth only)
+- Production cron: Uses Vercel User-Agent validation or manual CRON_SECRET
 - Check Vercel function logs for debugging
 - Verify email delivery in Resend dashboard
 
@@ -206,7 +211,7 @@ npm run dev                 # HTTP server (basic development)
    ADMIN_EMAIL=your-email@stanford.edu
    CRON_SECRET=your-secure-random-key
    ```
-3. **Test Email**: Visit `/api/test/email` to send test email
+3. **Test Email**: Visit `/api/test/email` in browser (basic auth only) or use curl
 4. **Deploy**: Cron job automatically runs daily at 9 AM UTC
 5. **Production**: Verify your own domain in Resend or work with Stanford IT for @stanford.edu addresses
 
@@ -231,6 +236,8 @@ app/
 components/         # React components
   [Component]/      # Directory-based components with .styles.ts, .types.ts
 lib/                # Core business logic (API clients)
+  acquia-api.ts     # Acquia Cloud API integration
+  email-service.ts  # Shared email functionality with accessibility and security
 docs/               # Technical documentation (EMAIL-CONFIGURATION.md)
 public/fonts/       # Local fonts (stanford.woff2)
 tailwind/plugins/   # Tailwind customizations (font families)
@@ -248,7 +255,8 @@ vercel.json         # Vercel configuration including cron jobs
 **Production Checklist**:
 - Verify all environment variables set in Vercel
 - Test basic authentication works
-- Verify email functionality with test endpoint
+- Verify email functionality with test endpoint (basic auth only)
+- Test cron endpoint with manual CRON_SECRET if needed
 - Check Vercel function logs for cron job execution
 - Confirm email delivery in Resend dashboard
 
@@ -260,7 +268,9 @@ vercel.json         # Vercel configuration including cron jobs
 4. **Cache staleness** - 6-hour cache may hide API issues, check timestamps
 5. **Decanter overrides** - Don't use arbitrary Tailwind values, use Decanter tokens
 6. **Missing email env vars** - `FROM_EMAIL` and `ADMIN_EMAIL` are required for email functionality
-7. **CRON_SECRET** - Must be set for email testing and cron job security
+7. **CRON_SECRET confusion** - Test endpoint doesn't need it; cron endpoint does for manual calls
+8. **Security oversights** - Always escape HTML output, validate environment variables at startup
+9. **Accessibility issues** - Use proper semantic HTML, ARIA labels, and table structure in emails
 
 ## Key Documentation
 
diff --git a/app/api/email/daily-summary/route.ts b/app/api/email/daily-summary/route.ts
index ba52d23..f7b23e1 100644
--- a/app/api/email/daily-summary/route.ts
+++ b/app/api/email/daily-summary/route.ts
@@ -6,21 +6,39 @@ export async function POST(request: NextRequest) {
     // Verify this is a legitimate Vercel cron job request
     const userAgent = request.headers.get('user-agent');
     const authHeader = request.headers.get('authorization');
+    const cronSecretHeader = request.headers.get('x-cron-secret');
 
     // Check for Vercel cron user agent OR manual auth with CRON_SECRET
     const isVercelCron = userAgent?.includes('vercel-cron/1.0');
-    const manualAuth = authHeader?.startsWith('Bearer ') &&
-                      authHeader.slice(7) === process.env.CRON_SECRET;
+
+    // Validate CRON_SECRET is configured before doing any auth checks
+    const cronSecret = process.env.CRON_SECRET;
+    if (!cronSecret) {
+      console.error('❌ CRON_SECRET environment variable not configured');
+      // Only allow Vercel cron if CRON_SECRET is not configured
+      if (!isVercelCron) {
+        return NextResponse.json({
+          error: 'Service misconfigured - manual authentication not available'
+        }, { status: 503 });
+      }
+    }
+
+    const bearerAuth = cronSecret && authHeader?.startsWith('Bearer ') &&
+                      authHeader.slice(7) === cronSecret;
+    const headerAuth = cronSecret && cronSecretHeader === cronSecret;
+    const manualAuth = bearerAuth || headerAuth;
 
     if (!isVercelCron && !manualAuth) {
       console.error('❌ Unauthorized cron call - not from Vercel cron and no valid CRON_SECRET');
       return NextResponse.json({
-        error: 'Unauthorized - must be Vercel cron job or provide valid CRON_SECRET'
+        error: 'Unauthorized - must be Vercel cron job or provide valid CRON_SECRET via Authorization or X-Cron-Secret header'
       }, { status: 401 });
     }
 
-    const requestSource = isVercelCron ? 'Vercel Cron' : 'Manual (authenticated)';
-    console.log(`✅ ${requestSource} authentication successful - executing daily summary...`);
+    const authMethod = isVercelCron ? 'Vercel Cron' :
+                      bearerAuth ? 'Manual (Bearer token)' :
+                      'Manual (X-Cron-Secret header)';
+    console.log(`✅ ${authMethod} authentication successful - executing daily summary...`);
 
     // Call the shared email service function
     const result = await sendDailySummaryEmail();
diff --git a/docs/EMAIL-CONFIGURATION.md b/docs/EMAIL-CONFIGURATION.md
index 3db0ffd..0ec4ac2 100644
--- a/docs/EMAIL-CONFIGURATION.md
+++ b/docs/EMAIL-CONFIGURATION.md
@@ -94,7 +94,9 @@ curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
 
 **Security Note**:
 - **Test endpoint** (`/api/test/email`): Protected by basic auth middleware only - easy for development
-- **Cron endpoint** (`/api/email/daily-summary`): Accepts Vercel cron jobs (via User-Agent) OR manual requests with `CRON_SECRET`## Data Collection Details
+- **Cron endpoint** (`/api/email/daily-summary`): Accepts Vercel cron jobs (via User-Agent) OR manual requests with `CRON_SECRET`
+
+## Data Collection Details
 
 **Date Range**: The email uses data from the 1st of the current month through yesterday (to avoid "future date" API errors from Acquia)
 
@@ -144,9 +146,10 @@ The current schedule in `vercel.json` runs daily at 9 AM UTC:
 ### Common Issues
 1. **Email not sending**: Check `RESEND_API_KEY` is valid
 2. **Unauthorized cron calls**: Verify `CRON_SECRET` matches between environment and request header
-3. **Test endpoint 401 error**: Ensure `CRON_SECRET` is provided in Authorization or X-Cron-Secret header
-4. **No data in email**: Check Acquia API credentials and permissions
-5. **Wrong timezone**: Cron runs in UTC, adjust schedule accordingly
+3. **Test endpoint access denied**: Ensure you can access the application (basic auth credentials required)
+4. **Cron endpoint 401 error**: Ensure `CRON_SECRET` is provided in Authorization or X-Cron-Secret header
+5. **No data in email**: Check Acquia API credentials and permissions
+6. **Wrong timezone**: Cron runs in UTC, adjust schedule accordingly
 
