Owner Cloudflare Access
The `/admin` workspace validates the Access issuer, owner application audience, token lifetime, and configured owner email before operational data loads.
CLOUDFLARE FOUNDATION
Owner and technician data stay behind explicit boundaries.
HVAC Core separates public product and contractor pages from the real D1-backed owner and technician workspaces, then applies the identity and record scope appropriate to each private surface.
Technician Cloudflare Access
The `/tech` workspace uses a separate Access application audience. HVAC Core maps the verified email to an active technician record before technician-context requests are allowed.
Assignment-scoped field data
Technician job reads and mutations include the signed-in technician ID server-side. A technician cannot select another technician ID in the browser to load or update somebody else’s work, and office-only internal job notes are excluded from technician query results.
D1 operational records
Leads, customers, estimates, invoices, payments, appointments, technicians, jobs, and job-status history remain in the bound D1 database behind server operations.
Public request protection
Contractor lead capture uses bounded JSON input, server validation, a honeypot, and server-side Turnstile verification before D1 persistence.
Mutation controls
Owner and technician mutations enforce same-origin POST rules, bounded bodies, validation, private/no-store response behavior, lifecycle restrictions, and revision conflict checks.
Optional Stripe boundary
Stripe webhook processing requires a signature, validates supported event data, and uses an idempotency ledger before recording invoice or membership billing state.
Optional Twilio boundary
Inbound SMS requests require Twilio signature verification before customer conversation data or consent state can change. Duplicate provider message IDs are ignored.
Optional QuickBooks boundary
OAuth state is single-use and expiring, QuickBooks access and refresh tokens are encrypted before D1 storage, and only explicitly supported accounting records are synchronized.