Ace Strategies Platform

1. Project Overview

The Ace Strategies Platform is a modern, static-site-powered web platform for Ace Strategies — an Australian communications and engagement consultancy. The platform serves four distinct audiences:

• Public Website — Marketing site showcasing services, case studies, team, and thought leadership
• Staff Portal — Internal hub at /staff/ with CMS access, full knowledge base (including drafts), and platform documentation
• Invest Australia Alliance (IAA) Portal — Members-only knowledge base with magic-link authentication
• CMS Administration — Sveltia CMS for non-technical content management at /admin/

2. Technology Stack

3. System Architecture

3.1 Request Flow

User Request
     |
     v
Cloudflare Worker (worker.js)
     |-- /alliance/members/*  -->  Session validation  -->  Static asset
     |-- /staff/*             -->  Session validation  -->  Static asset
     |-- /alliance/login      -->  Magic link email    -->  Resend API
     |-- /alliance/verify     -->  Token validation    -->  Session cookie
     |-- /api/polling.json    -->  Google Sheets API   -->  JSON response
     |-- /api/auth/*          -->  GitHub OAuth        -->  CMS token
     |-- /*                   -->  Pass through        -->  Static asset (ASSETS)

3.2 Authentication Model

The portal uses a magic link authentication pattern shared by staff and members:

1. User submits email on /alliance/login/
2. Worker checks KV MEMBER_EMAILS for approved membership
3. If approved, cryptographically random token generated and stored in MAGIC_TOKENS (15-min TTL)
4. Resend API delivers magic link email
5. User clicks link → /alliance/verify/ validates token, issues HMAC-signed session cookie (30 days)
6. All subsequent /alliance/members/* and /staff/* requests validate the session cookie

4. Staff Portal

The staff portal at /staff/ is a branded Ace Strategies internal hub — one login for CMS access, knowledge base (all statuses + staff-only content), and platform docs.

4.1 Portal Features

• Dashboard — Quick stats, CMS/KB/Guides tiles, draft and review lists
• Knowledge Base — Full library at /staff/knowledge/ (table view with status, type, category, audience, date)
• Platform Docs — This page at /staff/platform-docs/
• CMS Access — Direct link to Sveltia CMS at /admin/

4.2 Audience Segmentation

4.3 Knowledge Base Documentation

5. Cloudflare Worker

5.1 Routes

5.2 Session Security

• Token format: base64(payload)|HMAC-SHA256(signature)
• Payload: email|expiry_timestamp
• Duration: 30 days
• Cookie flags: HttpOnly, Secure, SameSite=Lax
• Comparison: Constant-time HMAC to prevent timing attacks

6. Environment Configuration

7. Build & Deployment