No-login magic links for field crews: hashed, scoped, revocable, and usable offline

Yardline facilitates the transition of a building supplier's materials to a contractor, with a crew lead on site confirming the delivery, noting any damages, and signing off. Typically, the crew lead possesses minimal signal strength and no desire to create an account. To streamline the process, Yardline provides a link that the crew can tap to see the delivery and mark it as received, without requiring a password, app installation, or sign-up.

This article focuses on securing this link, ensuring it remains safe for distribution via text message and functional even when the phone is offline. Key requirements for such a link include single-use, automatic expiration after a week, revocation by the office, and offline usability. The link is equivalent to a password transmitted in plain text through SMS threads, group chats, or forwarded screenshots.

Initial design considerations include limiting access to a single delivery, expiring automatically in seven days, the ability for the office to revoke the link at any time, non-replicability in the event of a database breach, and traceability of actions to the crew member using the link. To generate a secure link, the system creates a 32-byte random token using the operating system's random number generator, which is then hashed with SHA-256 and stored securely.

The link is issued to a temporary guest user with the 'crew_lead' role, bound to the contractor's account. Each action performed through the link is logged under 'Jobsite crew,' ensuring the office user responsible for the link is never held accountable for the crew's actions. The link's URL is configured to be excluded from search engine indexing.

Upon each request, the system re-verifies the token to ensure its validity, preventing unauthorized access.