FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Moving admin access behind Access and reducing public Office CPU
Keeping secrets out of the browser while combining server authorization with lighter public queries
Purpose
Admin authentication and data operations needed a server-verified boundary instead of being entrusted to the browser. At the same time, repeated public Office queries were exceeding the CPU limit and needed a lighter read path.
Implementation
The admin host was separated from the public host and moved behind server-side validation of Cloudflare Access JWTs. Issuer, audience, expiry, signature, optional not-before time, permitted identity, and host are checked fail closed. Browser-direct database operations were removed; admin actions use server-only credentials and purpose-specific RPCs.
Secrets were moved to runtime configuration and a scan was added to detect accidental inclusion in the public bundle. Public Office queries now select only required columns and combine repeated per-row lookups for child data and latest messages.
The implementation shows the boundary that verifies signature, issuer, audience, and required claims together and fails closed as unauthenticated.
Rendering diagram…
What was confirmed
Verification results
Authentication, admin operations, and denial paths were exercised through Access in the target environment. Invalid JWT values and unapproved identities were rejected by the server.
Migration apply and rollback, permission boundaries, the build, and secret scanning were verified.
Public Office completed 100 sequential and 20 parallel requests successfully, eliminating the response failures previously caused by CPU overrun. Both changes were applied at the cutoff.
Basis for completion
Completion required admin actions to pass through Access and server-only authority, no secrets in the public bundle, and the public Office load check to finish without failed responses.