SaaS Platform · Auth
Pulse
A multi-tenant SaaS foundation — email and OAuth auth, email verification, organisations, and runtime-definable custom roles with a permission catalogue that cannot escalate privileges.
Organisation
Independent Project
Role
Solo — architecture and implementation
Timeline
2026
Stack
Overview
Pulse is the part of every SaaS product that has to exist before the product does: accounts, teams, roles and permissions. It ships a complete authentication and authorisation system on Next.js 16 and PostgreSQL, with platform-level super-admin user management and per-team organisations carrying both built-in and custom roles.
Key Features
- Complete auth surface — email and password sign-up with verification email, password reset by token, optional Google OAuth with account linking, and set/change password for users who signed up via OAuth and have no password yet.
- Two-layer route protection — a fast edge-level cookie gate in Next.js 16’s proxy.js (middleware, renamed in v16), backed by an authoritative server-side session check in the dashboard layout.
- Two independent role systems — app-level platform roles (superadmin / user) for cross-tenant administration, and organisation-level roles (owner / admin / member) scoped per team.
- Dynamic access control — org admins define custom roles at runtime from a curated permission catalogue that deliberately excludes role management and org deletion, so a custom role can never escalate its own privileges.
- Dashboard shell with top navigation, a multi-tab settings modal (account, security, notifications, appearance, danger zone), and a users area for members, teams and invitations.
Impact
Authorisation is where multi-tenant products usually accumulate their worst bugs — roles hard-coded in checks, permissions that quietly let someone grant themselves more. Pulse makes roles data rather than code, and closes the escalation path by construction rather than by review.