← All projects

Web Applications · Security-minded design

Repair Ticket Tracking Portal

A public status page for repair customers that exposes one ticket at a time and nothing else.

Status
Prototype
Year
2026
Role
Designer and developer
Client
Shared with permission

01

Overview

A separate public app, deployed on its own, that reads from the shop's Supabase project through one SECURITY DEFINER Postgres function. It needs an exact ticket number or phone match and returns only customer-safe fields.

  • React
  • TypeScript
  • Vite
  • Tailwind CSS
  • Supabase

02

The challenge

Customers want to check their repair without calling, but opening the shop database to the public would expose every customer's data.

  • Giving customers useful status without leaking anyone else's data

03

System requirements

  • Look up a repair by ticket number or phone number
  • Returns no internal notes, no other customers' details and no financial breakdown
  • Separate repository and deployment from the staff app, so staff code never ships to public traffic
  • Static build that can sit on any host or subdomain

04

Solution architecture

Responsibility

Public tracking page

A static Vite build where customers enter a ticket number or phone number.

05

Implementation

  • Public tracking page where a customer enters a ticket number and the phone number used at drop-off. No ticket data is shown.
    Public tracking page where a customer enters a ticket number and the phone number used at drop-off. No ticket data is shown.

06

Technical decisions

  • Expose one database function instead of granting the public role SELECT on the table, because row-level security applies per role, not per query
  • To add a field, extend the function rather than widening table access
  • Keep the public app in its own repository and deployment

07

Results and validation

Content needed: measured results with period and method. Never estimated.

Evidence

  • Design rationale and setup are documented in a private repository README

08

Lessons learned

Content needed: what you would do differently

Content checklist (remove once filled)

  • Whether it is live, and its URL
  • Permission to name the shop
  • Any usage results, only with a period and method

09

Related work

Project 12 of 12