Letter of Authorization Generator & Public QR-Scannable Verifier

Cross-connect coordination across multiple datacenters used to mean PDF emails, signature scans, and “do you have a real LoA for this carrier?” phone calls. RoutePulse turns LoA workflow into a one-click operation — and gives the receiving carrier a public QR-scannable verifier so they can confirm authenticity from a phone in 4 seconds, with no login, no registration, and no shared credentials.

Every generated LoA carries a 60×60 QR code in the PDF footer linking to routepulse.goline.ch/loa/verify/<code>. The receiving carrier scans, lands on a branded page rendered with a classical 22-petal wax-seal SVG — bordeaux CERTIFIED when valid, amber EXPIRED when past validity, anthracite INVALID when the code doesn’t match any record. The whole verifier is hardened with strict charset validation, rate-limit per IP, audit logging, and four coordinated layers of public-route treatment (AuthGate bypass, page overlay, Apache IP-whitelist exemption, TrpcProvider 401-exception) so external IPs hit a clean verifier and not the operator console.

One-click LoA generation

Operator picks datacenter (Equinix ZH2/ZH4/ZH5, MIX DC Caldera, Interxion, or custom), patch-panel port (live availability from Equinix Colocation API OAuth2), and requesting carrier (auto-fill via PeeringDB facility presence + RIPE WHOIS). PDF is built server-side with PDFKit, embedded GOLINE signature PNG, and the QR code linking to the public verifier — all in under 2 seconds.

Classical wax-seal verifier (status-aware)

Pure inline SVG generated at render time. 22-petal scallop outline (programmatically built with quadratic Bézier curves), concentric inner rings simulating an embossed pressed channel, 130° curved-text bands at top + bottom, central engraved label with feSpecularLighting bevel relief and feTurbulence wax grain. Status palette: bordeaux-red for CERTIFIED, amber-gold for EXPIRED, grey-anthracite for INVALID — and a triple drop-shadow plus -6° rotation give it the hand-pressed feel.

Defence-in-depth REST endpoint

Backed by /api/v1/loa/verify/:code with strict /^[A-F0-9]{8,64}$/ charset filter applied before any database query — SQL-injection probes are rejected at the perimeter, never touching Postgres. Rate-limit 30 req/min per client IP. Cache-Control no-store on every verdict. Audit log writes every invalid_code_format / not_found / rate_limit_exceeded with client IP + offending code. Drizzle ORM gives parameterised-statement immunity to SQL injection; React server-component rendering escapes all DB values for XSS safety.

Key Capabilities

• One-click LoA PDF with embedded GOLINE signature image and 60×60 QR code linking to public verifier
• Public verifier at routepulse.goline.ch/loa/verify/<code> — no authentication, no registration, no shared credentials
• Classical 22-petal scallop wax seal in three status-aware variants (bordeaux CERTIFIED / amber EXPIRED / anthracite INVALID)
• SVG feTurbulence (fractal noise wax grain) + feSpecularLighting (bombé engraved relief) + triple drop-shadow + -6° hand-pressed rotation
• 4-layer public-route hardening: AuthGate bypass, page full-screen overlay, Apache IP-whitelist exemption, TrpcProvider 401-reload exception
• Strict /^[A-F0-9]{8,64}$/ charset filter; 30 req/min/IP rate limit; Cache-Control: no-store; full audit log of probing attempts
• Equinix Colocation API OAuth2 integration for live patch-panel port availability across all GOLINE datacenters
• 27 datacenter presets auto-populated from PeeringDB; carrier search with debounce 300 ms hitting local pdb_facilities Postgres mirror
• Per-LoA expiry tracking: the wax seal automatically switches palette and label when the expiry date is crossed
• Drizzle ORM parameter-safe SQL queries; React SSR HTML-escaping of all DB-derived content for SQL-injection + XSS immunity
• 5,000+ words of operator runbook in docs/97-ISP-MANAGER-INTEGRATION.md covering the public-route 4-layer architecture, REST hardening, and seal design rationale

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →