Architecture & Tech Decisions

Unlike purely frontend-driven applications, this system relies on a server-controlled data flow using Next.js Server Actions. All mutations and data fetching occur server-side, ensuring that no direct database logic is exposed to the client.

• Server Actions & Server-Only Mutations: All create, update, and delete operations are handled on the server to ensure secure mutations and prevent direct client manipulation.
• Relational Data Modeling: Structured relationships between users, children, and reports with enforced foreign keys and indexed columns for performance.
• Authentication: Supabase Auth with role metadata stored in JWT app_metadata. Sessions are intentionally configured as non-persistent, enforcing automatic logout when the browser is closed to reduce the risk of unauthorized access on shared devices.
• Authorization: Access control is enforced directly within PostgreSQL using Row Level Security (RLS) policies tied to JWT role metadata:
  • Parents to viewing only their child’s reports.
  • Caregivers to creating and managing reports.
• Styling & Responsiveness: Tailwind CSS enables a mobile-first, fully responsive interface across dashboards and reporting flows.