05Client project
Polaris
A gym platform with portals for members, trainers and admins, with access rules enforced in the database.
- Tables in the Postgres schema
- 17
- Row-level security policies
- 54
- Portals: member, trainer and admin
- 3
/
/login
What I built
- Member, trainer and admin portals in one Next.js 16 app.
- A 17-table Postgres schema protected by 54 row-level security policies.
- Class booking with row locking and a waitlist.
- Hardened after an OWASP ZAP assessment.
Engineering notes
No promoting yourself
A trigger rejects any member update to role, membership or contract fields, whatever the client sends. Admin changes pass and are audited.
No overbooking
Booking goes through one function that locks the class session, so two members can never take the last spot.