Project documents

Project Manager publishes a document to the portal: creates a document shares row pointing at the source document store file URL (workflow-dms, Project Billing Invoices, or a Project Management deliverable), picks the portal site + portal project, sets Category (Deliverable / Invoice / Contract / Report / Reference / Other) and requires acknowledgment. On Status: Published, the document-publish-notification workflow fires via the configured record event. A configured workflow service resolves every client user with portal user access to the portal project, record service bulk-creates an activity feed row plus per-recipient magic links rows with Purpose: Document view, and notification service notifies each recipient with the branded template and the magic-link deep-link. Client users click through, the magic-link auth handler resolves to the document viewer, the streamed download writes a document downloads row plus a client activities row with activity type: Document downloaded, and (when requires acknowledgment = true) the client confirms via an in-portal action that flips document download acknowledged: true.

Every fan-out workflow that needs a one-click email-to-portal entry generates a magic links row with a server-side-only Token, a Purpose enum, optional target table + target record deep-link, an issued at, and an expires at. The inbound URL handler resolves the Token server-side, validates Status: Active AND expires at > now, flips Status: Used immediately on first redemption, stamps used at + used from IP, writes a client activities row with activity type: Magic link redeemed, and redirects to the deep-link. The magic-link-expiry workflow runs hourly via the configured schedule, finds every magic links row where expires at < now AND Status = ‘Active’, and bulk-flips Status: Expired. Reissue is a Portal Manager action that generates a new row rather than extending the prior one.

Keep source files protected and generate a short-lived download only after an access check. A notification or download event does not supply an acknowledgment. Scheduled withdrawal and revoked membership apply to old links too. Portal sites, portal projects and client users establish separate tenant and project boundaries. Bind each external login to client user principal ID; shared email addresses and Account text do not grant membership. Effective access is the intersection of active site, active client user, active portal project and active portal user access. The role and grant must both permit the action. Every list, export, attachment, notification and direct API request rechecks this scope; hiding a card is insufficient. Magic link token stores only a one-way hash of a high-entropy token. Tokens are purpose, recipient, project, target and expiry bound, redeemed atomically once, and revoked on access removal. Opening an email link displays a confirmation page; link previews and GET requests cannot approve a decision. Approval action requires a verified session and an explicit confirmation POST with expected request revision. Tokens and signatures never appear in analytics, application logs or audit exports. Document shares file URL identifies a protected source; the backend obtains a short-lived scoped download URL only after access checks. Scheduled publication respects publish start and publish end; archived or hidden content remains unavailable through old links. Only published documents and updates create client activity-feed entries. Named recipients contains validated active recipients within the project. Thread parents and every reply inherit the exact same audience; notifications and mentions cannot widen it.

• My Project Documents (Client) — Find the published project documents available to the authenticated client.