Engineering deep-dives from the SlashFeed team — Elixir, Phoenix, and how the product is built.
How SlashFeed blocks an account everywhere at once — sessions, API tokens, MCP, background jobs — while deleting nothing, so unblocking restores it exactly. One timestamp, a handful of choke points, a query macro for the workers, and an email list with no foreign key on purpose.
Application-layer tenant scoping fails silently the day you forget a WHERE clause. PostgreSQL composite foreign keys turn a cross-user reference into a constraint violation the database rejects — here is the underdocumented references/2 :with option, the two migration patterns for CASCADE and SET NULL, the MATCH SIMPLE trick for nullable columns, and a test that proves the constraint lives in the DB.
How I added time-based one-time password (TOTP) MFA to SlashFeed using NimbleTOTP — the data model, the setup flow, backup code generation with bcrypt, and the subtle guard clause that prevents setup-state leakage.
How I added WebAuthn / passkey authentication to SlashFeed using the wax_ library — the data model, the JavaScript dance, the origin-binding gotcha that ate an afternoon, and the testing strategy for code that needs a real browser to fully exercise.