 ### Logs
 Check Vercel function logs for:
diff --git a/middleware.ts b/middleware.ts
index 14b16aa..95b355d 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -1,9 +1,18 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
+// Validate authentication configuration at startup - fail fast if misconfigured
 const USERNAME = process.env.BASIC_AUTH_USERNAME;
 const PASSWORD = process.env.BASIC_AUTH_PASSWORD;
 
+// Startup validation - log configuration issues immediately
+if (!USERNAME || !PASSWORD) {
+  console.error('❌ CRITICAL: BASIC_AUTH_USERNAME or BASIC_AUTH_PASSWORD environment variables not configured');
+  console.error('❌ Application will be inaccessible to external users until authentication is properly configured');
+}
+
+const isAuthConfigured = !!(USERNAME && PASSWORD);
+
 export function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
@@ -16,7 +25,7 @@ export function middleware(request: NextRequest) {
     return NextResponse.next();
   }
 
-  // Allow requests from localhost (IPv4 and IPv6)
+  // Allow requests from localhost (IPv4 and IPv6) for development
   const ip =
     request.headers.get('x-forwarded-for') ||
     request.headers.get('x-real-ip') ||
@@ -29,11 +38,14 @@ export function middleware(request: NextRequest) {
     return NextResponse.next();
   }
 
-  // Check if basic auth environment variables are configured
-  if (!USERNAME || !PASSWORD) {
-    console.error('❌ BASIC_AUTH_USERNAME or BASIC_AUTH_PASSWORD environment variables not configured');
-    return new NextResponse('Server configuration error - authentication not configured', {
-      status: 500,
+  // If authentication is not configured, return generic service unavailable
+  // without revealing configuration details
+  if (!isAuthConfigured) {
+    return new NextResponse('Service temporarily unavailable', {
+      status: 503,
+      headers: {
+        'Retry-After': '300', // Suggest retry after 5 minutes
+      },
     });
   }
 

From 76390ec879b1fe5f55d402b47ca9ea38b7e819e9 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 15:38:03 -0800
Subject: [PATCH 09/16] WIP: a11y fixes

---
 lib/email-service.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/email-service.ts b/lib/email-service.ts
index aef267f..c93862b 100644
--- a/lib/email-service.ts
+++ b/lib/email-service.ts
@@ -434,7 +434,7 @@ function generateEmailHTML(data: EmailData): string {
           <section class="progress-section" aria-labelledby="progress-heading">
             <h2 id="progress-heading" style="margin: 0 0 10px 0; color: #8c1515; font-size: 18px;">Month Progress</h2>
             <p style="margin: 0; font-size: 16px;">Day ${safeCurrentDay} of ${safeDaysInMonth} (${safeMonthProgress}% complete)</p>
-            <div class="progress-bar" role="progressbar" aria-valuenow="${Math.round(monthProgress)}" aria-valuemin="0" aria-valuemax="100" aria-label="Month progress: ${safeMonthProgress}% complete">
+            <div class="progress-bar" role="progressbar" aria-valuenow="${safeMonthProgress}" aria-valuemin="0" aria-valuemax="100" aria-label="Month progress: ${safeMonthProgress}% complete">>
               <div class="progress-fill" style="width: ${Math.min(monthProgress, 100)}%;"></div>
             </div>
             <p class="sr-only">Progress bar showing ${safeMonthProgress}% of the month has elapsed</p>
@@ -492,7 +492,7 @@ function generateEmailHTML(data: EmailData): string {
             <h3 id="expected-usage" style="margin: 0 0 5px 0; font-size: 14px; font-weight: bold; color: #2e2d29;">Expected Usage Comparison</h3>
             <p style="margin: 0; font-size: 14px; color: #2e2d29;">
               At ${safeMonthProgress}% through the month, expected usage should be:<br>
-              <span role="definition">Views: ${safeViewsExpected}</span> | <span role="definition">Visits: ${safeVisitsExpected}</span>
+              Views: ${safeViewsExpected} | Visits: ${safeVisitsExpected}
             </p>
           </section>
         </main>

From a28fb0f907ed8755f435f538bb6639d889839a7f Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 15:44:06 -0800
Subject: [PATCH 10/16] WIP: sanitization

---
 lib/email-service.ts | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/lib/email-service.ts b/lib/email-service.ts
index c93862b..6301d58 100644
--- a/lib/email-service.ts
+++ b/lib/email-service.ts
@@ -272,6 +272,13 @@ function generateEmailHTML(data: EmailData): string {
   const safeVisitsStatus = escapeHtml(visits.status);
   const safeVisitsExpected = escapeHtml(visits.expected.toLocaleString());
 
+  // Safe progress width for CSS style attribute
+  const safeProgressWidth = escapeHtml(Math.min(monthProgress, 100).toFixed(1));
+
+  // Validate status values for safe conditional logic
+  const isViewsOnTrack = views.status === 'On track';
+  const isVisitsOnTrack = visits.status === 'On track';
+
   return `
     <!DOCTYPE html>
     <html lang="en">
@@ -435,7 +442,7 @@ function generateEmailHTML(data: EmailData): string {
             <h2 id="progress-heading" style="margin: 0 0 10px 0; color: #8c1515; font-size: 18px;">Month Progress</h2>
             <p style="margin: 0; font-size: 16px;">Day ${safeCurrentDay} of ${safeDaysInMonth} (${safeMonthProgress}% complete)</p>
             <div class="progress-bar" role="progressbar" aria-valuenow="${safeMonthProgress}" aria-valuemin="0" aria-valuemax="100" aria-label="Month progress: ${safeMonthProgress}% complete">>
-              <div class="progress-fill" style="width: ${Math.min(monthProgress, 100)}%;"></div>
+              <div class="progress-fill" style="width: ${safeProgressWidth}%;"></div>
             </div>
             <p class="sr-only">Progress bar showing ${safeMonthProgress}% of the month has elapsed</p>
           </section>
@@ -456,8 +463,8 @@ function generateEmailHTML(data: EmailData): string {
                 <td class="metric-value">
                   <span class="metric-number">${safeViewsActual}</span>
                   <span class="metric-percentage">${safeViewsPercentage}% of ${safeViewsEntitlement} monthly limit</span>
-                  <span class="status-indicator ${views.status === 'On track' ? 'status-on-track' : 'status-over'}" role="status" aria-label="Status: ${safeViewsStatus}">
-                    <span aria-hidden="true">${views.status === 'On track' ? '✓' : '⚠'}</span> ${safeViewsStatus}
+                  <span class="status-indicator ${isViewsOnTrack ? 'status-on-track' : 'status-over'}" role="status" aria-label="Status: ${safeViewsStatus}">
+                    <span aria-hidden="true">${isViewsOnTrack ? '✓' : '⚠'}</span> ${safeViewsStatus}
                   </span>
                 </td>
               </tr>
@@ -480,8 +487,8 @@ function generateEmailHTML(data: EmailData): string {
                 <td class="metric-value">
                   <span class="metric-number">${safeVisitsActual}</span>
                   <span class="metric-percentage">${safeVisitsPercentage}% of ${safeVisitsEntitlement} monthly limit</span>
-                  <span class="status-indicator ${visits.status === 'On track' ? 'status-on-track' : 'status-over'}" role="status" aria-label="Status: ${safeVisitsStatus}">
-                    <span aria-hidden="true">${visits.status === 'On track' ? '✓' : '⚠'}</span> ${safeVisitsStatus}
+                  <span class="status-indicator ${isVisitsOnTrack ? 'status-on-track' : 'status-over'}" role="status" aria-label="Status: ${safeVisitsStatus}">
+                    <span aria-hidden="true">${isVisitsOnTrack ? '✓' : '⚠'}</span> ${safeVisitsStatus}
                   </span>
                 </td>
               </tr>

