Cross Campus
A verified student collaboration network for finding teammates, hackathon partners and research groups, launching at SRMIST.
- Status
- In progress
Built and tested locally; hosting, SMTP and Google OAuth are waiting on credentials
- Role
- Owner and developer: product scope, data model, authorization rules and the web app.
- Built with
- Next.js 16, React 19, TypeScript, Supabase, PostgreSQL, Row Level Security, Tailwind CSS, Vitest, Playwright, pgTAP
Repository is private
The problem
Students who want to build something rarely know who else on campus has the skills or the time. Cross Campus is a tool for finding the people who will actually build with you, not another social feed.
How it works
- Next.js 16 App Router with Server Components for data pages; Client Components only where there is interaction.
- Every database call goes through one service layer that takes an injected Supabase client, so the UI never imports the database directly.
- Authorization lives in Postgres: row-level security on every table, default-deny, and multi-table actions such as accepting a join request go through SECURITY DEFINER functions that re-check the caller.
- Students with an institution email are verified automatically by matching the domain, tested for srmist.edu.in.
- Direct messages and team chats use Supabase Realtime, which is filtered by the same RLS rules, so a client only receives rows it could read.
Decisions that mattered
- Authorization in the database, not the app
- It holds even if the UI is bypassed. The route proxy is a convenience, not the boundary.
- One backend provider
- The MVP already ran on Supabase with working RLS; a second backend would double the security surface for no user value.
- Discovery ranked by shared skills, no AI claims
- Cards say 'N skills in common', which is true and explainable.
Problems I had to solve
Proving a non-owner can't approve their own request
Join requests are accepted through a server-side function. An automated test signs in as a non-owner and confirms the approval is refused.
Realtime without leaking rows
Notifications moved from 45-second polling to Realtime subscriptions that respect RLS, with a catch-up fetch on reconnect.
What is verified, and what isn't
| Part | State |
|---|---|
| 28 pgTAP authorization tests and 50 unit tests passing; production build passes | Verified |
| Each end-to-end suite (privacy, collaboration, messaging) passed individually | Verified |
| Remote database migrated with all 7 migrations | Verified |
| Google OAuth sign-in (needs a Google Cloud OAuth client) | Blocked |
| Hosting, SMTP and the production redirect URLs | Blocked |
| Full-viewport walkthrough at 375, 768 and 1280 px | Built, not yet verified |
Taken from the project's own status documents.
Still unfinished
- Deploy to production and point Supabase redirect URLs at the real domain
- Configure SMTP so confirmation and reset emails deliver
- A real person's review of the privacy and terms pages