Full-Stack
FixFlow - QR Service Intake with 3-Tier RLS
A QR-based service intake app where security is enforced in the database itself, not just the UI.
The problem
A repair or service business wants customers to file a request by scanning a QR code, with zero friction and no account. But that same data must stay locked down: a customer must never see another customer's ticket, and a technician must only see the jobs assigned to them. Enforcing that only in application code is fragile, one missed check leaks data.
Approach
- Customers scan a per-location QR code and file a ticket anonymously; staff triage behind authentication.
- Access is enforced in Postgres with three-tier Row Level Security: anonymous can only create, technicians see only tickets assigned to them, admins see everything.
- Uses Supabase Auth, Storage for photo uploads, and an Edge Function to email staff on each new ticket.
- The security rules are covered by an integration test suite, so a policy regression fails the build.
What it proves
- Live demo deployed on Vercel with a hosted Supabase backend.
- Three-tier Row Level Security verified live against each role.
- Security policies covered by automated integration tests.