abdelkhaliq

Here’s what I actually built:

1. A tenant system where companies sign up and get their own private workspace instantly — teams, projects, tasks, all isolated from every other company on the platform

2. JWT authentication with two identity layers — who you are as a person, and which company you belong to — both encoded in every single request

3. An invitation system where owners generate shareable links with usage limits, and new members join directly into the right workspace without any manual setup

4. Subscription billing with Stripe — free plan, pro plan, enterprise plan with automatic workspace lockout when payment fails and instant feature unlock on upgrade

5. A plan enforcement layer that blocks operations at the service level before they hit the database — not just hiding buttons on a frontend

The hardest technical problem I solved was the circular foreign key between the users and tenants tables. A tenant needs to know its owner. A user needs to know their tenant. Neither can exist without the other. I solved it using SQLAlchemy’s db.flush() inside a single atomic transaction, getting the IDs back without committing, linking them, then committing everything at once or rolling it all back.

The most underrated thing I built was the Stripe webhook handler. Webhooks are deceptively hard — they arrive asynchronously, out of order, and your handler must be idempotent. I handled invoice.paid, payment_failed, and subscription.cancelled — each updating the database and locking or unlocking the workspace accordingly.

What I’d do differently:

I’d implement PostgreSQL Row-Level Security from day one instead of relying purely on application-level filtering. RLS enforces isolation at the database level — even a bug in your code can’t cause a data leak. I learned this too late in the build.