Veynity

A platform where a company signs itself up is a platform where strangers create accounts all day. The safe version of that is not a longer checklist on each page. It is an account that can do nothing until a person with the authority decides otherwise.

So a new account is pending, and one line in one function refuses a pending session. Every guard, admin and owner route sits behind that function, which makes it a property of one place rather than something each new page has to remember. The only two screens a pending account reaches are its own waiting screen and a single document upload. Everything else returns the same 404 a stranger would get.

Two smaller rules do the rest. A worker whose identity document is already on record is admitted straight away with a badge; without one they wait in a review queue. And a company can ask for its worker to be let into a society but cannot approve it, because the company is not the party taking the risk.

• Pending is the default, and it is refused in exactly one place
• An owner is deliberately not let through the company and worker guards
• An empty scope on a scoped query is how one company reads another's staff

Two rules hold this up. A visitor's phone number never appears anywhere you can reach without being a guard or an admin, and every query only ever sees one society. Both are the kind of rule that holds for months and then quietly breaks in one new function written in a hurry.

So neither one relies on anybody remembering. SQL is only allowed to exist in one folder, and every function in it takes the society as its first argument and refuses to run without one. The thing that writes events rejects any payload containing ten digits in a row, and it throws rather than quietly stripping it out, because silently cleaning up would hide the mistake that put a phone number there.

The same instinct runs through what each person is shown. A guard sees the kind of identity card and its last four digits, never the document. The console releases a flat's phone number only after the guard has recorded that the driver did not answer. And a tag that does not exist and a tag nobody has assigned return the same response, so the page cannot be used to work out which tokens are real.

• Society id is the first parameter of every repository call
• A phone number in an event payload is a thrown error, not a redaction
• Documents sit under a random key and are served private, no-store

Most systems fall over in whatever order the code happens to break. This one has a written ladder, and the rule is that nothing further down may take out anything above it.

So the printed tag carries the gate's phone number for the case where none of the software is running. A four character code is printed large, for when the camera will not read the QR. Every page except the photograph works with JavaScript switched off. If the document store is unreachable the report still files and quietly goes without a picture, because a report with no photo is worth enormously more than no report. With no flat list the flat becomes a free text box. With no phone number the report still opens and the console says to use the flat instead.

Wheelness sits at the bottom of that ladder on purpose. If it cannot be reached, every gate page is untouched and only the cleaning pages change, and they say which of the four possible reasons it is rather than showing an empty list. There is a test that serves those screens against a dead Wheelness and expects them to load.

• The required path: scan, report recorded, guard console shows it
• Photograph upload can fail without failing the report
• English, Hindi and Kannada on every visitor page and printed tag