All projects
SaaS case study
Authentication & Access Dashboard
Email and OAuth sign-in, role management and audit logging for an internal team tool.
- Shared logins
- → 0
- Access review
- 2 days → 10 min
- Audited actions
- 100%
app.example.com/sign-in
Interface reference — rendered from the real component structure, not a stock image.
The problem
Access was managed by sharing a single login, so nobody could tell who changed what.
The solution
Individual accounts with Google and email sign-in, roles stored in a dedicated table, and a server-side permission check on every action.
Hard parts
Avoiding privilege escalation. Roles are never read from the client — permissions resolve through a security-definer function on the server.
Outcome
Access reviews are now a report instead of an investigation.
Technology used
- Supabase Auth
- Next.js
- PostgreSQL
- TypeScript
How it was delivered
- 01Client problemOne shared account meant no accountability and no offboarding.
- 02ResearchMapped who genuinely needed which capability, not who currently had it.
- 03PlanningThree roles, separate role table, deny-by-default policies.
- 04WireframeMembers list, role editor, audit timeline.
- 05DevelopmentSupabase Auth with server-side role checks and full action logging.
- 06TestingAttempted escalation from each role as part of the test suite.
- 07DeploymentMigrated existing users in a scheduled window with a rollback script ready.
- 08ResultsOffboarding takes one click and leaves a record.
Lessons learned
Never store roles on the user or profile row. A separate table plus server-side checks is the only safe pattern.