Othman Real Estate
LiveMarketplace access control enforced at the database layer
My role
Designed and built the marketplace, including the RLS-based authorization model and Stripe subscription integration.
Frontend
Backend & data
Payments
Overview
A real estate marketplace with public property browsing, authenticated dashboards for listing owners, admin moderation tooling, and paid subscription plans that gate access to agent/agency features.
The problem
A real estate marketplace needs to let the public search listings freely while giving listing owners a private dashboard, giving admins moderation control, and gating premium features behind paid plans — all on one shared dataset, with authorization enforced consistently rather than through ad-hoc checks scattered across the app.
Requirements
Functional
- Public listing browsing with filters by city, property type, price, and search.
- Authenticated dashboard for creating, editing, and tracking the status of listings, and saving favorites.
- Admin panel for moderation, user management, and marketplace analytics.
- Stripe-based subscription checkout for Pro and Agency plans, with plan-based feature access.
Non-functional
- Authorization must be enforced at the database level, not only in the UI, for dashboard and admin routes.
- Public browsing should stay fast and usable without requiring an account.
System architecture
Supabase provides authentication and PostgreSQL, with row-level security policies enforcing who can read or write which rows — public listings are openly readable, while dashboard and admin data are restricted by policy. Stripe subscriptions gate access to Pro/Agency-only functionality on top of that.
Public visitors
Listing owners / agents
Public listing browser
Filter by city, type, price, search
Authenticated dashboard
Create, edit, track listings
Supabase Auth + RLS policies
PostgreSQL (Supabase)
Listings · users · saved properties
Stripe
Pro / Agency subscriptions
Admin panel
Moderation, analytics
Backend & data
Backend design
- Authorization enforced with Supabase row-level security policies on dashboard and admin routes.
- Stripe checkout integration for Pro/Agency subscription plans with plan-based feature gating.
Database design
- PostgreSQL (Supabase) schema for listings, users, saved properties, and subscription/plan state, protected by RLS policies.
Authentication & authorization
Supabase Auth for sign-in and session management, paired with PostgreSQL row-level security policies so authorization is enforced at the database layer for dashboard and admin routes.
Integrations
- Stripe for subscription checkout and plan-based access control.
Decisions & trade-offs
Decision
Supabase (Auth + Postgres + RLS) instead of a separate auth service and hand-written authorization checks.
Why
Row-level security enforces access control at the database layer, so authorization holds even if an application-level check is missed.
Decision
Stripe subscriptions for Pro/Agency plans instead of a custom billing system.
Why
Handles recurring billing, plan changes, and payment compliance without building that infrastructure from scratch.
Technical challenges
Making sure dashboard and admin data stay private without relying solely on UI-level checks.
Modeled access rules as PostgreSQL row-level security policies, so the database itself rejects unauthorized reads or writes regardless of the client.
Deployment & operations
Deployment
- Deployed on Vercel; live demo at real-estate-rust-omega.vercel.app.
Security
- Supabase Auth for session management.
- PostgreSQL row-level security policies restricting dashboard and admin data access.
- Plan-based access control gating Pro/Agency features.
Results
A deployed marketplace with public browsing, owner dashboards, admin moderation, and working Stripe subscription billing.