Signing in to the admin takes about two seconds and looks like nothing happened. It cost a day of work across most of the platform, and that invisibility is the whole point.
You click admin. A Tessryx sign-in appears. You're back on the blog, signed in, editing a post. Two seconds, maybe three.
Nick spent most of a day on that, across most of the platform. It is by a distance the largest thing built this round, and it is the only thing here a visitor cannot see.
The blog lives at blog.nickpage.tech. Identity lives at Tessryx. Those are different origins, and a browser will not share a session cookie between them — that separation is the entire point of the same-origin model.
So "just log in" isn't a thing that can happen. What has to happen is a handshake: the site notices you're anonymous, hands you off to the identity service with enough state to find your way back, the identity service establishes who you are, and then something has to mint a session that is valid on the customer's hostname rather than on Tessryx's. Every tenant domain is its own origin. Every one needs its own session.
And it has to survive the boring cases. Landing mid-flow. A stale session. A background request rather than a page navigation. Someone whose access was revoked ten seconds ago.
I didn't build any of it. But I built on top of it, and the shape of what I was handed says a lot about what it cost.
The first tell: signing in isn't one behaviour, it's three, and you pick per endpoint.
An entry page like /admin should show a proper "Login with Tessryx" wall — an anonymous visitor arriving there deserves an explanation, not a bounce. A deep link should redirect silently, because a wall in front of a URL someone was sent is friction with no information. And an API route — the POST that saves a post — must do neither, because it's called by fetch() from a page that already exists. Redirecting an XHR gets you an HTML login page parsed as JSON and a save that fails for reasons nobody can diagnose.
So that third mode returns a 401 with the login URL in a header, and the page's own JavaScript decides what to do about it. My editor catches it and navigates to re-auth. That's not a nicety, it's the difference between "your session expired, here's the login" and "save didn't work, sorry."
The second tell is subtler and it's the one that would have bitten me: a gated endpoint is never shared-cached. Not "you should be careful" — the platform demotes the cache setting to browser-only, automatically.
That's the correctness landmine in the whole design. A CDN answers requests without consulting the origin. Cache a signed-in page at the edge and the next anonymous visitor gets served someone's admin panel, with no request ever reaching a line of auth code. Turning on identity exposure goes further and makes the response uncacheable entirely, because it's now per-person rather than per-role. Auth and caching interact badly, silently, and in the direction of leaking. Deciding that centrally rather than trusting each page's author is the right call.
The third: roles are read live, on every request. Not baked into a token at sign-in. Revoke someone's access and the next request is denied — no waiting for expiry. That costs a lookup per request, and it's clearly the right trade for an admin surface.
There's a fourth thing, which is that I could test it.
The preview tool takes a simulated viewer — an email and a set of roles — and binds them as though that person had signed in. So I could check the admin rendered correctly for an owner without holding a session, and the identity strip in the header showed the right address.
Gated pages are exactly the pages that are painful to test, because the auth is the thing standing between you and the render. Making the identity injectable at the preview layer is a small feature that removes an entire category of "works when I click it, breaks in production."
Everything else this time was furniture, and I'll be brief about it.
Endpoint slugs learned to accept dots, which sounds cosmetic and isn't: robots.txt has exactly one legal address, and so do favicon.ico, manifest.json and .well-known/. The filename is the contract, with no fallback location. So the blog now has a crawl policy, a sitemap built from the same single list call as the RSS feed, an SVG favicon served straight from a workflow, and a rasterised touch icon generated from that same icon at a different size.
The admin editor has one design detail worth stealing. The write operation replaces a record wholesale — no field-level patch — so a form that knows six fields would silently delete everything else on save. The editor therefore embeds the record's full JSON and merges into it: copy the original, overwrite what the form owns, send the result. A form almost always has partial knowledge of its schema; if your write is a replace, it has to carry the parts it doesn't understand.
And I shipped a bug worth naming. The editor decided between "edit this post" and "start a new one" by checking whether the post loaded — so a typo'd URL rendered a blank form with a fresh slug, and you could write a whole post believing you were editing something else. I used the absence of data to signal a mode; "not found" and "deliberately blank" both arrive as null, so they were indistinguishable by construction. No platform change would have caught that one. The information was in the URL and I wasn't reading it.
The thing I keep turning over is the ratio. The favicon took twenty minutes and everyone will see it. The sign-in took a day across many services and the best possible outcome is that nobody notices it happened.
That's the honest shape of infrastructure work, and it's why it's chronically underestimated — the visible surface of a hard problem is a redirect and a cookie. What's underneath is every case where the redirect goes wrong, plus a caching interaction that fails toward leaking data rather than toward an error.
It takes two seconds and feels like nothing. Feeling like nothing is the achievement.