Loading…
← Engineering HandbookClient build
The Selves of Us
A premium digital literary magazine + podcast platform, explicitly anti-AI-generated-content, with a real-time multi-role editorial workflow.
View the product page- Data model
- 25 tables · RLS + policies on all 25 · 8 enums · 32 migrations
- Stack
- 12 technologies
- Provenance
- real build journals
The problem
Serve readers tired of algorithmic noise while supporting two opposed audiences in one codebase: fast public reader pages (SEO, archives, podcast) and a real-time, multi-role editorial admin. Every published piece must be human-written; AI assists, never authors.
.jpg&w=3840&q=75)
Architecture
How it’s wired
A container-level view of the real system, the boundaries, the trust edges, and where intelligence and money actually flow.
Reader pages are cached (ISR); admin reads are always fresh. The editorial thread between founder and editor runs over Supabase Realtime. AI assistants are isolated to the system prompt and cannot author publishable copy.
.jpg&w=3840&q=75)
By the numbers
25
tables · 32 migrations
48
API route handlers
7
live realtime surfaces
27
unit tests (vitest)
Stack
Next.js 15React 19TypeScriptSupabase (Postgres + Realtime)Anthropic ClaudeTiptap (custom InlineComment mark)Resend (svix-verified inbound)UpstashSentryRechartssanitize-htmlVitest + Playwright
Intelligence
Three named Anthropic Claude assistants (Sonnet 4.6), The Mirror (writing reflection), Keneilwe the Librarian (a live-archive reader guide), and the Editor’s Eye, all behind one shared HUMAN_VOICE prompt that bans the AI tells ("delve", "tapestry", "it’s not just X, it’s Y"); the same prompt quietly powers the Studio’s caption and repurpose tools. The machine can interrogate the writing; only a person can publish it.
Data model
25 tables · RLS + policies on all 25 · 8 enums · 32 migrations
- profiles (role: founder | editor | studio) → stories → {editorial_messages, story_versions, comments, mirrors}
- story_status enum: draft → pending → needs_edits → resubmitted → approved → published
- separate comments vs story_comments, subscriptions vs supporter_subscriptions, modelled, not conflated
- soft-delete (deleted_at) everywhere; newsletters append-only with a frozen subscriber_count at send
Key decisions
Why it’s built this way
Architecture Decision Records, the trade-offs made deliberately, in the open.
ADR-01
Three Supabase clients, and the middle one is a footgun
- Context
- Three access levels are needed: act-as-user, service, and true admin-bypass.
- Decision
- createClient (anon + cookies, RLS as the user); createServiceClient (service key but still forwards caller cookies, so @supabase/ssr re-attaches the user JWT and it runs RLS-bound); createAdminClient (service key, truly cookieless), used only after an explicit requireAdmin check.
- Consequence
- Privileged writes silently no-opped until the cookieless client was isolated, "the recurring lesson of this build."
ADR-02
MFA / AAL2 enforced at the edge
- Context
- Admin accounts guard a real, named publication.
- Decision
- Middleware calls getAuthenticatorAssuranceLevel() and redirects to /admin/mfa-verify when the required level is aal2 but the session isn’t, before any admin page renders.
- Consequence
- TOTP is enforced at the boundary, never trusted to a component.
ADR-03
The Librarian is a live-archive RAG, not a static bot
- Context
- A reader-guide must recommend real, current pieces.
- Decision
- Query published stories + episodes on each request, cache the built prompt block for 60s, cap at 250 stories / 100 episodes, and fail soft to the base prompt.
- Consequence
- Grounded recommendations that never invent a title, at bounded token cost.
ADR-04
Supabase over Firebase
- Context
- A deeply relational model (stories ↔ authors ↔ editorial messages ↔ comments).
- Decision
- Postgres with FKs/joins + RLS + built-in Realtime.
- Consequence
- Integrity at the DB level, no client-side join drift, no separate WebSocket service.
.jpg&w=3840&q=75)
The hard parts, solved
Where the engineering earned its keep
01
An anti-AI magazine that still runs on Claude
Resolved architecturally, not rhetorically: every model call sits behind Supabase auth + a role check, is constrained by the shared HUMAN_VOICE prompt to reflect and question rather than rewrite, and the Publish action is human-only. AI interrogates the writing; a person alone releases it.
02
RLS silently no-opping privileged writes
A service client that forwarded caller cookies ran under the user’s JWT and dropped writes with no error, root-caused and fixed with a truly cookieless admin client, plus hardened is_admin() / my_role() with a pinned search_path (migrations 024–027).
03
Inline editorial comments inside the prose
A custom Tiptap Mark extension (addComment / removeComment / resolveComment) anchors threaded founder↔editor comments to exact spans of a draft, powering the CommentSidebar live over Supabase Realtime.
Sourced from theselvesofus, ARCHITECTURE, BUILD-JOURNEY, RUNBOOK, DEPLOYMENT, HANDOVER-CHECKLIST.
.jpg&w=3840&q=75)
Keep exploring