Pokuty, a team fines tracker

The problem

An amateur team needed one shared place to record fines, see who owes what and mark fines as paid, without making every player create an account.

The approach

The database decides who can do what, not the screen. Visitors can read four tables and nothing else. Every change is re-checked on the server. Fines keep the amount they had when issued, so editing the price list never rewrites history, and nothing is hard-deleted.

What was built

A Czech-language dashboard with fines, players, a price list and an admin area. Admins sign in with e-mail and password.

Proof points

• Postgres row-level security is the real gate: the public role can read four tables and can never insert, update or delete.
• Every admin action re-checks the admin’s rights on the server, even if the screen hides the button.
• Fines snapshot their amount when issued. Players deactivate, fine types archive and fines are voided, so nothing is lost.
• Covered by unit tests, tests against the live database’s security rules, and browser tests at two screen sizes.

Built with