Articles

PropertyOS Case Studies — Part 6

The session that a reload used to erase

The backend already had real, Redis-backed sessions with hashed rotating refresh tokens. None of that machinery mattered, because the only place a token lived was a JavaScript variable — and a page reload throws those away. Here's what moved, and why the fix wasn't 'add localStorage.'

PropertyOS Case Studies — Part 5

A form that doesn't know what it's asking

A studio apartment and a warehouse don't share a form. Rather than build a unit form per property type, PropertyOS lets HQLead define the schema itself — and renders whatever comes back. Here's the boundary between 'flexible' and 'a code review that never ends.'

PropertyOS Case Studies — Part 4

The bugs that only show up under load

Every module in PropertyOS had passed its own tests. None of that tells you what happens when a header is wrong, a connection never gets released, or ten people try to log in at once. Four real bugs, found by measuring instead of reading.

PropertyOS Case Studies — Part 3

Borrowing an identity safely: how HQLead impersonation works

HQLead needed to 'log in as' a landlord admin for support, without ever seeing their password, without weakening their session, and without leaving anything to a log line. Here's the full design — meant to be the template for every future 'act on someone else's behalf' feature, not a one-off.

PropertyOS Case Studies — Part 2

The property list that returns 404 instead of 403

Properties was the first module where a landlord admin queries a whole collection of their own records instead of just their own account. That's the first place tenant isolation could actually fail — here's how it's enforced, and what it still costs.

PropertyOS Case Studies — Part 1

The SaaS platform with no sign-up form

PropertyOS has no registration endpoint anywhere — not for the operator, not for landlords, not for anyone. That's the access model, and it decides the security model. It also moves the risk somewhere else rather than removing it, which is the part worth being honest about.

Why I added dependency injection to a project only I would ever touch

Awilix in a solo SaaS project sounds like over-engineering. Here's the reasoning that made it worth it — and what it cost.