[Born Closed]
Auth, Roles & Invitations
Google sign-in limited to the company domain, roles per dashboard, invitations for people who never logged in, and a dev shortcut that can't open production.
The dashboard hub shows margins, affiliate payouts and customer data. Different people need different dashboards — and different cuts of the same one.
Designed and built auth, roles, invitations, the settings modal and the role guard inside server functions.
Access had to be per dashboard, people had to be invited before their first login, and local development needed a way in that could never work in production.
01 · Domain allowlist in the database
Google OAuth with internal-only consent, plus a signup trigger that rejects other domains — enforced by Postgres, not the UI.
02 · Roles per dashboard
owner / master / member, granted per dashboard by bootstrap owners.
03 · Invitations
An invited e-mail shows as Pending until the signup trigger applies its roles on the first login.
04 · Born closed
The mock user only works on development hostnames. In production the app stays closed even with the dev flag on, and a real session always wins over the mock.
05 · Guard inside the server function
The function that queries the lake checks the role and cuts the SELECT's column list itself.
! brokeThe app builder's native lake connector looked like it made the server function unnecessary.
→ changedInvestigated it end to end: it doesn't replace a server-side guard, so the guard stayed.