Tag adonisjs

Taking a real AdonisJS 7 and Inertia application from a push on master to a running production service - what `node ace build` produces, a two-stage Containerfile, Postgres and the app as Quadlet units, a CI pipeline that builds to GHCR and deploys over SSH, and the proxy detail that silently breaks rate limiting.

What I learned building UmimaClean - why frozen prices are the most important decision in the schema, how a conditional UPDATE stops two staff driving to the same address, why a payment webhook needs an escape hatch, and the parts I would build differently.

How an AdonisJS 7 application is actually assembled - providers and preloads, the two middleware stacks and why the order matters, constructor dependency injection with no container registration, subpath imports, and validated environment variables.

Building spreadsheet exports an owner actually uses - why numbers must be numbers, the UTC-components bug that shifts every date by a day, a generic sheet builder that erases its own type parameter, frozen headers and autofilters, and why the export must never stop at the current page.

The security layer in full - phone-number identity, why a signed-cookie session still has to be revocable, the passwordChangedAt trick, CSRF with a webhook exception, five rate limiters keyed on different things, private file storage with signed URLs, and the accounts that cannot be deleted.

The final part - three suites split by what each proves, asserting on Inertia props instead of parsing HTML, factories with states that name business situations, organising tests by role because that is what breaks, and an honest account of what is not covered.

Making validation composable and localised - a shared rule vocabulary, Indonesian messages registered once, a global transform that hands you Luxon dates, and the line between what a validator may know and what belongs in a service.

Generated model schemas, migrations as the source of truth, partial unique indexes that enforce what application code cannot, RESTRICT as a history-preservation strategy, transactions around multi-table writes, and the numeric-returns-a-string gotcha that shipped broken exports.

What it means to build a React app with no API - how Inertia visits work, shared props via middleware, flash messages and validation errors that arrive automatically, why SSR is configured but off, and the mobile app I gave up to get here.

The layer between a model and a page - variants that encode who may see what, why depth is a property of the resource, Tuyau turning route names into compile-time checks, and Inertia 2 forms that need no useState at all.

Why SSE beat WebSockets for a one-directional problem - how Transmit channels and authorisation work, the two channels this app has, why broadcasts carry stored values instead of labels, and what breaks when you run more than one process.

Integrating an Indonesian payment gateway properly - Core API versus Snap, why the Midtrans order id cannot be your order number, the SHA-512 webhook signature that is the whole security of the flow, mapping five gateway statuses onto four of your own, and the escape hatch for the callback that never arrives.

Building on WhatsApp because that is where the customers are - why there is no email field anywhere, the unofficial API trade-off, an endpoint that returns HTTP 200 to report failure, signed URLs that carry their own identity, and why reminders are sent by hand.

A tour of every library in a real production codebase and what each one actually cost - why AdonisJS over Express, Inertia instead of a REST API, Leaflet with Google tiles, Midtrans Core API over Snap, and the two data-type gotchas that broke my spreadsheet exports.