From 6c2d47f293daf803b8a1b249ee752310a1072a22 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 15:57:46 -0800
Subject: [PATCH 11/16] fixup! WIP

---
 docs/EMAIL-CONFIGURATION.md | 1 -
 lib/email-service.ts        | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/docs/EMAIL-CONFIGURATION.md b/docs/EMAIL-CONFIGURATION.md
index 0ec4ac2..490e336 100644
--- a/docs/EMAIL-CONFIGURATION.md
+++ b/docs/EMAIL-CONFIGURATION.md
@@ -126,7 +126,6 @@ The current schedule in `vercel.json` runs daily at 9 AM UTC:
 - The endpoint validates this header to ensure requests come from Vercel
 - Manual testing still requires `CRON_SECRET` for security
 - No additional configuration needed in `vercel.json`
-```
 
 ### Common Cron Schedules
 - `0 9 * * *` - 9 AM UTC daily
diff --git a/lib/email-service.ts b/lib/email-service.ts
index 6301d58..efd8194 100644
--- a/lib/email-service.ts
+++ b/lib/email-service.ts
@@ -441,7 +441,7 @@ function generateEmailHTML(data: EmailData): string {
           <section class="progress-section" aria-labelledby="progress-heading">
             <h2 id="progress-heading" style="margin: 0 0 10px 0; color: #8c1515; font-size: 18px;">Month Progress</h2>
             <p style="margin: 0; font-size: 16px;">Day ${safeCurrentDay} of ${safeDaysInMonth} (${safeMonthProgress}% complete)</p>
-            <div class="progress-bar" role="progressbar" aria-valuenow="${safeMonthProgress}" aria-valuemin="0" aria-valuemax="100" aria-label="Month progress: ${safeMonthProgress}% complete">>
+            <div class="progress-bar" role="progressbar" aria-valuenow="${safeMonthProgress}" aria-valuemin="0" aria-valuemax="100" aria-label="Month progress: ${safeMonthProgress}% complete">
               <div class="progress-fill" style="width: ${safeProgressWidth}%;"></div>
             </div>
             <p class="sr-only">Progress bar showing ${safeMonthProgress}% of the month has elapsed</p>

From b5952dd6a20d616ba199a918e31ece40377f81c0 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 15:58:01 -0800
Subject: [PATCH 12/16] Exclude daily summary API endpoint from basic auth

---
 middleware.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/middleware.ts b/middleware.ts
index 95b355d..90f741c 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -20,7 +20,8 @@ export function middleware(request: NextRequest) {
   if (
     pathname.startsWith('/_next') ||
     pathname.startsWith('/api/public') ||
-    pathname.startsWith('/favicon.ico')
+    pathname.startsWith('/favicon.ico') ||
+    pathname === '/api/email/daily-summary' // Allow Vercel cron job
   ) {
     return NextResponse.next();
   }
@@ -77,5 +78,5 @@ export function middleware(request: NextRequest) {
 }
 
 export const config = {
-  matcher: ['/((?!_next|api/public|favicon.ico).*)'],
+  matcher: ['/((?!_next|api/public|api/email/daily-summary|favicon.ico).*)'],
 };
\ No newline at end of file

From 53b7e96f6b9ae5123d6e93287bd8c02650f5878e Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 16:20:35 -0800
Subject: [PATCH 13/16] ACHOO-150: data fidelity and date ranges

---
 .github/copilot-instructions.md |  9 ++++++--
 docs/EMAIL-CONFIGURATION.md     | 11 +++++++++-
 lib/email-service.ts            | 39 ++++++++++++++++++++++++++++-----
 3 files changed, 51 insertions(+), 8 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index e5e9aa4..839e5a5 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -129,9 +129,14 @@
 
 **Daily Summary Emails** (`app/api/email/daily-summary/`):
 - **Trigger**: Vercel cron job runs daily at 9 AM UTC (configured in `vercel.json`)
-- **Data**: Aggregates views/visits across all applications for current month
+- **Data**: Aggregates views/visits across all applications for current month with data lag handling
+- **Data Lag Protection**: Uses 2-day offset when possible, but never crosses month boundaries:
+  - Day 1: Current day only (no previous data)
+  - Day 2: First day only (avoids previous month)
+  - Day 3: First day only (2-day offset would be previous month)
+  - Day 4+: 2-day offset within current month
 - **Calculations**:
-  - Month progress percentage (e.g., day 7 of 31 = 22.6%)
+  - Month progress percentage (e.g., day 7 of 30 = 23.3%)
   - Expected usage at current point vs actual usage
   - Overage warnings when usage exceeds expected pace
 - **Email Service**: Uses Resend.com for reliable delivery
diff --git a/docs/EMAIL-CONFIGURATION.md b/docs/EMAIL-CONFIGURATION.md
index 490e336..93b22ce 100644
--- a/docs/EMAIL-CONFIGURATION.md
+++ b/docs/EMAIL-CONFIGURATION.md
@@ -98,7 +98,16 @@ curl -X POST "https://your-domain.vercel.app/api/email/daily-summary" \
 
