Sekou Diarra

In Java, a lease id and a property id are both a UUID, and nothing stops one from landing where the other belongs. Sekou wrote an entity_id! proc macro that generates a newtype per entity, with SQLx Encode and Decode emitted only under the server feature, so the WASM build never pulls in SQLx. Money stopped being f64 and became a MonetaryAmount over Decimal, decoded straight from Postgres numeric.

Lease, payment, and maintenance statuses are enums deriving sqlx::Type, mirroring the CHECK constraints in the schema and matched exhaustively instead of string-compared. Expiring was removed from LeaseStatus on purpose: it is not a stored state but a function of the end date and today, so it became an is_expiring() method. Property status (vacant, occupied, late) is computed by a SQL CASE and cast directly onto its enum through query_as!, which deleted the intermediate row struct and the mapping code.

Every owner-side server function uses #[secured_server], an attribute macro Sekou wrote as a drop-in replacement for Dioxus's #[server]. It injects the session user, generates a Controller marker type per function, and adds a compile-time assertion that the marker implements AccessController. Forgetting the permission check is a build error, not a code review comment.

Tenant-side functions take the other route and are safe by construction: every query is bound to the caller's own id from the session, so there is no parameter to tamper with. Both owner and tenant layouts are default-deny and redirect to login unless the auth resource holds a user. Errors cross the server function boundary through one AppError type, so the client can still tell NotFound from Unauthorized.

The first schema had one properties table and one tenant per lease. Real landlords own buildings with several units and sign leases with couples and roommates. Sekou split buildings from rentable units, replaced the single tenant foreign key with a lease_tenants join table, moved free-text maintenance providers to a vendors table, and added rent history.

Every query then joins through units and lease_tenants, and dashboard occupancy counts units rather than buildings. Vacant units show their asking rent by falling back to the unit's target rent when no active lease exists. Repository functions take &mut PgConnection instead of &PgPool, so the same functions compose inside a transaction without a second version of the data layer.

The assistant started as a tool-calling agent, not RAG: the data is live, per-user Postgres rows, and “what is my collection rate this month” is a query, not a similarity search. Then the transport ruled tool calls out (the headless Claude CLI with tools disabled, or plain chat completions), so Sekou flipped the design: the server gathers the caller's scoped data first through the same server functions the pages use, and the model only ever answers from that JSON.

The scope comes from the session, never from the model, and the system prompt is explicitly not treated as a security boundary. Owner context reuses existing functions and filters open maintenance and late payments in Rust, with zero new SQL. CLI calls run behind a semaphore and a timeout with kill_on_drop, so an abandoned request does not leave a child process behind. A per-user sliding-window rate limit lives in memory, with the move to a shared store documented for when the app runs on more than one instance, and every turn is logged to chat_events with duration, success, and error type.