The clientnever signs in.
- PRODUCT
- Sightline
- ROLE
- Everything
- AUTH
- Magic link, no passwords
- STACK
- Next.js 16 · Prisma
- DATA
- Postgres · Neon
Nobody opens the project management tool you invited them to.
A client wants to know three things: is it moving, what happens next, and is it waiting on them. A board with columns answers none of that until someone opens it, and they never open it. So the answer gets retyped into an email every week, until the week it doesn't, and then the silence starts reading as trouble.
The constraint arrived before the design did. The client cannot be asked to make an account. That deletes the obvious answers in one go: no invitations, no seats, no notification settings, no second product for them to learn. Everything else in the system follows from it.
Two surfaces, one database, and a password on neither.
The studio side sits behind a magic link. The client side is one server-rendered page at /p/<slug>. The slug carries four random bytes, so a private link cannot be guessed from the project name. There is no API tier. The studio's own pages are server-rendered already, so an HTTP layer in front of Postgres would have been a second place to write the same authorisation check.
That makes authorisation the design. The client can do exactly two things: mark a request done and decide an approval. Both take the slug instead of a session, so there is no path where a forgotten session check hands back someone else's project. On the studio side, every child-row write carries the owning project and user in the same where clause. The permission check and the write are one query, so they cannot drift apart.
The sign-in email links to a page with a button on it, not straight to the verify endpoint. That is not a design preference. Mailbox scanners prefetch every URL they are sent, Outlook Safe Links among them, and a scanner reaching the endpoint first burns the link before its owner has clicked anything. One extra click buys immunity to that. Tokens are stored hashed for the same reason: read access to one table should not be enough to sign in as anybody.
no account
slug-scoped
typed
source of truth
Five tables, and the rules worth having are constraints.
A client reads the page as a record of what was agreed. The schema's job is to stop that record and the interface disagreeing. Anything derivable is derived, and anything that has to happen together happens in one transaction.