Build a React + TypeScript + Tailwind CSS app (Vite) that authenticates with the Brivo API using the 3-legged OAuth authorization_code flow. A "Log in with Brivo" page initiates the flow by redirecting to https://auth.brivo.com/oauth/authorize with response_type=code, client_id, and a generated state. Brivo redirects back to BRIVO_REDIRECT_URI (default http://localhost:5173/oauth/callback) with ?code=...&state=...; the /oauth/callback route validates state, then exchanges the code at /auth/oauth/token through the Vite proxy. Include user management (Brivo Users only, not Administrators), add/remove BMP credentials (use the digital invitation flow for BMP credential creation; credential management lives within the user detail view, not a separate page), site management (read-only: list and detail view), initiate and clear default emergency scenarios, and door management (list and unlock only). Provide a dashboard with clickable widgets that navigate to each feature.

Read https://apidocs.brivo.com/llms.txt for API documentation. Use only llms.txt and the files it references. BRIVO_CLIENT_ID, BRIVO_CLIENT_SECRET, BRIVO_API_KEY, and BRIVO_REDIRECT_URI are in .env (unprefixed - server-side only, never exposed to the browser).

Use a Vite dev-server proxy for CORS and credential injection: /auth -> https://auth.brivo.com, /api -> https://api.brivo.com. Pin the Vite dev server in vite.config.ts: server: { port: 5173, strictPort: true } so the registered redirect URI always matches. In the proxy `configure` hook, read credentials from process.env and inject the api-key header on all proxied requests, and inject the Authorization: Basic base64(client_id:client_secret) header on requests to /auth/oauth/token. The browser never sees client_id, client_secret, or api_key.

Do not include client_id or client_secret in the token request body - the proxy supplies them via Basic auth, and Brivo rejects requests carrying both.

Store the resulting access_token and refresh_token in sessionStorage. Silently refresh via grant_type=refresh_token before expires_in elapses, or on a 401 retry.

Display API errors in the UI with the HTTP status and response body.

Write a Node.js script that reads users from a CSV file and provisions them in Brivo Access. For each row, create the user, create and assign a credential, and assign group membership. Authenticate using the 3-legged OAuth authorization_code flow.

On every invocation, the script must: (a) generate a state value and start an ephemeral HTTP listener bound to the port of BRIVO_REDIRECT_URI (default http://localhost:8765/callback); (b) open the user's default browser to https://auth.brivo.com/oauth/authorize with response_type=code, client_id, and the generated state; (c) on the loopback callback, validate state, capture the code, respond with a small "you may close this tab" HTML page, and shut the listener down; (d) POST the code exchange to https://auth.brivo.com/oauth/token with the api-key header and an Authorization: Basic base64(client_id:client_secret) header. Hold access_token and refresh_token in process memory only. Use grant_type=refresh_token during the run when the access token expires. Never write tokens or codes to disk, logs, or stdout.

Do not include client_id or client_secret in the token request body - send them only via the Basic auth header. Brivo rejects requests carrying both.

Read https://apidocs.brivo.com/llms.txt for API documentation. Use only llms.txt and the files it references. BRIVO_CLIENT_ID, BRIVO_CLIENT_SECRET, BRIVO_API_KEY, and BRIVO_REDIRECT_URI are in .env.

CSV columns: firstName, lastName, email, credentialFormat (default "Standard 26 Bit"), credentialReferenceId, facilityCode, cardNumber, groupName. Generate a sample CSV with a few rows using "Visitors" as the default groupName.

Cache lookup data (credential formats, group name-to-ID mappings) before processing rows. Use case-insensitive matching for name-based lookups. Validate every row against the cached data and report all mismatches before processing any rows.

On any API error, stop and log the HTTP status, response body, the failing row, and the operation that failed.

Build a React + TypeScript + Tailwind CSS app (Vite) that authenticates with the Brivo API using the 3-legged OAuth authorization_code flow. A "Log in with Brivo" page initiates the flow by redirecting to https://auth.brivo.com/oauth/authorize with response_type=code, client_id, and a generated state. Brivo redirects back to BRIVO_REDIRECT_URI (default http://localhost:5174/oauth/callback) with ?code=...&state=...; the /oauth/callback route validates state, then exchanges the code at /auth/oauth/token through the Vite proxy. Display access events with filtering by site, access point, and date range.

Read https://apidocs.brivo.com/llms.txt for API documentation. Use only llms.txt and the files it references. BRIVO_CLIENT_ID, BRIVO_CLIENT_SECRET, BRIVO_API_KEY, and BRIVO_REDIRECT_URI are in .env (unprefixed - server-side only, never exposed to the browser).

Use a Vite dev-server proxy for CORS and credential injection: /auth -> https://auth.brivo.com, /api -> https://api.brivo.com. Pin the Vite dev server in vite.config.ts: server: { port: 5174, strictPort: true } so the registered redirect URI always matches. In the proxy `configure` hook, read credentials from process.env and inject the api-key header on all proxied requests, and inject the Authorization: Basic base64(client_id:client_secret) header on requests to /auth/oauth/token. The browser never sees client_id, client_secret, or api_key.

Do not include client_id or client_secret in the token request body - the proxy supplies them via Basic auth, and Brivo rejects requests carrying both.

Store the resulting access_token and refresh_token in sessionStorage. Silently refresh via grant_type=refresh_token before expires_in elapses, or on a 401 retry.

Display API errors in the UI with the HTTP status and response body.