- Deny-by-default data access with application and PostgreSQL enforcement layers.
- Repeatable local database rebuilds and generated TypeScript contracts.
- Automated lint, types, tests, builds, browser smoke checks, database checks, audits, and previews.
PostgreSQL RLSSupabase AuthCI/CDPlaywright
Secure SaaS Foundation
A reusable application foundation that aligns server authorization, database policies, quality gates, and bilingual interfaces.
- Year
- 2026
- Status
- Production-oriented foundation
The challenge
Create secure defaults that remain productive for feature work and prove that client-side visibility never substitutes for authorization.
The approach
- 1
Modeled roles, enrollments, course access, progress, audit, contact, and newsletter data through reviewed SQL migrations.
- 2
Forced RLS on exposed tables and verified owner, cross-user, expired, revoked, public, and administrative cases with pgTAP.
- 3
Added cookie session refresh, server principal resolution, role guards, environment validation, CI, and deployment checks.