Platform Audit Report

League Gator — Platform Audit & Reference Report

Date: 2 August 2026  ·  Status: Live (Stripe in Live Mode)  ·  Purpose: Pre-development baseline snapshot

1. Product Overview

League Gator is an all-in-one sports management SaaS serving leagues, clubs, and sports organisations. It combines:

  • Public-facing club/organisation portal websites (per-org subdomain + custom domain)
  • Competition administration — seasons, divisions, teams, fixtures, standings, brackets
  • Fixture generation — round-robin, intelligent/AI scheduling, bracket builders
  • Member management — players, coaches, referees, registrations
  • Referee management — assignments, ratings, match fees, Stripe Connect payouts
  • Compliance & medical — injury tracking, return-to-play clearance, back-office reporting
  • Monetisation — subscription plans (regional PPP pricing), registration fees, affiliate program
  • Marketing & growth — landing pages, newsletter campaigns, lead capture, affiliates
  • Platform operations — super-admin console, support tickets, version control, analytics

2. Technology Stack

FrontendReact 18 + Vite 6, Tailwind CSS 3, shadcn/ui (Radix primitives)
Routingreact-router-dom 6
Data layer@tanstack/react-query 5, Base44 SDK (@base44/sdk 0.8.41)
BackendBase44 BaaS — entities, auth, functions (Deno), automations
PaymentsStripe (Live) — @stripe/react-stripe-js, stripe-js
Rich contentreact-quill, react-markdown
Chartsrecharts
Mapsreact-leaflet
3D/Visualthree.js
Drag & drop@hello-pangea/dnd
PDFjspdf, html2canvas
Formsreact-hook-form + zod
i18ni18next + react-i18next (en, es, fr, pt)
Notificationssonner (toasts), react-hot-toast
EmailResend (RESEND_API_KEY)
SMSTwilio (via PlatformSettings)

3. Roles & Access Control (RBAC)

Defined in src/lib/rbac.js. Platform roles are stored as the Base44 admin platform role, differentiated by a sub-role field.

Platform Roles

  • super_admin — Full platform access
  • ops_manager — Support, Marketing, Affiliates, Announcements, KB
  • helpdesk — Support tickets (CRUD) + Knowledge Base (read-only)

Organisation Roles

  • org_admin — Full access within their organisation
  • comp_manager — Competitions, fixtures, results, standings
  • coach — View-only + own team roster editing
  • player — View-only within their org
  • public — Unauthenticated; portal pages only

Permission Matrix (key permissions)

  • Platform-only: manage_platform, manage_organisations, manage_plans, manage_subscriptions, manage_analytics, manage_version_control, manage_legal_platform, manage_platform_users → Super Admin only
  • Support/KB: manage_support, view_knowledge_base → Super Admin + Ops + Helpdesk; manage_knowledge_base → Super Admin + Ops
  • Growth: manage_marketing, manage_affiliates, manage_announcements → Super Admin + Ops
  • Org settings: manage_org_settings, manage_members, manage_website → Super Admin + Org Admin
  • Competition ops: manage_competitions, manage_fixtures, enter_results, manage_registrations, manage_teams, manage_players, manage_venues, manage_referees, manage_news → Super Admin + Org Admin + Comp Manager
  • Roster: manage_own_team_roster → includes Coach
  • View: view_org_admin → all org roles + Coach + Player

Row-Level Security (RLS) is configured per entity — most follow an owner-or-admin pattern; some are public-read (read: null).

4. Supported Sports (50+)

Defined in src/lib/sportConfig.js. Each sport carries a full terminology map (match/team/player/fixture/standings/score/venue/competition/round/coach + two extra stats) that drives sport-aware UI labels across the app.

Team sports (26): Soccer, Basketball, Cricket, Volleyball, American Football, Rugby Union, Baseball, Ice Hockey, Field Hockey, Handball, Rugby League, Water Polo, Lacrosse, Softball, Futsal, Netball, Kabaddi, AFL, Gaelic Football, Ultimate Frisbee, Curling, Polo, Sepak Takraw, Dragon Boat Racing, Beach Volleyball.

Individual sports (24): Tennis, Athletics, Golf, Boxing, F1, MMA, Cycling, Swimming, Gymnastics, Wrestling, Badminton, Table Tennis, Skiing, Snowboarding, Surfing, Skateboarding, Triathlon, Marathon, Horse Racing, Judo, Taekwondo, Fencing, Archery, Billiards/Snooker, Chess.