 ## Data Collection Details
 
-**Date Range**: The email uses data from the 1st of the current month through yesterday (to avoid "future date" API errors from Acquia)
+**Data Lag Handling**: The email accounts for Acquia's data processing delays by using a 2-day offset when possible, but always ensures data stays within the current month:
+
+- **Day 1**: Uses current day only (no previous data available)
+- **Day 2**: Uses first day only (2-day offset would cross to previous month)
+- **Day 3**: Uses first day only (2-day offset would be previous month)
+- **Day 4+**: Uses 2-day offset (e.g., Day 4 reports through Day 2)
+
+**Month Boundary Protection**: Never includes data from the previous month to ensure accurate monthly usage tracking
+
+**Date Range**: Reports data from the 1st of the current month through the calculated end date based on data availability
 
 **Data Aggregation**: Combines views and visits across all applications in your Acquia subscription
 
diff --git a/lib/email-service.ts b/lib/email-service.ts
index efd8194..f3c5d40 100644
--- a/lib/email-service.ts
+++ b/lib/email-service.ts
@@ -204,14 +204,43 @@ async function fetchCurrentMonthUsage(subscriptionUuid: string) {
   try {
     console.log('📊 Fetching current month usage data...');
 
-    // Get current month date range (from 1st to yesterday to avoid "future date" API errors)
+    // Get current month date range accounting for data processing delays
     const now = new Date();
     const firstDayOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
-    const yesterday = new Date(now);
-    yesterday.setDate(yesterday.getDate() - 1);
 
-    const fromDate = firstDayOfMonth.toISOString().split('T')[0]; // YYYY-MM-DD format
-    const toDate = yesterday.toISOString().split('T')[0]; // YYYY-MM-DD format
+    // Handle first day of month edge case and cross-month boundaries
+    let toDate: string;
+    let fromDate: string;
+
+    if (now.getDate() === 1) {
+      // On the first day, we don't have any previous days in this month to query
+      // Use the first day as both start and end date to get zero values
+      toDate = firstDayOfMonth.toISOString().split('T')[0];
+      fromDate = firstDayOfMonth.toISOString().split('T')[0];
+      console.log(`📊 First day of month detected - using current day for date range`);
+    } else if (now.getDate() === 2) {
+      // On the second day, 2-day offset would go to previous month
+      // Use first day of current month through first day only
+      fromDate = firstDayOfMonth.toISOString().split('T')[0];
+      toDate = firstDayOfMonth.toISOString().split('T')[0];
+      console.log(`📊 Second day of month detected - using first day only to avoid previous month`);
+    } else {
+      // Use 2-day offset for data availability, but ensure we don't cross month boundary
+      const twoDaysAgo = new Date(now);
+      twoDaysAgo.setDate(twoDaysAgo.getDate() - 2);
+
+      if (twoDaysAgo.getMonth() !== now.getMonth()) {
+        // 2-day offset crosses into previous month, use first day of current month instead
+        fromDate = firstDayOfMonth.toISOString().split('T')[0];
+        toDate = firstDayOfMonth.toISOString().split('T')[0];
+        console.log(`📊 2-day offset crosses month boundary - using first day only`);
+      } else {
+        // Safe to use 2-day offset within current month
+        fromDate = firstDayOfMonth.toISOString().split('T')[0];
+        toDate = twoDaysAgo.toISOString().split('T')[0];
+        console.log(`📊 Using 2-day offset for data availability - querying through ${toDate}`);
+      }
+    }
 
     console.log(`📊 Fetching data from ${fromDate} to ${toDate}`);
 

From 03dc4f31da4a89f3b6d69ffdc8b6e2c3594c940f Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Wed, 26 Nov 2025 16:21:10 -0800
Subject: [PATCH 14/16] fixup! WIP

---
 .github/copilot-instructions-caching.md | 295 ------------------------
 .github/copilot-instructions-saml.md    | 282 ----------------------
 2 files changed, 577 deletions(-)
 delete mode 100644 .github/copilot-instructions-caching.md
 delete mode 100644 .github/copilot-instructions-saml.md

