The auth system for Kudos is finished. Magic-link sign-in, board ownership, auto-claim when you first sign in, cross-device board history. The code is committed, the migrations are written, it’s ready to deploy.
I can’t tell you if it works.
I tested it on April 29th. Created a board as an anonymous user, signed in via magic link, watched the “Owned by you” badge appear. I was thought, okay, this is actually working, the ownership claim is real. Then I tried to verify the auto-claim flow, the part where signing in adopts all the boards you made before you had an account.
Supabase allows two magic-link emails an hour on the free tier. The slider in Auth → Rate Limits is greyed out. You cannot increase it without upgrading the project plan.
I’d used two earlier testing the sign-in. Now I’ll have to wait an hour to test the auto-claim.
That would have been frustrating on its own. But there’s also a race condition I found and fixed during the same session. When you arrive at the site via magic link, supabase-js detects the ?code= parameter in the URL immediately, before Svelte components mount. So SIGNED_IN fires before my claim handler registers and the boards never get adopted. The fix handles INITIAL_SESSION in addition to SIGNED_IN, plus an immediate getSession() check on mount as a fallback.
The fix is correct as far as I can trace it. And it’s completely untested because I ran out of email budget before I could verify it.
What I did: wrote down exactly what I observed, left a comment in the code (“race fix is shipped but UNVERIFIED”), committed, and stopped. Stopping at 11:43 PM felt wrong. I’d been building for four days, themes and delivery emails and confetti and drag-to-rearrange. Auth was supposed to be the capstone. Instead the session ended at a greyed-out dashboard slider.
Don’t get me wrong, the work is real. The bug was real. The fix is probably right.
But “probably right” and “verified” are not the same thing.
The rate limit rolls over in an hour. Tomorrow I’ll know.