Multi-sport organisations merge terminology (sport-specific where terms agree, generic fallback where they differ). Organisations enable sports via sports_enabled[]; sport_type is auto-set from the primary.

5. Data Model — Entities (~70)

Core Competition Entities

  • Organisation — Tenant root: branding, domain, hero, menu, social, plans, registration fee (read: public; update: owner/admin)
  • Season — Seasonal periods gating competitions
  • Competition — Leagues/cups/tournaments
  • Division — Competition divisions/grades
  • Team — Clubs/teams with home_venue_id, coach details, branding (read: public)
  • Player — Roster players with photo, DOB, position, emergency contact (read: public; update: owner/admin)
  • Venue — Grounds/courts with courts_fields count, capacity, indoor flag (read: public)
  • Fixture — Matches: teams, venue, date/time, scores, status, assigned referees (read: public)
  • LeagueStandings — Computed standings (W/D/L/GF/GA/GD/points/position) (read: public)
  • Bracket — Knockout structures (single/double elimination) with rounds & matches (read: public)
  • MatchEvent — In-match events (goals, cards, subs)
  • PlayerMatchStat — Per-match player statistics (read: public)
  • Lineup — Team lineups for fixtures
  • Attendance — Match/training attendance
  • Availability — Player availability responses

Referee Management

  • Referee — Referees with experience level, sport qualifications, geo-location, assigned fixtures
  • RefereeAvailability — Referee availability slots
  • RefereeRating — Post-match referee ratings (5 categories + overall)
  • MatchFeeRule — Configurable fee rules by role/experience/competition
  • RefereeMatchFee — Per-fixture fee owed to a referee
  • RefereePayout — Batch payouts (Stripe Connect / bank / manual)

Medical & Compliance

  • Injury — Full injury records: type, body part, mechanism, severity, concussion flag, GRTP, attachments[], clearance workflow
  • SchedulingConstraint — Unified constraints: blackouts, venue/referee/team/player unavailability, max travel, time prefs, field capacity; links to injury_id for auto player-unavailable

Scheduling & Availability

  • VenueAvailability — Venue time slots
  • TrainingSession — Training sessions
  • TrainingAttendance — Training attendance records

Registration & Members

  • Registration — Player/season registrations
  • OrganisationMember — Org member roster with roles
  • PlayerContact — Player contact/guardian details
  • Sponsor — Competition/team sponsors

Content & Portal

  • BlogPost — Org news articles
  • LegalPage — Legal/content pages (platform or org scoped) with SEO meta
  • Notification — In-app notifications

Subscriptions & Billing

  • SubscriptionPlan — Plans with regional PPP pricing (USD/AUD/GBP/EUR/INR/SGD/PHP), Stripe price IDs, feature limits
  • Subscription — Org subscriptions: status, billing cycle, Stripe IDs, PO/manual invoice support

Affiliate Program

  • Affiliate — Affiliate accounts with referral codes & commission rates
  • Referral — Referral tracking with 12-month commission window & fraud flags
  • AffiliateCommission — Commission records
  • AffiliateNotification — Affiliate notifications
  • MarketingAsset — Reusable marketing assets for affiliates

Marketing & Growth

  • MarketingPage — Landing pages
  • MarketingLead — Captured leads
  • FormField — Custom form fields
  • NewsletterCampaign — Email campaigns
  • NewsletterSubscriber — Subscriber list
  • NewsletterSettings — Newsletter config
  • PageAnalytics — Landing page analytics
  • KnowledgeBaseArticle — Help center articles

Platform Admin

  • PlatformSettings — Global app config: name, logo, analytics, Twilio, OpenWeather
  • SystemAnnouncement — Platform-wide announcements
  • SupportTicket — Support tickets
  • WeatherAlert — Weather alerts for fixtures (severity, recommendation)
  • SMSNotification — SMS notification log

Version Control & Safety

  • CodeVersion — Code snapshots
  • ContentVersion — Content snapshots
  • ConfigVersion — Config snapshots
  • RecycleBin — Soft-deleted records
  • DeletedAdminUser — Soft-deleted admin users

6. Backend Functions (65)

Scheduling & Fixtures

generateIntelligentSchedule (AI/optimised round-robin — venue distribution + home-venue preference, recently fixed), optimizeFixtureSchedule, assignReferees / intelligentRefereeAssignment, generateBracket, seedWinner, exportFixturesToCalendar, updateLeagueStandings