diff --git a/.github/copilot-instructions-caching.md b/.github/copilot-instructions-caching.md
deleted file mode 100644
index 675c872..0000000
--- a/.github/copilot-instructions-caching.md
+++ /dev/null
@@ -1,295 +0,0 @@
-# CHURRO - AI Development Guidelines
-
-## Project Overview
-**CHURRO** (Cloud Hosting Usage Reporting with Recurring Output) is a Next.js 15 dashboard for visualizing Acquia Cloud hosting analytics (views/visits data). Built for Stanford University with Stanford Design System (Decanter) styling and basic HTTP authentication.
-
-## Architecture
-
-### Tech Stack
-- **Framework**: Next.js 15.5+ (App Router only, no Pages Router)
-- **Runtime**: Node.js 22.x (enforced via package.json engines)
-- **Styling**: TailwindCSS with Decanter preset (Stanford Design System)
-- **Authentication**: Basic HTTP Authentication via middleware
-- **Data Viz**: Recharts for charts/graphs
-- **Deployment**: Vercel
-
-### Key Components
-
-**API Routes** (`app/api/`):
-- `/api/acquia/applications` - Fetches all Acquia applications
-- `/api/acquia/visits` - Fetches visits metrics with pagination
-- `/api/acquia/views` - Fetches views metrics with pagination
-- `/api/cache` - Cache management endpoint (GET/DELETE)
-
-**Core Services** (`lib/`):
-- `lib/acquia-api.ts` - Acquia Cloud API client with hybrid caching and pagination
-- `lib/cache-hybrid.ts` - Hybrid caching system (file-based local, unstable_cache production)
-- `lib/cache.ts` - File-based caching for local development
-
-**Main Pages**:
-- `/` - Dashboard with date filtering and tabbed views (Dashboard component)
-- `/applications` - Applications overview table (auto-loading, filtered)
-- `/applications/[uuid]` - Individual application detail with daily charts
-
-**Data Flow**:
-1. User accesses application → Basic auth via middleware
-2. Dashboard/pages fetch from `/api/acquia/*` routes
-3. API routes use `AcquiaApiServiceFixed` with OAuth2 client_credentials flow
-4. Response data parsed from Acquia's nested `_embedded.items[].datapoints[]` structure
-5. Data cached using hybrid cache system for 5 minutes
-
-## Development Patterns
-
-### Environment Variables
-**Required** (stored in `.env.local`, never committed):
-- `ACQUIA_API_KEY` / `ACQUIA_API_SECRET` - OAuth2 credentials (no quotes)
-- `NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID` - Subscription identifier
-- `NEXT_PUBLIC_ACQUIA_MONTHLY_{VIEWS|VISITS}_ENTITLEMENT` - Usage limits
-- `ACQUIA_API_BASE_URL` - API base URL (defaults to https://cloud.acquia.com/api)
-- `ACQUIA_AUTH_BASE_URL` - Auth base URL (defaults to https://accounts.acquia.com/api)
-
-**Critical**: Values must NOT have surrounding quotes. API key/secret are auto-stripped of quotes in `acquia-api.ts`.
-
-### Authentication
-
-**Basic HTTP Authentication** (`middleware.ts`):
-- Username: `sws`
-- Password: `sws`
-- Protects all routes except `/_next`, `/api/public`, `/favicon.ico`
-- Allows localhost access (IPv4/IPv6) without authentication
-- Returns 401 with WWW-Authenticate header for protected resources
-
-### Stanford Design System (Decanter)
-
-**Colors** - Use semantic Decanter tokens, NOT hex values:
-- Primary: `cardinal-red` (Stanford brand red)
-- Accents: `digital-blue`, `digital-green`
-- Grays: `black-{10,20,60,80}`, `gc-black`
-- **Never use**: Custom hex colors unless explicitly non-Stanford branding
-
-**Typography**:
-- Headings: `type-{0,1,2,3,4}` classes (defined in Decanter)
-- Body: `Source_Sans_3` (imported in `app/layout.tsx`)
-- Serif: `Source_Serif_4` for emphasis
-- Display: Custom `stanford` font (local woff2)
-
-**Interaction States**:
-- Use `hocus:` prefix for hover+focus states (Decanter utility)
-- Example: `hocus:bg-black hocus:text-white`
-
-**Spacing**:
-- Use Decanter scale: `p-{5,8,10,15,20,25,30,50}` (not arbitrary values)
-- Responsive: `px-20 sm:px-30 md:px-50 lg:px-30`
-
-### Acquia API Integration
-
-**Authentication** (`lib/acquia-api.ts`):
-- OAuth2 client credentials flow with 3 fallback methods
-- Token cached in `this.accessToken`, auto-retries on 401
-- Credentials auto-cleaned of quotes
-
-**Data Parsing**:
-- Response structure: `_embedded.items[]` where each item = one application
-- Each item has `metadata.application.uuids[0]` + `datapoints[]` array
-- Datapoints format: `["2025-04-15T00:00:00+00:00", "1124"]` (date, value)
-- **Critical**: ONE item = ONE application, ALL datapoints belong to that app
-
-**Caching**:
-- Hybrid cache system: file-based (local) vs unstable_cache (production)
-- 5-minute cache duration with deployment-based invalidation
-- Cache keys based on deployment ID for automatic invalidation
-- Browser cache prevention via `cache: 'reload'` and unique timestamps
-
-**Date Filtering**:
-- API expects ISO 8601: `2025-04-15T23:59:59.000Z`
-- Frontend sends: `YYYY-MM-DD` (conditional - only if user sets dates)
-- No default date filtering (fetches all available data)
-
-### Hybrid Caching System
-
-**Local Development** (`lib/cache.ts`):
-- File-based caching in `.cache/` directory
-- 5-minute TTL with file timestamps
-- Persists across server restarts
-- Manual clearing via file deletion
-
-**Production** (`lib/cache-hybrid.ts`):
-- Next.js `unstable_cache` with deployment versioning
-- Cache keys include `VERCEL_DEPLOYMENT_ID` for auto-invalidation
-- Application-layer timestamp validation (5 minutes)
-- Browser cache prevention via headers and unique URLs
-
-**Key Features**:
-- Environment detection at runtime
-- Deployment-based cache invalidation
-- Cross-instance cache sharing on Vercel
-- Manual cache clearing via `/api/cache` DELETE endpoint
-
-### Component Patterns
-
-**Client Components** - Use `'use client'` directive when:
-- Using React hooks (`useState`, `useEffect`)
-- Browser APIs (localStorage, fetch)
-- Timer components (`CountUpTimer`)
-
-**Server Components** - Default for:
-- Page layouts (`app/layout.tsx`)
-- Static content rendering
-
-**Data Fetching**:
-- Client-side: `fetch('/api/acquia/visits')` with cache-busting timestamps
-- Pass query params: `new URLSearchParams({ subscriptionUuid, from, to })`
-- Handle loading states with `CountUpTimer` component
-
-## Page Architecture
-
-### Dashboard (`/`)
-- **Purpose**: Main analytics dashboard with date filtering
-- **Features**:
-  - User-configurable date range inputs
-  - Subscription UUID input field
-  - Tabbed interface (pie charts, bar charts, data tables)
-  - Manual "Fetch Analytics Data" button
-  - Cache clearing functionality
-- **Data**: Fetches all apps, views, and visits with optional date filtering
-
-### Applications Page (`/applications`)
-- **Purpose**: Overview table of all applications with statistics
-- **Features**:
-  - Auto-loads on page mount (no manual refresh needed)
-  - Shows current Pacific time timestamp
-  - Displays views/visits totals and percentages
-  - Links to individual application pages
-  - Excludes specific UUIDs: `2b2d2517-3839-414e-85a4-7183adc22283`, `1ef402a7-c301-42d7-9b63-f226fa1b2329`
-- **Data**: Fetches all available data (no date filtering)
-- **Styling**: Stanford Design System table with alternating rows
-
-### Application Detail (`/applications/[uuid]`)
-- **Purpose**: Individual application analytics with daily resolution
-- **Features**:
-  - Date range picker for custom filtering
-  - Daily resolution charts (line charts)
-  - Application name resolution from UUID
-  - Cache clearing functionality
-- **Data**: Fetches daily data with `resolution=day` parameter
-
-## Common Tasks
-
-### Adding a New Chart Type
-1. Create component in `components/` (e.g., `NewChart.tsx`)
-2. Import Recharts primitives: `{ BarChart, Bar, XAxis, YAxis, Tooltip }`
-3. Accept `data` prop with `{ name: string, value: number, uuid: string }[]`
-4. Use Decanter colors: `className='fill-cardinal-red'`
-5. Add tab to Dashboard TABS array
-6. Add conditional render in tab content section
-
-### Debugging Acquia API Issues
-1. Check API route error responses for detailed error info including envCheck
-2. Verify auth credentials are set correctly (no quotes)
-3. Monitor cache behavior via console logs
-4. Use "Clear Cache" functionality to force fresh data
-
-### Environment Setup
-
-**Local Development**:
-```bash
