Case study N° 05 · Dashboards

Grants Ops Console

An operations console for tracking FEMA hazard-mitigation grants from award to closeout.

One dataset
4views
Table, Gantt, Kanban and Calendar read the same milestones.
Each with its own RLS policy
11tables
Plus a private storage bucket for grant documents. Advisor findings fixed.
Per contractor link
1task
The most an outside upload link can touch. No account needed.

Why there are no screenshots

The real screens show live FEMA grant records, so there are no screenshots here. The diagram shows how the console fits together, with no grant data.

WHOAPPSUPABASEAdmin 1signed infull accessAdmin 2signed infull accessContractorshare linkno accountcan upload to 1 taskNext.js 16 · React 19TableGanttKanbanCalendarTask drawer + file viewerNew-grant wizardReport generatorPostgresgrantsRLStasksRLStask_depsRLSdocsRLSactivity_entriesRLStask_share_linksRLSStoragegrant-docs/RLSRealtimerow changes to both admins
Fig. 1|How it fits together. Every table and the document bucket carry their own row-level security policy; dashed lines are the only path an outside account can take. Realtime pushes row changes to both admins.

The problem

Two grant administrators manage multi-million-dollar FEMA HMGP safe-room grants. Each grant has years of milestones, compliance documents and contractor deliverables, and they needed one place to see what’s due, what’s at risk, and what’s missing.

What I built

One console where each grant’s milestones, tasks and documents live together, with four views of the same data: Table, Gantt, Kanban and Calendar.

  • A task drawer with notes, documents and an activity log, plus a PDF/XLSX viewer built into the page.
  • A new-grant wizard and a report generator.
  • Contractor share links that let an outside contractor upload to one task only, with no account.
  • Global search, and at-risk milestone alerts.

The hard part

Security and live collaboration on Supabase. Every table has row-level security policies, and storage buckets have their own. Supabase’s security advisors were run and fixed (search_path pinned, a needless EXECUTE grant revoked). Realtime subscriptions keep both admins’ screens in sync, and all schema changes ship as versioned SQL migrations.

Result

Built on the newest stack (Next.js 16 and React 19), with build and lint passing and a step-by-step deployment checklist for Supabase and Vercel.

Methods

Stack
Next.js 16, React 19, TypeScript, Tailwind v4, Supabase Postgres, Supabase Auth, Supabase Storage, Supabase Realtime.
Data
The diagram is redrawn from the shipped code. No real records are shown.
Status
Shipped Jun 2026. 2 grant administrators.