Four problems you inherit the moment your SQL client runs on a server

A desktop database client makes two demands nobody writes down: every laptop has to reach the production network, and every laptop has to hold a copy of every credential. Move the client onto a server next to the data and both demands disappear. The credential lives in one place instead of sixty. The network path becomes a deployment topology instead of a VPN grant per person. That is the trade. This post is the invoice. Because the thing you just built is no longer a client. It is a multi-tenant network service holding every database connection your team owns, and it has four problems a desktop app never had. We hit all four building LibreDB Studio, and got two of them wrong on the first attempt. 1. The trust boundary moves inside your own process On a laptop the OS user is the authorization boundary. Server-side, one process holds every connection, and something inside it has to decide who is asking. The obvious answer is middleware: run before every route, verify the session cookie, redirect the rest. We have that. The part worth saying out loud is that it is not the boundary. Look at what a Next.js matcher actually is: export const config = { matcher : [ " /((?!api/storage/config|_next/static|_next/image|.* \\ ..*).*) " ], }; That .*\..* exempts any path containing a dot. It is there so static assets skip the pipeline, and it is a perfectly good optimisation. It is a terrible boundary. So every route that reaches a database or a model provider verifies its own caller again through one shared guard. The edge exists to make the common case cheap, not to be trusted. That distinction paid off the first time we designed a seam where something legitimate could not present a session. Our agent runtime has a callback that asks the server to resume a long-running query session. Its caller is a durable transport, not a person, so it has no cookie by construction. Nothing mints one in production yet, because no queue produces a drive delivery so far, and the credential exi