-nvm use                     # Ensures Node 22.x
-npm install                 # Install dependencies
-
-# Configure environment
-cp .env.example .env.local  # Create env file if needed
-# Edit .env.local with required Acquia credentials
-
-npm run dev                 # Start development server
-```
-
-### Adding New Application Exclusions
-1. Edit the `EXCLUDED_UUIDS` array in `/app/applications/page.tsx`
-2. Add UUID string to the array
-3. Applications will be filtered from both table display and statistics
-
-### Cache Management
-1. **Local**: Cache stored in `.cache/` directory (gitignored)
-2. **Production**: Cache cleared automatically on deployment
-3. **Manual**: Use "Clear Cache" buttons in UI or `DELETE /api/cache`
-4. **TTL**: 5 minutes across all environments
-
-## File Organization
-
-```
-app/
-  api/              # API routes (Next.js 15 route handlers)
-    acquia/         # Acquia Cloud API proxy routes
-    cache/          # Cache management endpoint
-  applications/     # Applications pages
-    [uuid]/         # Individual application detail
-    page.tsx        # Applications overview table
-  page.tsx          # Home page (Dashboard component)
-  layout.tsx        # Root layout with Stanford fonts
-components/         # React components
-  Dashboard.tsx     # Main dashboard with tabs and charts
-  CountUpTimer.tsx  # Loading timer component
-  [Charts]/         # Recharts-based chart components
-  [UI]/             # Stanford Design System components
-lib/                # Core business logic
-  acquia-api.ts     # Acquia API client with OAuth2 and caching
-  cache-hybrid.ts   # Hybrid caching system
-  cache.ts          # File-based cache (local development)
-docs/               # Documentation
-  caching.md        # Comprehensive caching system docs
-middleware.ts       # Basic HTTP authentication
-utilities/          # Helper utilities
-```
-
-## Testing & Verification
-
-**Local Testing**:
-- Use basic auth credentials: sws/sws
-- Test API endpoints directly via browser DevTools
-- Check cache behavior via console logs
-- Check API error responses for envCheck debugging info
-
-**Production Checklist**:
-- Verify all environment variables set in Vercel
-- Test basic authentication works
-- Confirm caching behavior (5-minute TTL)
-- Check that excluded applications don't appear in `/applications`
-
-## Common Pitfalls
-
-1. **Quoted env vars** - `ACQUIA_API_KEY="abc"` breaks auth (remove quotes)
-2. **Wrong auth method** - This branch uses basic HTTP auth, not SAML
-3. **Date format mismatch** - Frontend sends `YYYY-MM-DD`, API needs ISO 8601
-4. **Cache staleness** - 5-minute cache may hide API issues, use cache clearing
-5. **Decanter overrides** - Don't use arbitrary Tailwind values, use Decanter tokens
-6. **Application filtering** - Remember to add UUIDs to exclusion list when needed
-
-## Dependencies
-
-**Core Dependencies**:
-- `next` ^15.5.2 - Next.js framework
-- `react` 18.3.1 - React library
-- `axios` ^1.12.0 - HTTP client for API calls
-- `recharts` ^2.12.7 - Chart components
-- `decanter` ^7.4.0 - Stanford Design System
-- `basic-auth` ^2.0.1 - Basic authentication utilities
-
-**Development Dependencies**:
-- `typescript` ^5.5.2 - TypeScript support
-- `tailwindcss` ^3.4.17 - Utility-first CSS
-- `eslint` ^8.57.0 - Code linting
-
-## Key Documentation
-
-- **Caching System**: `docs/caching.md` (comprehensive caching guide)
-- **Acquia API**: https://cloud.acquia.com/api (official docs, requires login)
-- **Acquia API Rate Limits**: https://docs.acquia.com/acquia-cloud-platform/developing-cloud-platform-api (rate limiting information)
-- **Decanter**: https://decanter.stanford.edu (Stanford Design System)
-- **Next.js 15**: https://nextjs.org/docs (App Router only)
-
-## Branch Strategy
-- Current branch: `ACHOO-119-20251015`
-- Repository: `SU-SWS/churro` (Stanford University Web Services)
-
----
-*Last Updated: November 2025 - Reflects current implementation with basic HTTP auth and hybrid caching*
diff --git a/.github/copilot-instructions-saml.md b/.github/copilot-instructions-saml.md
deleted file mode 100644
index 91b87e5..0000000
--- a/.github/copilot-instructions-saml.md
+++ /dev/null
@@ -1,282 +0,0 @@
-# CHURRO - AI Development Guidelines
-
-## Project Overview
-**CHURRO** (Cloud Hosting Usage Reporting with Recurring Output) is a Next.js 15 dashboard for visualizing Acquia Cloud hosting analytics (views/visits data). Built for Stanford University with Stanford Design System (Decanter) styling and Stanford SAML SSO integration.
-
-## Architecture
-
-### Tech Stack
-- **Framework**: Next.js 15.5+ (App Router only, no Pages Router)
-- **Runtime**: Node.js 22.x (enforced via package.json engines)
-- **Styling**: TailwindCSS with Decanter preset (Stanford Design System)
-- **Authentication**: Stanford SAML SSO via `@node-saml/node-saml`
-- **Data Viz**: Recharts for charts/graphs
-- **Deployment**: Vercel
-
-### Key Components
-
-**API Routes** (`app/api/`):
-- `/api/acquia/applications` - Fetches all Acquia applications
-- `/api/acquia/visits` - Fetches visits metrics with pagination
-- `/api/acquia/views` - Fetches views metrics with pagination
-- `/api/saml/login` - Initiates SAML authentication flow
-- `/api/saml/acs` - Assertion Consumer Service for SAML callbacks
-- `/api/saml/metadata` - Generates SP metadata XML
-
-**Core Services** (`lib/`):
-- `lib/acquia-api.ts` - Acquia Cloud API client with 6-hour caching and pagination
-- `lib/saml-config.ts` - SAML configuration with signed requests
-
-**Data Flow**:
-1. User selects date range → Dashboard component
-2. Dashboard fetches from `/api/acquia/*` routes
-3. API routes use `AcquiaApiServiceFixed` with OAuth2 client_credentials flow
-4. Response data parsed from Acquia's nested `_embedded.items[].datapoints[]` structure
-5. Data cached in-memory for 6 hours with cache keys based on query params
-
-## Development Patterns
-
-### Environment Variables
-**Required** (stored in `.env.local`, never committed):
-- `ACQUIA_API_KEY` / `ACQUIA_API_SECRET` - OAuth2 credentials (no quotes)
-- `NEXT_PUBLIC_ACQUIA_SUBSCRIPTION_UUID` - Subscription identifier
-- `NEXT_PUBLIC_ACQUIA_MONTHLY_{VIEWS|VISITS}_ENTITLEMENT` - Usage limits
-- `SAML_CERT`, `SAML_SP_CERT`, `SAML_SP_PRIVATE_KEY` - SAML certificates
-- `APP_URL` - Base URL (production URL, or inferred from request in dev)
-- `JWT_SECRET` - JWT signing secret (generate with `openssl rand -base64 32`)
-
-**Critical**: Values must NOT have surrounding quotes. API key/secret are auto-stripped of quotes in `acquia-api.ts` (lines 91-92).
-
-### Stanford Design System (Decanter)
-
-**Colors** - Use semantic Decanter tokens, NOT hex values:
-- Primary: `cardinal-red` (Stanford brand red)
-- Accents: `digital-blue`, `digital-green`
-- Grays: `black-{10,20,60,80}`, `gc-black`
-- **Never use**: Custom hex colors unless explicitly non-Stanford branding
-
-**Typography**:
-- Headings: `type-{0,1,2,3,4}` classes (defined in Decanter)
-- Body: `Source_Sans_3` (imported in `app/layout.tsx`)
-- Serif: `Source_Serif_4` for emphasis
-- Display: Custom `stanford` font (local woff2)
-
-**Interaction States**:
-- Use `hocus:` prefix for hover+focus states (Decanter utility)
-- Example: `hocus:bg-black hocus:text-white`
-
-**Spacing**:
-- Use Decanter scale: `p-{5,8,10,15,20,25,30,50}` (not arbitrary values)
-- Responsive: `px-20 sm:px-30 md:px-50 lg:px-30`
-
-### Acquia API Integration
-
-**Authentication** (`lib/acquia-api.ts` lines 81-177):
-- OAuth2 client credentials flow with 3 fallback methods
-- Token cached in `this.accessToken`, auto-retries on 401
-- **Debug tip**: Check lines 127-142 for auth method attempts
-
-**Data Parsing** (`lib/acquia-api.ts` lines 312-466):
-- Response structure: `_embedded.items[]` where each item = one application
-- Each item has `metadata.application.uuids[0]` + `datapoints[]` array
-- Datapoints format: `["2025-04-15T00:00:00+00:00", "1124"]` (date, value)
-- **Critical**: ONE item = ONE application, ALL datapoints belong to that app
-
-**Caching**:
-- 6-hour in-memory cache (lines 10-24)
-- Cache keys: `generateCacheKey([endpoint, uuid, from, to, resolution])`
-- Cache hit returns immediately without API call
-
-**Date Filtering** (lines 218-262):