Match & Reporting

generateMatchSummary / generateMatchReport (AI), generateCommissionerReport, assignMatchFeeOnFixtureCompletion, calculateRefereeFees, createRefereePayout / exportRefereePayoutReport / processRefereeStripeConnect

Billing & Subscriptions

createCheckoutSession / createRegistrationCheckout / createStripeInvoice, manageSubscription, stripeWebhook, expireTrials

Affiliates

affiliateRegistration / trackReferral, processAffiliateCommissions / approveAffiliateCommission / processAffiliatePayout / monthlyAffiliateCommissionCycle

Notifications & Comms

sendEventReminders / sendFixtureSMSReminder / sendRegistrationDeadlineSMS / checkFixture24hReminders, sendNewsletterCampaign / processRecurringNewsletters / unsubscribeNewsletter, notifyFixtureResult / notifyRegistrationStatus / notifyTrainingSession / notifyWeatherAlerts / notifyRefereePayoutPaid / notifyNewSupportTicket, createNotifications, processSMSQueue, sendContactMessage

Org & User Management

createSignupOrganisation (self-service, service-role bypass of RLS), inviteOrgAdmin, requestPoSignup / approvePoRegistration

Weather

checkWeatherAlerts / notifyWeatherAlerts (OpenWeather integration)

AI Content

generateSEOContent / generateSocialContent / generateFAQ

Platform Admin & Versioning

getPlatformSettings / updatePlatformSettings, createCodeSnapshot / createContentSnapshot / createConfigSnapshot, restoreCodeVersion / restoreContentVersion / restoreConfigVersion, softDeleteAdminUser / purgeDeletedAdmins / softDeleteEntity / restoreFromRecycleBin / purgeExpiredRecycleBin, submitRefereeRating

7. Application Routes & Pages

Public (no auth)

/login, /register, /forgot-password, /reset-password (email/password + Google OAuth + OTP), /signup (org self-signup/pricing), /sport-landing/:sportId, /pages/:slug, /legal/:slug, /availability, /unsubscribe, /affiliate/signup

Public Portal (/portal/:orgId)

Per-organisation public website: Home, Fixtures, Results, Standings, Stats, Team Roster, News, Competitions, Register, Contact, Legal pages. SEO titles follow [Org name] - [Page Title].

Protected — Super Admin (/admin/*)

Dashboard, User Management, Organisations, Plans, Subscriptions, Support Tickets, Announcements, Knowledge Base, Analytics, Landing Analytics, Newsletter, Marketing (Landing Pages/Leads/Analytics/Newsletter), Version Control, Page Management, Affiliates (Manage/Marketing Assets/Referee Payouts), Weather Alerts.

Protected — Org Admin (/org/*)

Dashboard, Competitions, Seasons, Teams, Players, Venues, Fixtures, Standings, Registrations, News, Website, Settings, Support, Smart Scheduling, Sport Setup, Venue Availability, Referees (+ profile), Knowledge Base, Page Management, Weather Alerts, Back Office, Injuries.

Protected — Coach (/coach/*)

Dashboard, Calendar, Fixtures, Results, Team, Training, Player Profile, Player Performance, Live Match.

Protected — Referee (/referee)

Referee Dashboard.

Protected — Affiliate (/affiliate/*)

Dashboard, Marketing Resources.

8. Key Feature Areas (current state)

Smart Scheduling (/org/scheduling)

Tabbed interface: AI/Intelligent generator, Unified Constraint Manager, Round-Robin generator, drag-and-drop Schedule Board.

  • IntelligentScheduleGenerator — round-robin with constraints (team availability, max travel, fair home/away, avoid back-to-back). Recently fixed: now prefers each team's home_venue_id and round-robins remaining venues instead of collapsing to one.
  • UnifiedConstraintManager — single UI for all constraint types (blackout dates, venue/referee/team/player unavailability, max travel, time prefs, field capacity) with scope control (org-wide vs competition) and "Clear all" bulk action.
  • Injury ↔ Constraint sync — injuryConstraintSync helper auto-creates/removes player_unavailable constraints linked via injury_id. Non-fatal in UI.

Injury Management (/org/injuries)

Full medical workflow: injury recording (type, body part, mechanism, severity, concussion/GRTP flag), multi-file attachment upload (medical reports, clearance docs, imaging), return-to-play clearance gate, one-click "Clear to Play", auto-unblocks scheduling constraints. Embedded in player profiles.

Referee Management

Assignment engine (proximity + qualification + experience matching), availability calendars, post-match ratings (5 categories), configurable match fee rules, Stripe Connect payouts, payout reporting.

Back Office (/org/back-office)

Compliance reporting with PDF generation (jspdf).

Weather Alerts

OpenWeather API integration; automated alerts for fixtures with severity & recommendations (monitor/reschedule/cancel/proceed).

Portal Websites

Per-org public site with custom branding (logo, colors, hero), custom menu links, built-in menu visibility toggles, season visibility filtering, SEO titles, social links, newsletter widget, contact form, registration with Stripe checkout.

Monetisation

  • Subscription plans with regional PPP pricing across 7 currencies, annual discount, feature limits (teams/competitions/players/pages, custom domain, registration, blog, advanced scheduling).
  • Registration fees per organisation (Stripe checkout).
  • Manual PO invoicing for enterprise.
  • Affiliate program — 15/20/25% commission, 12-month earning window, fraud detection, Stripe Connect payouts.

Marketing & Growth

Landing page builder, lead capture with custom form fields, newsletter campaigns (scheduled + recurring), analytics, marketing assets for affiliates.

Version Control & Safety

Code/content/config snapshots with restore; recycle bin with soft-delete + expiry purge; soft-deleted admin user handling.

Internationalisation

4 languages (en, es, fr, pt) via i18next; language switcher in sidebar; sport-aware terminology.

9. Integrations & Secrets

IntegrationStatusSecret
Stripe (Live)Claimed, Live ModeSTRIPE_SECRET_KEY, STRIPE_PUBLISHABLE_KEY, STRIPE_WEBHOOK_SECRET (+ test keys)
Resend (Email)ConfiguredRESEND_API_KEY
Twilio (SMS)Via PlatformSettingstwilio_account_sid, twilio_auth_token, twilio_phone_number
OpenWeatherVia PlatformSettingsopenweather_api_key
Base44 CoreBuilt-inInvokeLLM, UploadFile, GenerateImage, GenerateSpeech, GenerateVideo, TranscribeAudio, SendEmail, ExtractData, CreateFileSignedUrl, UploadPrivateFile

App connectors: None authorised yet. Supported connectors available (Google, Slack, Microsoft, etc.) but not connected.

10. Design System

  • Theme: Token-based via CSS variables in src/index.css (:root + .dark), mapped in tailwind.config.js.
  • Primary color: Emerald green (160 84% 28% light / 39% dark).
  • Font: Inter (Google Fonts).
  • Sidebar: Dark navy (222 47% 8%) with emerald accents.
  • Dark mode: Class-based, toggle in sidebar user menu.
  • Components: Full shadcn/ui suite installed (40+ primitives).
  • Toasts: Sonner (top-right, rich colors) + legacy Toaster.

11. Known Issues & Technical Notes

  1. Competitions page fetches all records with implicit limit of 50 via SDK — no pagination or load-more support.
  2. Intelligent schedule generator venue logic — fixed this session (was collapsing to one venue; now prefers home venues + round-robins).
  3. Venue entity has no latitude/longitude fields, so the travel-time optimiser in generateIntelligentSchedule always returns 0 — the "max travel time" constraint is currently inert. Consider adding geo fields if travel optimisation is needed.
  4. Self-service org signup delegates to createSignupOrganisation backend function (service-role) to bypass RLS on Organisation creation.
  5. SendEmail integration reaches registered app users only — external addresses are rejected.

12. Architecture Decisions (carried forward)

  • Shared auth helper base44/shared/authChecks.ts for consistent security enforcement.
  • High-privilege operations (org creation) run server-side with service-role to bypass RLS.
  • Unified "About Us" field replaces individual footer-text fields.
  • Sonner Toaster mounted in App.jsx for toast notifications.
  • Bidirectional linking between portal results ↔ standings via competition query params.
  • portal_home_seo_title for custom homepage meta titles.
  • Injury clearance-gate logic integrated into lineups.
  • Multi-file upload for medical documents in InjuryFormDialog.
  • Consolidated "Return to Play" workflow with auto-unblocking.
  • Unified scheduling constraints in a single manager (UnifiedConstraintManager).
  • injuryConstraintSync helper for atomic injury→constraint management.
End of report — League Gator Platform Audit, 2 August 2026