This is an app I had wanted to create back when my own (now college-aged) kids were young and into play dates, and Mom and Dad could use more date nights. I was probably using old-school Facebook around that time, and as is described elsewhere on this website - looking to learn web-based programming.
This one was my first big Claude Code project, and I plan to someday try to get some real users - so it has its own documentation at playdatenight.app that I'll point you to.
How it is built (written by AI)
React on the front, Supabase — Postgres, Auth, Realtime — behind it. Two constraints shape the whole codebase:
src/db.jsis the only file that touches Supabase. Components import functions from it and never see the client. One file to audit when a query looks wrong.- Every table has Row Level Security on. The browser holds a real Postgres connection with the user's own privileges, so the database — not the UI — is where authorization lives. A malicious client gets exactly as far as its policies allow.
Anything that must be atomic or must bypass RLS — credit transfer, invite
redemption, match confirmation, leaving a ring — goes through a
SECURITY DEFINER PL/pgSQL function. Clients have no EXECUTE permission on
the credit functions at all, so credits, total_earned, and total_spent
are simply not writable from the browser. The column-level UPDATE grant on
families stops at cosmetic fields.
-- every policy in the schema is rooted in this one helper
create function my_family_id() returns uuid
language sql security definer stable as $$
select id from families where auth_user_id = auth.uid()
$$;
src/dataModel.js documents every entity as JSDoc typedefs. It is never
imported by runtime code — it exists so that one file explains what the data is.
Status
Still in testing. I haven't advertised it to the public yet and there is a short list of things that must land before it is:
- Invites are bearer tokens today — anyone with the link can redeem one. They need to be bound to a specific recipient email.
- Dev-admin operations are single-factor. They need an AAL2 / MFA check before strangers are in the system.
Both are fine for a friend-group beta where everyone knows everyone. Neither is fine for a public launch, so the public launch waits.