-- API expects ISO 8601: `2025-04-15T23:59:59.000Z`
-- Frontend sends: `YYYY-MM-DD`
-- Conversion adds `T00:00:00.000Z` (start) or `T23:59:59.000Z` (end)
-- Filter format: `filter=from=2025-04-01T00:00:00.000Z,to=2025-04-30T23:59:59.000Z`
-
-### SAML Authentication
-
-**Flow** (detailed in `docs/SAML.md`):
-1. User clicks "Sign In with Stanford SAML" → `/api/saml/login`
-2. `saml.getAuthorizeUrlAsync()` generates signed AuthnRequest
-3. Redirect to Stanford IdP (`login-uat.stanford.edu` or `login.stanford.edu`)
-4. Stanford returns signed+encrypted assertion to `/api/saml/acs`
-5. `saml.validatePostResponseAsync()` verifies signature and decrypts
-6. Extract attributes via OID mappings (e.g., `urn:oid:0.9.2342.19200300.100.1.1` = SUNet ID)
-7. Generate JWT token from user profile using `jose` library (`lib/jwt-auth.ts`)
-8. Set JWT in HTTP-only cookie (`churro-auth-token`) with 24-hour expiration
-9. Redirect to application (no user data in URL params - security best practice)
-
-**JWT Cookie Authentication** (`lib/jwt-auth.ts`):
-- Uses `jose` library for JWT signing/verification with HS256 algorithm
-- Secret from `JWT_SECRET` environment variable (required, no default)
-- Cookie options: `httpOnly: true`, `secure: true` (production), `sameSite: 'lax'`
-- Token expires in 24 hours
-- Helper functions: `generateJWT()`, `verifyJWT()`, `getJWTCookieName()`
-
-**Middleware Protection** (`middleware.ts`):
-- Checks JWT cookie on protected routes (e.g., `/protected/*`)
-- Verifies token validity and redirects to `/api/saml/login` if invalid
-- Adds user info to request headers (`x-user-id`, `x-user-sunetid`, `x-user-email`)
-- Non-protected routes pass through without checks
-
-**Client-Side Auth Checking**:
-- Use `/api/auth/status` to check authentication (reads HTTP-only cookie server-side)
-- Returns `{ authenticated: boolean, user: {...} }`
-- Use `/api/auth/logout` to clear JWT cookie
-- Never pass user data in URL params - security risk!
-
-**Attribute Parsing** (`app/api/saml/acs/route.ts` lines 27-34):
-```typescript
-const getAttr = (key: string): string | undefined => {
-  const value = attributes[key]
-  if (Array.isArray(value)) return value[0] as string
-  return value as string | undefined
-}
-```
-**Always handle arrays** - Stanford may send single values or arrays.
-
-**Security**:
-- Private key (`SAML_SP_PRIVATE_KEY`) signs requests and decrypts assertions
-- Public cert (`SAML_SP_CERT`) verified by Stanford IdP
-- JWT tokens stored in HTTP-only cookies (not accessible to JavaScript)
-- Clock skew: 5 minutes (`acceptedClockSkewMs: 300000`)
-
-### Component Patterns
-
-**Client Components** - Use `'use client'` directive when:
-- Using React hooks (`useState`, `useEffect`)
-- Browser APIs (localStorage, fetch)
-- Example: `components/Dashboard.tsx` (line 1)
-
-**Server Components** - Default for:
-- Page layouts (`app/layout.tsx`, `app/page.tsx`)
-- Static content rendering
-
-**Data Fetching**:
-- Client-side: `fetch('/api/acquia/visits')` from Dashboard
-- Pass query params: `new URLSearchParams({ subscriptionUuid, from, to })`
-- Handle loading states with `CountUpTimer` component
-
-## Common Tasks
-
-### Adding a New Chart Type
-1. Create component in `components/` (e.g., `NewChart.tsx`)
-2. Import Recharts primitives: `{ BarChart, Bar, XAxis, YAxis, Tooltip }`
-3. Accept `data` prop with `{ name: string, value: number, uuid: string }[]`
-4. Use Decanter colors: `className='fill-cardinal-red'`
-5. Add tab to `Dashboard.tsx` TABS array
-6. Add conditional render in tab content section
-
-### Debugging Acquia API Issues
-1. Check auth: Uncomment console.logs in `lib/acquia-api.ts` lines 95-141
-2. Verify date parsing: Check logs at lines 237-251 (date formatting)
-3. Inspect response structure: Logs at lines 320-330 (parsing entry point)
-4. Cache debugging: Search for "Returning cached" logs
-
-### Environment Setup
-
-**Local Development with HTTPS** (required for SAML):
-```bash
-nvm use                     # Ensures Node 22.x
-npm install                 # Install dependencies
-
-# Set up local HTTPS
-brew install mkcert
-mkcert -install
-mkdir -p .cert
-mkcert -key-file .cert/localhost-key.pem -cert-file .cert/localhost-cert.pem localhost 127.0.0.1 ::1
-
-# Configure environment
-cp .env.example .env.local  # Create env file
-# Edit .env.local:
-#   APP_URL=https://localhost:3000
-#   SAML_ENTITY_ID=https://churro-test.stanford.edu (if needed)
-#   JWT_SECRET=<generate with: openssl rand -base64 32>
-
-# Start development server
-npm run dev:https           # HTTPS server (required for SAML)
-# OR
-npm run dev                 # HTTP server (basic development, no SAML)
-```
-
-**SAML Entity ID Configuration**:
-- `APP_URL` - Where your app runs (e.g., `https://localhost:3000`)
-- `SAML_ENTITY_ID` - (Optional) What Stanford expects (e.g., `https://churro-test.stanford.edu`)
-- If `SAML_ENTITY_ID` is not set, it defaults to `APP_URL`
-- Use `SAML_ENTITY_ID` for local dev when SPDB registration differs from local URL
-
-### Adding New SAML Attributes
-1. Find OID from Stanford docs: https://uit.stanford.edu/service/authentication/saml
-2. Add to `user` object in `app/api/saml/acs/route.ts` (lines 36-71)
-3. Use `getAttr()` helper to handle arrays
-4. Example: `newAttr: getAttr('urn:oid:x.x.x.x.x')`
-5. User data is automatically included in JWT token payload
-
-### Protecting Routes with Authentication
-1. Add route pattern to middleware matcher if needed
-2. Check for protected path prefix in `middleware.ts` (default: `/protected/*`)
-3. Middleware automatically redirects unauthenticated users to `/api/saml/login`
-4. Access user info in API routes via request headers: `x-user-id`, `x-user-sunetid`, `x-user-email`
-
-### Checking Auth Status Client-Side
-```typescript
-// Check if user is authenticated
-const response = await fetch('/api/auth/status')
-const { authenticated, user } = await response.json()
-
-// Logout
-window.location.href = '/api/auth/logout'
-```
-
-## File Organization
-
-```
-app/
-  api/              # API routes (Next.js 15 route handlers)
-  [pages]           # Page components (e.g., page.tsx, layout.tsx)
-components/         # React components
-  [Component]/      # Directory-based components with .styles.ts, .types.ts
-lib/                # Core business logic (API clients, configs)
-docs/               # Technical documentation (SAML.md)
-public/fonts/       # Local fonts (stanford.woff2)
-tailwind/plugins/   # Tailwind customizations (font families)
-utilities/          # Helper utilities (datasource color mappings)
-```
-
-## Testing & Verification
-
-**Local Testing**:
-- Use Stanford UAT environment: `SAML_ENTRY_POINT=https://login-uat.stanford.edu/...`
-- Test SAML: Navigate to `/auth/test` page
-- Test API: Check DevTools Network tab for `/api/acquia/*` responses
-
-**Production Checklist**:
-- Switch to production IdP endpoint (remove `-uat`)
-- Update `APP_URL` to production domain
-- Verify SPDB registration: https://spdb.stanford.edu
-- Check Vercel env vars match `.env.local` structure
-
-## Common Pitfalls
-
-1. **Quoted env vars** - `ACQUIA_API_KEY="abc"` breaks auth (remove quotes)
-2. **Wrong SAML cert** - Must match environment (UAT ≠ production cert)
-3. **Date format mismatch** - Frontend sends `YYYY-MM-DD`, API needs ISO 8601
-4. **Array vs single value** - SAML attributes may be arrays, use `getAttr()` helper
-5. **Cache staleness** - 6-hour cache may hide API issues, check timestamps
-6. **Decanter overrides** - Don't use arbitrary Tailwind values, use Decanter tokens
-7. **User data in URLs** - Never pass sensitive user data in query params; use HTTP-only cookies
-8. **JWT secret missing** - Ensure `JWT_SECRET` is set (required for JWT signing)
-
-## Key Documentation
-
-- **SAML Setup**: `docs/SAML.md` (comprehensive Stanford SSO guide)
-- **Acquia API**: https://cloud.acquia.com/api (official docs, requires login)
-- **Decanter**: https://decanter.stanford.edu (Stanford Design System)
-- **Next.js 15**: https://nextjs.org/docs (App Router only)
-
-## Branch Strategy
-- Main branch: `main` (current development branch)
-- Repository: `SU-SWS/churro` (Stanford University Web Services)
-
----
-*Last Updated: Based on codebase analysis, November 2025*

