Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a dashboard behind authentication where a Next.js 16 `proxy.ts` performs an optimistic request-boundary session check and protected server code enforces authorization. Fetch independent data sources concurrently and STREAM them with per-widget Suspense boundaries rather than blocking on the slowest. Expose a Route Handler for a webhook or JSON API, use `updateTag` for immediate Server Action reads or `revalidateTag(tag, 'max')` for stale-while-revalidate, optimize images/fonts, keep secrets server-only, and deploy with a clean production build.
proxy.ts uses a narrow matcher and request-boundary redirect, while protected routes and mutations independently validate identity and authorization.
Independent data streams via per-section Suspense boundaries; the shell/skeletons render instantly instead of blocking on the slowest fetch.
A working Route Handler; updateTag or explicitly profiled revalidateTag/revalidatePath behavior matches the required consistency after changes.
Clean next build and a real deploy; only NEXT_PUBLIC_ vars are client-exposed; images/fonts optimized; no secrets shipped.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A streaming, authenticated dashboard ## Goal Build a dashboard behind authentication where a Next.js 16 `proxy.ts` performs an optimistic request-boundary session check and protected server code enforces authorization. Fetch independent data sources concurrently and STREAM them with per-widget Suspense boundaries rather than blocking on the slowest. Expose a Route Handler for a webhook or JSON API, use `updateTag` for immediate Server Action reads or `revalidateTag(tag, 'max')` for stale-while-revalidate, optimize images/fonts, keep secrets server-only, and deploy with a clean production build. ## Acceptance criteria - [ ] Proxy & auth: proxy.ts uses a narrow matcher and request-boundary redirect, while protected routes and mutations independently validate identity and authorization. - [ ] Streaming & Suspense: Independent data streams via per-section Suspense boundaries; the shell/skeletons render instantly instead of blocking on the slowest fetch. - [ ] Caching & route handlers: A working Route Handler; updateTag or explicitly profiled revalidateTag/revalidatePath behavior matches the required consistency after changes. - [ ] Production: Clean next build and a real deploy; only NEXT_PUBLIC_ vars are client-exposed; images/fonts optimized; no secrets shipped. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.