Custom web applications

Permissions live in the database

In a multi-tenant platform the real question is not how the client list looks, but what happens the day a query forgets the company filter. If the check lives only in the code, that day one customer sees another customer's data and nobody notices.

So isolation goes into PostgreSQL as Row-Level Security policies, and the application connects with a role that has no BYPASSRLS. Code can be wrong; the database cannot. The permission becomes readable, revocable data instead of a branch scattered across thirty files.

Rendered on the server, state only where needed

Next.js App Router: pages arrive already drawn — which matters for SEO, because crawlers don't run JavaScript, and for perceived speed. The client only takes over the parts that genuinely need to react.

Preferences that change the very first pixel (menu open or closed, theme, language) live in cookies read by the server while rendering, not in localStorage: otherwise the first paint is always the wrong one and the page jumps on every load.

Multilingual without rebuilding the site

i18n with next-intl: clean URLs per language, reciprocal hreflang, content actually translated rather than Italian strings sitting under a different flag. When a translation is missing we decide explicitly whether to show the fallback or hide the page.