These implementation notes describe my original Shatimi website, built with static HTML, CSS and JavaScript.
This portfolio keeps its public pages as static HTML, CSS and JavaScript. One Node.js Vercel function connects the community interface to Supabase Auth, PostgreSQL and private Storage. There is no frontend framework or browser-side service key.
Registration uses an email confirmation code. An unconfirmed account cannot enter the discussion or like comments. Session tokens stay in HttpOnly cookies; the server verifies the Supabase user before granting member actions. Owner permissions depend on a confirmed configured email, never editable user metadata.
Visitors can read posts and comments without receiving a database profile. A successful first guest comment creates a server-generated anonym name and a signed cookie. Replies reuse the same identity. Clearing that cookie creates a new identity, so moderation also has rate limits and an optional connection block.
The same comment records appear under posts and in the members-only discussion. PostgreSQL functions enforce thread boundaries, reply depth, ownership, mutes and bans. Browser roles cannot access community tables or service-only functions directly.
Avatar uploads are checked for file size and actual image format, decoded, cropped and re-encoded to WebP with metadata removed. A private bucket and a live profile check allow an owner to remove an image and block further uploads.
This is a small community implementation, not private messaging. It polls visible conversations instead of promising realtime delivery, and email confirmation proves access to an inbox rather than a legal identity. Integration tests use real isolated PostgreSQL with explicit fixtures for Auth and Storage.