Title: Rebind front-end update: I gave permissions a personality
Quick confession before the update: I spent a week making sure a "guest" role literally cannot break anything, and somehow that felt more satisfying than any feature I've shipped this year. Anyway. Here's what changed.
Stack's still the same overachiever lineup: React 19 + TypeScript, Vite, Tailwind v4, shadcn/ui, TanStack Query, Zustand, Playwright watching everything like a disappointed parent.
Role-based access control, or: teaching the app to say "no." The original design had a portal switcher with zero actual security — anyone could just click their way into being a VC. Bold strategy, but not great for a fintech app. So I built a real permission system: five roles, one policy table, and every route and button now checks in with it before doing anything spicy.
export const ROLE_POLICIES: Record = { admin: { label: 'Administrator', portals: ['founder', 'vc', 'admin'], canMutate: true }, founder: { label: 'Founder', portals: ['founder'], canMutate: true }, user: { label: 'Team Member', portals: ['founder'], canMutate: false }, vc: { label: 'VC Partner', portals: ['vc'], canMutate: true }, guest: { label: 'Guest', portals: ['founder'], canMutate: false }, } Twenty lines of code, and now a "Team Member" can look at the dashboard all they want but can't touch the "Execute Transfer" button no matter how hard they click it. I tested this personally. Repeatedly. It never worked. Beautiful.
Six environments, because one was never going to be enough. Dev, qa, qa2, uat, uat2, production — each with its own config, all from the same codebase. Yes, qa2 exists. No, I don't know what happened to qa1's dignity. It's just called qa now. qa2 is the sequel nobody asked for but everybody needed.
The Great Icon Diet. Turns out Google's icon font wanted 3.96MB of my users' data just to draw some outlines. I said absolutely not, swapped in lucide-react behind a translation layer, and the app lost weight without losing a single icon. If only real diets worked by just changing the label on the box.
Feature folders, because chaos is not a personality trait. Treasury, portfolio, review, documents, admin, onboarding, settings — each one gets its own tidy little home instead of living in one 4,000-line file that only I understood and only on days I'd had coffee.
10 Playwright suites, aka 10 tiny robots whose entire job is to distrust me. They click every button, try every role, and file a complaint the moment something's off. Genuinely the most judgmental teammates I've ever had, and also the most useful.
What's next: expanding the review queue and document lineage views, and probably renaming something else "v2" out of habit.
Curious what breaks first when you try to log in as a guest and mash every button — go ahead, I dare you. Drop your role-based chaos stories in the comments.
Log in or sign up for Devpost to join the conversation.