Nov 2025 - Present Solo build: design, code, database
Star Galaxy
A Star Wars galaxy map and community site for the TNIO gaming group: a shared 3D map that admins edit live, a news section, and access rules enforced in the database rather than the browser.
Star Galaxy is the site behind AlphaSec United, a Star Wars fan project I built for the TNIO gaming community. At its center is a 3D map of the Old Republic galaxy, with planets, fleets, faction control and a timeline that the community's admins edit and members with map access explore. Around it sit a public landing page, a news section with a rich-text editor, likes and comments, a feedback form, and admin tools for users, roles and an audit log. I wrote 275 of the repo's 276 commits, from the React front end and the Three.js scene to the Supabase database, its row-level security policies and its one server-side function.
A galaxy map people edit together
The map is a React Three Fiber scene. Planets are drawn by custom shaders instead of image textures, and so are the starfield, the nebula and the spiral arms. Ship models load as GLTF files, and civilian traffic flies curved routes between systems so the galaxy looks lived in. Admins place fleets, edit planets, set each faction's share of control and move the timeline year, and a guided tour walks new members through it all.
Several admins edit the same map, so it listens for changes over Supabase Realtime. When I checked that path in August, no events were arriving: the tables had never been added to Supabase's realtime publication, so two editors could overwrite each other without either one noticing. I added them and changed the map to apply each changed row in place instead of reloading the whole galaxy. That also keeps any edits a user has not saved yet.
Access enforced in the database
Members sign in with email and password or with Google, through Supabase Auth using the PKCE flow. Every account has one of four roles: a basic user, a galaxy user with map access, an admin, and the owner. The front end hides pages a role cannot use, but the real check is row-level security on every table. Only galaxy users and above can read map data, only admins can change it, and only the owner can publish articles.
Roles cannot be edited directly. A trigger blocks writes to the role and email columns, and the only way to change a role is a database function. It refuses changes to your own account, lets admins grant only the two lower roles, and writes every change to the audit log. A scheduled job deletes audit entries after 14 days.
Trusting nothing from the browser
The smaller features follow the same rule. Article HTML from the editor is checked against an allowlist of tags before it is shown. Article images go to a storage bucket that accepts only GIF, JPEG, PNG and WebP files up to 10 MB. The feedback form's user is set by a database trigger from the signed-in session, not taken from the request, and messages are trimmed and capped at 2,000 characters.
The only code that holds a server key is one Supabase Edge Function, which deletes an account. It accepts requests only from the site's own addresses, checks the caller's token, and clears that user's data before deleting them. Every page also gets security headers, including a content security policy, HSTS and a ban on being framed by other sites.