Documentation

Component Diagram — Internal Module Boundaries

authOptions is the single most connected node in the codebase — nearly every API route depends on it via getServerSession, and middleware.ts applies it to every route except sign-in and auth/seed endpoints.

Key boundaries

• Client vs. Server: pages fetch JSON from same-origin API routes; there is no separate backend service.
• Auth boundary: enforced twice — once at the edge via middleware.ts, and again inside each route handler via getServerSession, which is also where role/ownership checks happen.
• Storage boundary: Supabase Storage is used only for document object storage (private, signed URLs) — it plays no role in authentication or the relational data model.