Keeping API requests off the client
A Supabase Edge Function stores the AeroDataBox key, checks the user’s session and turns the response into a consistent format for the app. Since coverage varies and the free tier is limited, results are cached for fifteen minutes and requests are limited by user and IP. IP addresses are hashed before they are stored.
Keeping flight history private
Supabase row-level security makes sure each user can only access their own saved flights. I added pgTAP tests for cross-user reads, writes, updates and deletes, as well as checks that the provider cache and rate-limit tables cannot be accessed from a user session. Deleting an account also deletes its flight history.
Handling local flight times
Flight times are stored in UTC and displayed in each airport’s local time, so overnight flights show the right time at both ends. Airport coordinates and countries come from the public OurAirports dataset and are added by a database trigger. That data is also used for distance totals and the route map.
Working around incomplete data
Flight records are often missing an aircraft, distance or airport match, so the app calculates each stat independently instead of dropping the whole flight. If a lookup fails completely, I can enter the flight manually and save the same kind of record.