From a00f86689cbe257cb61bf2b60c66df2aa5753062 Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Thu, 4 Dec 2025 10:45:33 -0800
Subject: [PATCH 15/16] fixup! WIP

---
 lib/email-service.ts | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/email-service.ts b/lib/email-service.ts
index f3c5d40..ceb7ee2 100644
--- a/lib/email-service.ts
+++ b/lib/email-service.ts
@@ -535,9 +535,8 @@ function generateEmailHTML(data: EmailData): string {
 
         <footer class="footer" role="contentinfo">
           <p style="margin: 0;">
-            Generated by <span class="stanford-branding">CHURRO</span>
-            <span class="sr-only">(</span><abbr title="Cloud Hosting Usage Reporting with Recurring Output">CHURRO</abbr><span class="sr-only">)</span><br>
-            Stanford University Web Services
+            Generated by <a href="https://churro.stanford.edu" style="color: #8c1515; font-weight: 600; text-decoration: none;"><abbr title="Cloud Hosting Usage Reporting with Recurring Output">CHURRO</abbr></a><br>
+            Stanford Web Services
           </p>
         </footer>
       </div>

From 80375a3ced9690a64c342ad2b020a7946f11befa Mon Sep 17 00:00:00 2001
From: John Bickar <jbickar@stanford.edu>
Date: Mon, 15 Dec 2025 09:20:41 -0800
Subject: [PATCH 16/16] next-15.5.8

---
 package-lock.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package-lock.json b/package-lock.json
index b0ec842..533897b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
         "basic-auth": "^2.0.1",
         "cnbuilder": "^3.1.0",
         "decanter": "^7.4.0",
-        "next": "^15.5.7",
+        "next": "^15.5.8",
         "react": "18.3.1",
         "react-dom": "18.3.1",
         "recharts": "^2.12.7",