Milsaca
- STUDIO
- MILWEB
- TYPE
- DIGITAL PRODUCT
- STATUS
- IN DEVELOPMENT
02 / THE IDEA
Custom SaaS · multi-tenant platform
A whole sector ran improvised between spreadsheets and WhatsApp, with no single system.
01 / 01
Isolation by corretora_id enforced in the database, not the app. RLS on every table.
02 / 02
IN 8/2003 (MAPA) classification engine as a pure package, with PDF + public QR verification.
03 / 03
CEPEA, ICE NY Coffee C and PTAX (Brazil's central bank) synced via a scheduled edge function.
04 / 04
Next.js 16 and Expo Router sharing the same Supabase through a layered client package.
0102030404 / UNDER THE HOOD
01A Turborepo + pnpm monorepo with three fronts on one backend: Next.js 16 (App Router) for web, which alone covers three panels (producer, br…+
A Turborepo + pnpm monorepo with three fronts on one backend: Next.js 16 (App Router) for web, which alone covers three panels (producer, broker, and platform admin), and Expo Router for the producer's mobile app. Web and mobile talk to the same Supabase through a shared package (@milsaca/db) with three client layers: one with a session cookie for the server, one cookie-less (public key only) for cached routes, and one with secure-store for mobile.
02Multi-tenant for real, not just a "WHERE filter": every table in the public schema has Row Level Security enabled, no exceptions, with isola…+
Multi-tenant for real, not just a "WHERE filter": every table in the public schema has Row Level Security enabled, no exceptions, with isolation by corretora_id enforced in the database, not in the application layer. Roles (producer/broker/admin) live in an array on the profile table, letting the same email hold more than one role; the platform admin sits in its own table, outside the role enum, so a sloppy RLS policy can't accidentally leak it.
03The auth decision is a good example of learning from the product itself: it started with magic links and was switched to a 6-digit email OTP…+
The auth decision is a good example of learning from the product itself: it started with magic links and was switched to a 6-digit email OTP, because Gmail Safe Links auto-prefetches the link (to scan it for safety) and ends up "burning" the one-time token before the user even clicks. It's a subtle bug that only shows up in production, with real email providers.
04The domain differentiator is the COB classification (Brazilian MAPA regulation IN 8/2003): the logic for coffee type, defects, screen size a…+
The domain differentiator is the COB classification (Brazilian MAPA regulation IN 8/2003): the logic for coffee type, defects, screen size and cup quality was extracted into a pure package (@milsaca/cob), with no runtime dependencies, independently testable. The generated report ships as a PDF with a QR code and a public verification page, giving the producer something that today is done on paper or from memory.
BUILT WITH — Next.js · Expo · Supabase · PostgreSQL · TypeScript
06 / RESULT
ECOA
