Code

PropertyOS is a private repository, so rather than link to a page only I can open, here are the files I would point at in a code review — each next to the case study that explains the decision behind it.

• The one place tenant isolation is decided

  apps/backend/src/modules/landlord_admin/helpers/resolveLandlordIdForActor.js

  Seventeen lines that every landlord-scoped query in the system passes through. A landlord admin's tenant is resolved from their own identity record and never accepted from request input.

• Blocking identity-sensitive actions while impersonating

  apps/backend/src/modules/landlord_admin/middlewares/blockDuringImpersonation.js

  Support staff can act on a customer's behalf, but cannot change that customer's MFA while wearing their identity. The line is drawn at credential and identity actions, not at everything.

• Closing a SQL injection vector that was never exploited

  apps/backend/src/modules/landlord_admin/helpers/buildUpdateQuery.js

  Values can be parameterised; column names cannot. A shared helper that was safe only by convention is now safe by construction.

• Enforcing a schema that is itself data

  apps/backend/src/modules/units/validateUnitAttributes.js

  Unit fields are defined per property type by the platform operator, not hardcoded. A flexible form is a UI convenience — this is what makes it a real schema.

• Wiring the whole application in one file

  apps/backend/src/container.js

  Every repo, service, controller and router is registered in one place and resolved by constructor parameter name. An excerpt — the real file is around 500 lines of the same pattern.