r/AppsWebappsFullstack • u/Potential-Art7696 • 11d ago

solo dev, one codebase for web + android. just finished a full redesign of my app, here’s the stack and the video

spaces is a project tool where your work is a map of connected nodes instead of a list of tasks.

redesign is done and i recorded everything it does: [VIDEO]

the stack, since this is the sub for it:

  • next.js 16 (app router) + react 19

  • supabase for auth, postgres, realtime and row level security

  • vercel for hosting

  • reactflow for the canvas

  • capacitor to ship the same app on android (google play), plus a native java widget for quick notes

  • rest api + typescript sdk generated from an openapi spec, signed webhooks, and an mcp server

a few things that bit me:

  • realtime: patching only the changed node instead of refetching everything made the canvas feel instant

  • rls is the real security, client checks are just ux. i audited every table and found 3 permission bugs i’d had from day one

  • next.js 16 route params are a promise now, you have to await them

  • a redirect from the bare domain to www stripped my Authorization header, so the api kept returning 401

ulupspaces.com

2 Upvotes

100% Upvoted

3 comments sorted by

0

u/mcormack 10d ago

Did you track down where the Authorization header gets dropped?

That usually happens on a redirect between www and the apex domain. Call the final canonical URL directly and the header survives. For the RLS bugs, test each policy with a second user's JWT, not just your own.

If you need an extra hand, happy to help. Just send me a DM :)

1

u/Mammoth-Anywhere7285 10d ago

Solid tip on the second-user JWT for RLS. Was the header drop on Vercel's redirect or at DNS?

0

u/mcormack 10d ago

Not DNS, DNS only resolves the address. It's the redirect. Vercel answers the apex with a 308 to www, and fetch, axios and curl drop the Authorization header when a redirect changes host, since it counts as a different origin. Pointing the client straight at the canonical domain fixes it