01
Public request intake
Step 01A visitor submits a Network request through a public-safe form designed for people, projects, services, small businesses, creative work, and useful introductions.
Workflow Case Study
A governed intake workflow for public-safe Network requests.
This case study shows how a public Network request becomes a controlled review process. A person submits a request, the site checks it, stores it as pending, notifies the reviewer, tracks the decision, and only publishes approved public-safe details.
Status
Built workflow
Route
/network/request/
Admin
Access protected
Storage
Cloudflare D1
Problem
A public form needs guardrails before people can trust it.
The Network page needed a way to collect useful introductions and public-safe requests without allowing spam, unsafe content, private contact details, or unreviewed submissions to appear on the public site.
Design Goals
Protect public submissions
Validate data server-side
Store requests for review
Keep publishing manual
Display only public-safe fields
Track notes and decisions
Make workflow metrics visible
Notify the reviewer when a new request arrives
Confirm receipt clearly for the submitter
Workflow
From request to review to public-safe output.
This pattern turns a simple request form into a governed workflow with clear control points, private review, and public-safe output.
02
Validation and bot protection
Step 02Cloudflare Turnstile helps protect the form from bots, while server-side checks validate required fields, categories, email format, HTTPS links, size limits, and honeypot activity.
03
Pending request storage
Step 03Validated submissions are stored in Cloudflare D1 with a pending status. Nothing is published automatically.
04
Admin review dashboard
Step 04A private review dashboard shows pending, approved, rejected, and published requests with category metrics, review notes, status actions, and masked contact details.
05
Audit history
Step 05Request creation, note saves, and status changes are written to an audit table so review decisions remain visible over time.
06
Public-safe publishing path
Step 06Published requests are made available to the public Network page while review emails, notes, and audit records remain private.
07
Notification and confirmation
Step 07A Resend notification email is sent to the admin when a new request is stored, while the submitter sees a confirmation dialog explaining that the request was received for review and nothing was published automatically.
Process Chart
Security controls at each step.
This turns the request flow into more than a form. Each step adds a control: collect only what is needed, check the request, limit access, track decisions, and publish only safe public details.
01
Submit
Controlled intake
Public form collects only the fields needed for review.
02
Validate
Trust but verify
Server-side checks enforce required fields, categories, email format, HTTPS links, size limits, honeypot checks, and Turnstile verification.
03
Store
Default to pending
Validated requests are written to D1 as pending so user-submitted content never publishes automatically.
04
Notify
Operational visibility
A formatted admin email creates a clear review signal with a stable dashboard link.
05
Review
Least privilege and separation
Admin review stays behind Cloudflare Access, while contact details, notes, and audit records remain private.
06
Audit
Traceability
Request creation, note saves, and status changes are recorded so decisions are explainable over time.
07
Publish
Least data exposure
Only reviewed, published, public-safe fields are exposed through the public Network page.
Workflow Screenshots
A visual path from submission to public-safe output.
These screenshots use demo data to show the full lifecycle without exposing private review details or real submitter information.
Public Intake
Public intake form
Acknowledgment
Submitter confirmation
Notification
Admin email notification
Private Review
Pending admin review
Governance
Audit trail after review action
Published Output
Public-safe Network card
Security Controls
Checks before anything is saved.
Cloudflare Turnstile bot protection
Server-side validation in a Pages Function
Category allowlist
Required field checks
Email format validation
HTTPS-only public link validation
Request body size limit
Honeypot field
Request saved only after validation passes
Manual review before publishing
Cloudflare Access protection for admin routes and dev previews
Data Model
Current request status plus review history.
network_requests
Stores the current request state, including status, public-safe details, review email, latest note, and submitted timestamp.
network_request_audit
Stores historical workflow events such as request_created, note_saved, and status_changed with previous status, new status, timestamp, actor, and note details.
Access Protection
Admin review stays private.
The admin dashboard and development preview routes are protected with Cloudflare Access. Public visitors can still view the Network page and request form, while private review workflows remain restricted.
Protected admin route group
Admin dashboard requires Access login
Development preview protected by Access policy
Public Network page remains separate
Public request form remains separate
Policy limited to approved admin email
Notification Workflow
New requests send a clear review alert.
After a request is validated, stored, and audited, a non-blocking Resend email notification alerts the admin that a new request is waiting. The email includes request details, workflow status, and a stable dashboard link back to the protected admin review page.
Resend transactional email notification
Verified sender: [email protected]
Notification sent after D1 storage succeeds
Stable protected dashboard link
Email failure does not block request receipt
Success dialog confirms review-only submission
Cloudflare Email Routing forwards domain mail
Admin Dashboard
A private dashboard for review decisions.
The private dashboard shows what is waiting for review, what has been approved or rejected, and what has been marked for publication. Review notes and audit history help explain how a request moved through the workflow, while published requests feed public-safe cards on the Network page.
Total, pending, approved, rejected, and published counts
Oldest pending request visibility
Top submitted category
Status-based filtering
Masked review emails by default
Internal review notes
Status action buttons
Audit history timeline per request
Published requests appear as public-safe Network cards
Formatted admin email notification with dashboard link
What This Demonstrates
A small feature built like a governed workflow.
Secure intake design
Server-side validation
Database-backed workflow state
Audit logging
Admin review operations
Public-safe publishing controls
Separation of public data from internal review data
Protected administrative access for private review workflows
Non-blocking email notification with stable admin dashboard link
Submitter confirmation dialog after successful request receipt
Technology
Next.jsTypeScriptCloudflare PagesCloudflare Pages FunctionsCloudflare TurnstileCloudflare D1Cloudflare AccessCloudflare Email RoutingResendWranglerGitHub
Workflow Summary
The core lifecycle connects public request intake, D1 storage, audit history, admin review, email notification, submitter confirmation, published status, and public-safe Network card display.
Public-Safe Output
Published does not mean everything becomes public.
The public Network page only receives approved display fields. Internal review data stays behind the admin workflow.
Name or project title
Category
Public-safe description
Open-to summary
Approved public link
No review email, notes, or audit trail
Related Work
See the workflow in context.
The project case study connects to the live Network page, request form, and dashboard view of workflow metrics.