Завантаження документації...
Підготовка контенту платформи Ring
Concepts, value, and typical clone scenarios — less code.
Concepts, value, and typical clone scenarios — less code.
Підготовка контенту платформи Ring
Підготовка контенту платформи Ring
Підготовка контенту платформи Ring
Use Founder / Developer tabs in the docs sidebar. This page covers the architecture-level security model; operational hardening and compliance depth live in Security & Compliance.
Ring Platform defense is layered: Auth.js establishes identity, layout-level gates enforce role access before Server Actions run, JSONB rows carry visibility flags, and API routes apply Zod validation plus rate limits. There is no single middleware that replaces domain checks — each layer adds a narrow guarantee.
| Layer | Founder view | Developer anchor |
|---|---|---|
| Identity | Magic link, Google, Apple, wallet sign-in | Auth.js v5 — Authentication |
| Roles | Visitor → Subscriber → Member → Confidential → Admin | users.data.role lowercase enum |
| Route gates | Paid tiers unlock posting & confidential reads | Authenticated route layouts call auth() |
| Data visibility | Confidential entities/opportunities hidden from public lists | visibility fields + cache tags by role |
| API surface | Webhooks verified server-side only | Zod + RBAC in route handlers |
| Transport | HTTPS everywhere; secrets never in MDX | CORS + rate limiting on /api/* |
Zod schemas, route-boundary patterns, webhook HMAC verification, and business data safety.
Auth.js config, GDPR, PCI notes, Firebase rules legacy paths.
Sessions, Postgres adapter, multi-provider setup.
HMAC webhook verification, idempotent order references.
Use Founder / Developer tabs in the docs sidebar. This page covers the architecture-level security model; operational hardening and compliance depth live in Security & Compliance.
Ring Platform defense is layered: Auth.js establishes identity, layout-level gates enforce role access before Server Actions run, JSONB rows carry visibility flags, and API routes apply Zod validation plus rate limits. There is no single middleware that replaces domain checks — each layer adds a narrow guarantee.
| Layer | Founder view | Developer anchor |
|---|---|---|
| Identity | Magic link, Google, Apple, wallet sign-in | Auth.js v5 — Authentication |
| Roles | Visitor → Subscriber → Member → Confidential → Admin | users.data.role lowercase enum |
| Route gates | Paid tiers unlock posting & confidential reads | Authenticated route layouts call auth() |
| Data visibility | Confidential entities/opportunities hidden from public lists | visibility fields + cache tags by role |
| API surface | Webhooks verified server-side only | Zod + RBAC in route handlers |
| Transport | HTTPS everywhere; secrets never in MDX | CORS + rate limiting on /api/* |
Zod schemas, route-boundary patterns, webhook HMAC verification, and business data safety.
Auth.js config, GDPR, PCI notes, Firebase rules legacy paths.
Sessions, Postgres adapter, multi-provider setup.
HMAC webhook verification, idempotent order references.
Use Founder / Developer tabs in the docs sidebar. This page covers the architecture-level security model; operational hardening and compliance depth live in Security & Compliance.
Ring Platform defense is layered: Auth.js establishes identity, layout-level gates enforce role access before Server Actions run, JSONB rows carry visibility flags, and API routes apply Zod validation plus rate limits. There is no single middleware that replaces domain checks — each layer adds a narrow guarantee.
| Layer | Founder view | Developer anchor |
|---|---|---|
| Identity | Magic link, Google, Apple, wallet sign-in | Auth.js v5 — Authentication |
| Roles | Visitor → Subscriber → Member → Confidential → Admin | users.data.role lowercase enum |
| Route gates | Paid tiers unlock posting & confidential reads | Authenticated route layouts call auth() |
| Data visibility | Confidential entities/opportunities hidden from public lists | visibility fields + cache tags by role |
| API surface | Webhooks verified server-side only | Zod + RBAC in route handlers |
| Transport | HTTPS everywhere; secrets never in MDX | CORS + rate limiting on /api/* |
Zod schemas, route-boundary patterns, webhook HMAC verification, and business data safety.
Auth.js config, GDPR, PCI notes, Firebase rules legacy paths.
Sessions, Postgres adapter, multi-provider setup.
HMAC webhook verification, idempotent order references.
Confidential entities and opportunities let you run a two-speed marketplace: public discovery for reach, restricted listings for vetted partners (investors, government tenders, M&A). Membership upsell often maps directly to confidential access — see Membership.
Never expose production AUTH_SECRET, WayForPay keys, or service accounts in docs widgets, clone READMEs, or client bundles. Ring docs authoring rules forbid embedded secrets.
constants/routes.tsNever trust client JSON — mirror Server Action schemas in /app/api/**.
Check session role + resource ownership (entity userId, opportunity poster).
Apply limiting on auth, webhook, and public write routes — patterns in Security & Compliance.
Use Error.cause (ES2022) for nested failure context in services — aids logging without leaking internals to clients.
API routes set explicit CORS for trusted clone origins only — do not widen Access-Control-Allow-Origin for convenience in production.
Data retention and export for GDPR-facing clones.
Confidential entities and opportunities let you run a two-speed marketplace: public discovery for reach, restricted listings for vetted partners (investors, government tenders, M&A). Membership upsell often maps directly to confidential access — see Membership.
Never expose production AUTH_SECRET, WayForPay keys, or service accounts in docs widgets, clone READMEs, or client bundles. Ring docs authoring rules forbid embedded secrets.
constants/routes.tsNever trust client JSON — mirror Server Action schemas in /app/api/**.
Check session role + resource ownership (entity userId, opportunity poster).
Apply limiting on auth, webhook, and public write routes — patterns in Security & Compliance.
Use Error.cause (ES2022) for nested failure context in services — aids logging without leaking internals to clients.
API routes set explicit CORS for trusted clone origins only — do not widen Access-Control-Allow-Origin for convenience in production.
Data retention and export for GDPR-facing clones.
Confidential entities and opportunities let you run a two-speed marketplace: public discovery for reach, restricted listings for vetted partners (investors, government tenders, M&A). Membership upsell often maps directly to confidential access — see Membership.
Never expose production AUTH_SECRET, WayForPay keys, or service accounts in docs widgets, clone READMEs, or client bundles. Ring docs authoring rules forbid embedded secrets.
constants/routes.tsNever trust client JSON — mirror Server Action schemas in /app/api/**.
Check session role + resource ownership (entity userId, opportunity poster).
Apply limiting on auth, webhook, and public write routes — patterns in Security & Compliance.
Use Error.cause (ES2022) for nested failure context in services — aids logging without leaking internals to clients.
API routes set explicit CORS for trusted clone origins only — do not widen Access-Control-Allow-Origin for convenience in production.
Data retention and export for GDPR-facing clones.