Applications · Implementation study
A client portal with project-level access control
An application architecture for sharing milestones, documents, and approvals with the right customer and project team.
What the demo shows
The portfolio workspace contains fictional projects and local progress controls. It demonstrates the interface, not a connected customer account or an audited authorization system.
Proposed system flow
- 01Authenticated request
- 02Project permission
- 03Stored records
- 04Customer workspace
01
Model the work and its ownership
A production portal would define organizations, users, memberships, projects, milestones, and documents as related records. Progress would follow agreed milestone rules rather than an editable decorative percentage. The API would return only the data required for the selected workspace, with explicit loading, empty, and unavailable states. Customer-facing dates and approvals need an owner and an audit trail.
02
Authorize every operation
Signing in establishes identity; it does not grant access to every project. Each read, update, and download would check organization membership and permission for the requested resource. OWASP recommends denying access by default and checking permissions on every request. Hiding a button in the interface cannot enforce that boundary. Tests should attempt access using another customer's actual record identifiers.
03
Protect records beyond the interface
PostgreSQL row security can provide an additional database boundary when configured with appropriate policies and application roles. Table owners normally bypass it, and superusers and BYPASSRLS roles bypass it, so role selection must be tested. This design would also authorize file downloads, expire temporary access links, and commit state changes with their audit records.
Validation plan
- Test cross-customer reads, updates, exports, and direct document access.
- Check expired sessions, revoked memberships, and simultaneous milestone changes.
- Verify that audit entries identify the actor, action, resource, and time.
More in applications
Have a similar problem to solve?
Discuss your project