Property & Investment CRM Platform

Public enquiries have to insert a row into a system nobody outside the company may read. Adding a second database login would have meant another password, another connection string and another deployment secret. Instead there is a single function that runs with elevated rights and can touch exactly one table; no insert policy exists at all, so even an administrator cannot write a row directly. Rate limits are counted in the database, because separate serverless instances cannot share a counter.

PostgreSQL grants execute on a new function to PUBLIC by default. The migration that created the elevated-rights writer granted it to the application role but never revoked that default, which left anonymous visitors technically holding execute on it. Only a missing schema grant stood in the way. A follow-up migration revokes it, and the rule is now explicit: after creating a function that runs with elevated rights, revoke execute from PUBLIC in the same migration.

Converting an enquiry naturally wanted to create an opportunity, but the opportunity model requires one of four product lines and none of them described what the enquirer actually had. Rather than inventing a fifth value to make the flow complete, conversion creates a contact only. The gap is documented and waits for a real decision.