Day 4

While I had other errands for Wednesday, I added the post about the third day and had some issues fixed while doing so.

To my surprise, the image upload page suddenly stopped working. The original idea was an issue with authentication but even after making changes the issue persisted. But then I also noticed that if a post had an emoji as a title it didn't get an ID in the database which, in turn, broke the query that listed the posts the image could be attached to. As an interim solution these posts were skipped but I made a mental note to handle this properly later.

As a small change, images that were smaller than the default content width became un-stretched and retained their original width, centered.

Day 5

🧑🏻‍💼 Admin console

While for the small number of posts I imported manually editing the database was sufficient, it was time to rethink administration and create a proper MVP experience. I had a console made with tabs for listing posts, an editor to modify and add posts and integrated the image uploader as well. Lovable kindly updated the row-level security (RLS) policies for the tables for all these to work properly.

Sorting the blog posts by publication date also highlighted the need to modify the posts table slightly. Originally Lovable created a date field as well as a created_at field, the former being superfluous. (I suppose it made sense at the time based on the front matter content of the file I used as an example blog post.) So I did away with date and had every page use the created at timestamp, properly formatted.

⛓️ Post IDs and links

As I mentioned before, posts with emoji lacked a post ID so I attempted to fix that in the importer. The idea was to have posts with titles like 🎄 have an URL-encoded ID, in this case %f0%9f%8e%84. Fought a little battle to make sure that these posts get imported correctly, the capitalization is consistent and links work as intended.

Sorry, I'm a millennial, I like emoji.¹

📦 Mass import

By this point, I was satisfied with the state of the site enough to let the import script loose on all the more than 2,000 posts in the archives. It did stop a couple of times due to errors caused by either the post not having a title in the front matter or not having front matter at all, issues Jekyll used to kindly overlook, but otherwise sailed through perfectly.

Looking at the results, there are a couple of broken embeds and images. Some of these might not have worked with the previous tech stack either, to be honest, and there were known issues with old posts, anyway. A lot can happen in 23 years on the internet.

Suddenly having this many posts surprised Lovable a little — she didn't think about pagination having this many pages — resulting in a nice long overflowing series of numbers on the index page. While fixing this, I also had the functionality changed slightly so that URL parameters are used in order for the browsers' navigation buttons to work more consistently.²

Additionally, I ran into the 1,000-row default query limit of Supabase because the initial solution for the index page just tried to load all the posts at once. This was changed to a behavior where only the posts of the page shown are loaded at a time.

The admin console also needed some love to handle the increased number of posts: the post selector on the image upload page had to be converted to a combo box with search instead.

🔐 Security

Before publication, I was warned about some security issues. Lovable does offer a comprehensive security scan of the application looking at various areas, such as:

✅ Strong Authentication - Proper email/password auth with input validation using Zod schemas
✅ Role-Based Access Control - Admin functions protected via has_role() security definer function
✅ Comprehensive RLS Policies - All tables have appropriate row-level security
✅ Secure Edge Functions - Both edge functions verify authentication and admin roles
✅ Input Validation - Consistent use of Zod schemas and length checks
✅ No Client-Side Auth - All authorization checks happen server-side
✅ Secure Storage Upload - File type, size validation with proper authentication

Errors, warnings and information can be asked to be fixed right from the Security console very effectively. I also learned about the existence of Zod schemas.

🌍 Publication

The only thing left was to change the DNS record for the domain and wait for it to propagate. Now sesam.hu points to the new tech stack. 🎉

Footnotes

1. According to my research into AP style, "emoji" is still the accepted form in both singular and plural. This sounds to be in accordance with the Japanese language which does not have plural either. ↩

2. Even though recetly em-dashes are considered a dead giveaway for AI writing, this blog is still written by hand, word by word, by me. Check AP's editorial take on “the ChatGPT hyphen.” ↩