Mohammad TahaProperty Tricity Live
Real estate media platform for the Chandigarh Tricity
A regional property media platform: builder video interviews, news, ground reports and locality guides across six fixed desks. Role-based admin with 22 permissions and a super admin, a CMS-style publishing flow, and a Postgres-backed content layer.
- Built with
- Next.jsTypeScriptPrismaPostgreSQL (Neon)Cloudflare TurnstileDockerVitestRender
- Type
- Client & collaborative work
- Source
- Private client repository
How it decides
Draft → reviewed → published
- person
- guesses / untrusted
- decides
- process
- storage
- third party
- trust boundary
Boundary Where guessing stops and something deterministic decides.
- Only roles with the publish permission can publish, unpublish or edit live content. repo docs
- A market figure is labelled “Illustrative” until it has a source. repo docs
- Every change is written to the audit log. repo docs
The drawing, in words
Property Tricity Live: Draft → reviewed → published. Left of the redline is “Unreviewed content”; right of it is “Permission-checked”.
- Reporter — or editor (Unreviewed content)
- Draft story — draft → in review (Unreviewed content)
- Market reading — avg ₹ / sq ft (Unreviewed content)
- Sign-in attempt — email + password (Unreviewed content)
- Login throttle — no parallel bypass (Permission-checked)
- Role check — 22 permissions (Permission-checked)
- Source rule — unsourced → labelled (Permission-checked)
- Published page — cached 60 s (Permission-checked)
- PostgreSQL — Neon · Prisma (Permission-checked)
- Audit log — every change (Permission-checked)
Connections
- Reporter → Draft story
- Draft story → Role check (submit)
- Role check → Published page (publish)
- Market reading → Source rule
- Source rule → PostgreSQL
- Role check → Audit log
- Reporter → Sign-in attempt
- Sign-in attempt → Login throttle
More screens
The problem
- A newsroom with reporters, editors and owners needs drafts to stay drafts until someone allowed to publish says so — and needs every change on record. repo docs
What was built
- Six fixed area desks, interviews with chapters and transcripts, news and local guides. repo docs
- Editing flow draft → in review → published → archived, with an audit log of every change. repo docs
- Market Watch readings per desk, labelled “Illustrative” until a source is attached. repo docs
My part
- Hardened auth, server actions and security headers. commits
- Wrote the Vitest suite for permissions, schemas and helpers. commits
- Fixed the login throttle so parallel requests couldn't bypass it and the owner couldn't be locked out. commits
- Added shared SEO metadata and JSON-LD to every public page; accessibility pass on contrast, landmarks and focus after errors. commits
Limits and open work
- Not built yet: image upload to R2, draft previews, scheduled publishing, emailed set-password links, revocable database sessions. repo docs
Decisions worth knowing
Publishing is a permission, not a button
Only roles with the publish permission can publish, unpublish, edit something already live, or put a story on the homepage. The last active super admin can't be removed.
repo docs
Numbers carry their status
A market figure stays labelled “Illustrative” until a source is attached to it.
repo docs
Node host over Workers
Pages built on Cache Components hung in a local Workers test, so the site runs on a Node host (Render) instead.
repo docs
A closer look
- CHD Chandigarh
- MOH Mohali
- KHR Kharar & Kurali
- NCH New Chandigarh
- PKL Panchkula
- ZRK Zirakpur & Derabassi