Public eSign Portal & Cloudflare Proxy | Client App Specification

Public Recipient eSign Wireflow & Cloudflare Edge Routing

Click to Zoom Fullscreen

graph LR
    Recipient[External Recipient] --> Link[Access Link: /s/:shortCode]
    Link --> CF[Cloudflare Worker: punchcharlie-proxy]
    CF --> Passcode[Edge Passcode Verification /api/esign/verify-passcode]
    Passcode -->|Valid Passcode| StreamPDF[Stream PDF Bytes /api/esign/pdf/:packetId]
    StreamPDF --> Viewer[Document Viewer & Mandatory Scroll]
    Viewer --> Canvas[Signature Canvas Capture]
    Canvas --> Finalize[POST /api/esign/finalize]
    Finalize --> Seal[Generate SHA-256 Audit Certificate]

punchcharlie-proxy Cloudflare Worker Edge Topology

Cloudflare Worker Edge (punchcharlie-proxy)

workers/proxy-worker.js

• /api/esign/pdf/:packetId (PDF Stream)
• /api/esign/verify-passcode (Passcode Check)
• /api/esign/finalize (Relay to Backend)

Storage & Backend Protection

Supabase Private Bucket

Direct database and file storage credentials remain strictly isolated at the Cloudflare Edge. Signers never receive raw database connections.

Recipient Security & Edge Worker Guardrails

Cloudflare Edge Proxying (punchcharlie-proxy)

Routes all recipient traffic through an isolated Cloudflare Worker, keeping origin servers hidden and unexposed.

Passcode Access Code Gate

Requires recipient to enter a valid passcode + access code before streaming PDF bytes from storage.

ESIGN Mandatory Scroll Lock

Disables signature pad until recipient completes 100% full-text document scroll.

SHA-256 Audit Trail Cryptographic Seal

Binds IP address, user-agent, timestamp, and signature vector data into an immutable SHA-256 PDF audit certificate.

Cloudflare Worker & Recipient Backend Sequence

sequenceDiagram
    autonumber
    actor Recipient as External Recipient
    participant CF as Cloudflare Worker (punchcharlie-proxy)
    participant Edge as Supabase REST API
    participant Storage as Supabase Storage
    participant Backend as App Backend Server

    Recipient->>CF: GET /s/:shortCode
    CF->>Edge: Query document_packets short_code
    Edge-->>CF: Return Packet ID
    CF-->>Recipient: Redirect to /sign/:packetId
    Recipient->>CF: POST /api/esign/verify-passcode
    CF->>Edge: Validate Passcode against document_signers
    Edge-->>CF: Passcode Verified 200 OK
    CF->>Storage: Fetch PDF Blob via Service Key
    Storage-->>CF: Return PDF Bytes
    CF-->>Recipient: Stream PDF inline
    Recipient->>CF: POST /api/esign/finalize
    CF->>Backend: Proxy Finalize Payload
    Backend-->>CF: 200 OK Sealed PDF Created
    CF-->>Recipient: Render Audit Seal & Success Toast

Component Inventory Entry

Component	Type	Design System Token
Passcode Verification Form	Passcode Gate Card	components/feedback/35-login-variants.html
PDF Scroll Document Canvas	Scroll Container	components/layout/19-section-variants.html
Touch Signature Pad Canvas	Signature Drawer	components/feedback/29-modals.html
Audit Certificate Seal Badge	Status Stamp	components/feedback/26-badges.html

Public eSign Portal & Cloudflare Proxy punchcharlie-proxy

Page Visual Switcher

Public Recipient eSign Wireflow & Cloudflare Edge Routing

punchcharlie-proxy Cloudflare Worker Edge Topology

Recipient Security & Edge Worker Guardrails

Cloudflare Worker & Recipient Backend Sequence

Component Inventory Entry

Public eSign Portal & Cloudflare Proxy punchcharlie-proxy

Page Visual Switcher

Public Recipient eSign Wireflow & Cloudflare Edge Routing

punchcharlie-proxy Cloudflare Worker Edge Topology

Recipient Security & Edge Worker Guardrails

Cloudflare Worker & Recipient Backend Sequence

Component Inventory Entry

Public eSign Wireflow — Fullscreen View