Smakspor

There are four roles — consumer, owner, staff and admin — and they answer two different questions. Authentication asks whether I know who you are; authorization asks whether this particular row is yours. Conflating them is how a panel ends up showing one operator another operator's orders.

So the check happens twice, at different depths. The application decides what to render and which endpoints to expose. The database decides what may be read at all: Row Level Security policies in PostgreSQL sit under the queries, keyed to the authenticated user, so a request that slips past the application layer still returns nothing. A 401 means I do not know you. A 403 means I know you and the answer is still no.

Nothing the second time. Stripe does not promise exactly-once delivery, it promises at-least-once, so a payment handler that assumes a single call is a handler that eventually double-credits an order.

Two guards. The signature is verified before the body is trusted at all, because an unsigned endpoint that mutates payment state is an open endpoint. Then the handler is idempotent: the event identifier decides whether this is work to do or work already done, and a repeat is acknowledged and dropped rather than replayed.

Because the question the product asks is "who is near me, right now", and that is a spatial query, not an arithmetic one. Latitude and longitude in two columns turns every proximity search into a full scan with trigonometry bolted on top, and it cannot be indexed usefully.

PostGIS gives the geometry a real type, a spatial index, and distance operators the planner understands. The live map and the location search run on the same data the operator panel writes.

Google OAuth, or a one-time code by email. No password field anywhere, because a password field is a liability I would then have to defend — storage, reset flow, reuse, leak response — for a product whose users open it to find lunch.

Transactional email goes through Resend; Web Push carries the notifications people actually asked for by following a truck.

Playwright over the paths where failure is expensive: signing in, publishing a location, and checkout. These are end-to-end tests, so they catch the integration breaking, which is where this product actually breaks.

What I do not have is a broad unit suite. That is a real gap and it is on the site's own list of them.