App Registry

Password auth uses bcrypt hash stored as base64 in env vars to avoid special character parsing issues with $ and / in bcrypt hashes. Session managed via iron-session with a 7-day cookie expiry.

Auth model

• Public read on all routes — dashboard and project detail pages are shareable
• /admin/* routes gated via proxy.ts (Next.js 16 convention)
• Mutating API routes (POST, PATCH, DELETE) check session server-side

Data layer

• Upstash Redis shared with Mise en Place — keys namespaced under registry: to avoid collision
• registry:projects:index holds the array of project IDs
• Projects stored individually at registry:projects:{id}
• Array fields (stack, futureIdeas) normalised on read to guard against missing data from older records

Thumbnails

• Vercel Blob (public store) — client-side upload from the edit form, URL stored in Redis
• Falls back to /thumbnails/default.svg if no thumbnail set

Future ideas

Stored as { text: string, done: boolean } objects to support checkbox completion tracking on the detail page.