Loading…
← Engineering HandbookPartner venture
True Access
South Africa’s first community accessibility-mapping platform, disabled people discover and rate accessible spaces; businesses get SANS 10400-S compliance scoring. One codebase for iOS, Android and Web.
View the product page- Data model
- 19 tables · PostGIS · 8 migrations · 13 RPCs
- Stack
- 11 technologies
- Provenance
- real build journals
The problem
4.2M South Africans live with disability and can’t safely survey a venue before an expensive, unreliable trip. SANS 10400-S mandates accessible buildings, but no platform aggregates real-world SA accessibility data.
.jpg&w=3840&q=75)
Architecture
How it’s wired
A container-level view of the real system, the boundaries, the trust edges, and where intelligence and money actually flow.
Supabase + PostGIS is the source of truth for locations; an Edge Function publishes verified locations to Mapbox as visual tiles. Payment truth arrives via an HMAC-SHA512-verified Paystack webhook. A 50/50 co-venture.
.jpg&w=3840&q=75)
By the numbers
1
codebase, 3 platforms
0–100
SANS score · 17 checks
6
Deno Edge Functions
19
tables · 13 RPCs
Stack
Expo SDK 52 (Expo Router)React Native 0.76 (React 18.3)TypeScriptNativeWindSupabase (Postgres + PostGIS + Edge Functions)TanStack QueryZustandMapbox, @rnmapbox/maps (native) · CDN Mapbox GL JS (web)@gorhom/bottom-sheetexpo-secure-storePaystack
Intelligence
No AI in production, listed only on the future roadmap, so it is never claimed as a current capability.
Data model
19 tables · PostGIS · 8 migrations · 13 RPCs
- locations, PostGIS GIST index on geography(Point), compliance_score CHECK 0–100, mapbox_feature_id; partial indexes WHERE deleted_at IS NULL
- accessibility_features, the SANS 10400-S:2011 checklist: 11 required ×10 + 6 optional ×5 (MAX 140), each row citing a clause like cl.5.1
- consents, POPIA §26 special-personal-info: versioned, per-type (disability_data / marketing / analytics), revocable
- role locked to RPC-only writes; reviews UNIQUE(location_id, user_id); soft-delete via deleted_at throughout
Key decisions
Why it’s built this way
Architecture Decision Records, the trade-offs made deliberately, in the open.
ADR-01
Supabase is the source of truth; Mapbox is downstream
- Context
- The location data is the core monetizable asset, not something to rent from a map vendor.
- Decision
- Own the data in Postgres + PostGIS; on approval an Edge Function upserts one GeoJSON feature to Mapbox Datasets and writes back mapbox_feature_id (no-op if creds absent, never blocking approval). A separate role-scoped data-export API returns GeoJSON, admin=all, business=own, user=verified-only.
- Consequence
- Spatial queries plus a licensable export the platform fully controls.
ADR-02
Separation of duties enforced in the database
- Context
- An auditor must never be able to approve their own audit.
- Decision
- Approval is a single SECURITY DEFINER transaction, admin_review_audit(), guarded by is_admin(), it enforces the state machine and derives locations.features from the checklist JSONB; RLS separately forbids an auditor from setting status=approved or verified=true directly.
- Consequence
- The trust boundary lives in Postgres, not in the UI.
ADR-03
A weighted, clause-cited SANS 10400-S score
- Context
- A legally-defensible accessibility metric is needed.
- Decision
- 11 required features ×10 + 6 optional ×5 (max 140), scaled and clamped to 0–100, each item citing a SANS 10400-S:2011 clause (cl.4.1–cl.8.3).
- Consequence
- Scores double as defensible documentation and drive the compliance-products funnel.
ADR-04
A seeded audit backlog as a product mechanic
- Context
- A community map is empty on day one.
- Decision
- ~27 real Buffalo City / kuGompo City public venues are inserted UNVERIFIED (score 0) to form the auditor backlog; an approved SANS audit flips them to verified and publicly visible, unverified pins render brand-blue, verified pins compliance-colored.
- Consequence
- The map is useful from launch, and verification is a visible, earnable state.
.jpg&w=3840&q=75)
The hard parts, solved
Where the engineering earned its keep
01
Two renderers, one contract, against a bundler that refuses Mapbox
Neither npm Mapbox path survives Metro (mapbox-gl uses import(variable), which Metro’s web transform rejects; react-map-gl drags it in). So Metro file-extension resolution picks MapView.native.tsx (@rnmapbox/maps v10) or MapView.web.tsx, CDN-loaded Mapbox GL JS v3.8.0 driven imperatively, pins painted on a canvas, both mirroring one cluster spec, behind a single MapViewProps contract.
02
RLS that infinitely recursed, and signups that 500’d
An "admin can read all" policy tested admin-ness with EXISTS(SELECT FROM profiles…) inside a profiles policy → Postgres 42P17 recursion on every authenticated read; and handle_new_user lacked SET search_path, so 100% of signups returned 500. Both closed with SECURITY DEFINER is_admin()/is_staff() helpers, caught only by testing live as each real role.
03
Privilege escalation closed on a mutable role column
The "own row" update policy let any user set their own role=admin. Because authenticated held table-level UPDATE, a bare REVOKE UPDATE(role) was a no-op, so the grant was dropped and re-granted on every column except role, forcing all role changes through guarded RPCs.
Sourced from TrueAccApp, .claude/ARCHITECTURE, SCHEMA, BUSINESS, BUILD_PHASES, PRODUCTION_READINESS, supabase/migrations 001–008.
.jpg&w=3840&q=75)
Keep exploring