Case study · Private site

A private site that says no by default.

Most of ADJL Capital’s site is for its investors. The build seals members’ pages out of the public output. An edge function checks for a signed session before it serves any of them, and when it can’t tell, it refuses. Serverless functions handle property lookups, market data (live prices and trades from the exchanges) and scheduled email briefs.

Locks
Sealed at build, checked at the edge
Default
Refuse when unsure
Functions
Property lookup, market data, scheduled briefs
Shown here
The design only. No keys, paths or rules

This page’s own structure, drawn at build from its HTML.

People read the top layer, crawlers follow the middle one and machines parse the bottom one.

9 headings · 50 links · 5 schema nodes

Build

Build and edge

Two locks, one rule.

The first lock runs at build time. Members’ pages never reach the public files at all. The second runs at the edge on every request, before any cache (a stored copy from an earlier request). It checks a signed session and serves the page only when the check passes.

build seal · edge check Illustration
  1. Members’ pages are sealed out of the public build, so they never reach the public files.
  2. Every request for one meets an edge function first, before any cache.
  3. A request with a valid signed session gets the page.
  4. Anything the function can’t verify gets an error, and nothing is served.
  5. If the lock were ever missing from a deploy, the members’ pages wouldn’t exist in it.

Failure mode

When unsure, refuse.

If the edge function can’t decide, it serves an error and not the page. If the lock were ever missing from a deploy (each time the site is published), the members’ pages wouldn’t exist in it. That trade is deliberate. A confusing error now and then is cheap next to a members’ page served to a stranger.

Serverless functions

Functions behind the pages.

Property lookup

Takes a pasted listing URL and returns what’s known about the address, with each figure labeled by its source. It checks access and rate limits before it spends anything.

Market data

Quotes, filings and news, fetched with server-side keys the browser never sees.

Scheduled briefs

Email briefs that run on a schedule and go only to people who asked for them, with a working unsubscribe.

Withheld from this page

Not shown

Left out on purpose.

This page describes the design and leaves out the paths, the token format, the rules and the keys. Those stay private for the same reason the members’ pages do.

Start here

Tell us what’s slow, or what can’t be found.

One paragraph is plenty. Tell us what you want built, the step that costs the most, or the page that should rank and doesn’t. If you know why the obvious fix hasn’t worked, say that too.

Email
daniel@adjlcapital.com
Email Daniel

Daniel reads and answers these himself, usually within a day or two. No sequence, no drip, and nothing sold to anyone.