RSVQuick

Create customizable RSVP invitations, share them by link or QR code, collect short survey answers, and keep an accurate guest count.

This repository is FixMyMVP's independent rescue fork of Ansell Maximilian's original RSVQuick project. The original product concept and visual direction remain credited to its creator. The rescue focuses on a reproducible database, safer public submissions, maintained dependencies, and automated proof of the critical flow.

• Read the measured case study
• Visit FixMyMVP
• Follow or contact @FixMyMVP

What changed

• The complete Supabase schema now lives in versioned migrations.
• Invitation owners are isolated with row-level security.
• Anonymous guests cannot read or write RSVP tables directly.
• Public invitation reads use a narrow, safe database function.
• A response and all survey answers are committed in one transaction.
• Capacity and close dates are checked by the database under a transaction lock, preventing two guests from taking the final seat.
• Retries are safe through per-invitation idempotency keys.
• RSVP submissions return explicit success, duplicate, full, expired, invalid, and not-found states that the interface can explain and recover from.
• Shared Zod schemas enforce the database limits in host and guest forms.
• Public, host, and QR-export code is split so each route loads only what it needs.
• Demo resources and hard-coded login credentials were removed.
• The app now has unit, database integration, end-to-end, accessibility, lint, type, build, and dependency-audit checks.

flowchart LR
  Host["Authenticated host"] -->|"RLS-protected CRUD"| Tables["Private RSVP tables"]
  Guest["Anonymous guest"] --> Read["get_public_invitation()"]
  Guest --> Submit["submit_rsvp()"]
  Read -->|"Safe invitation view"| Tables
  Submit -->|"Lock + validate + atomic write"| Tables

Loading

Measured rescue

The measurements are stored under docs/evidence and tied to the tagged starting commit.

Check	Baseline	Rescue
Production dependency advisories	41	2
High / critical advisories	21 / 3	0 / 0
Main JavaScript, gzip	1,081,500 bytes	366,183 bytes
Automated checks	0	125
Lighthouse performance	91	99
Lighthouse accessibility	67	100
Versioned migrations	0	1
CI workflows	0	1

The automated-check count is 24 unit/component tests, 95 database assertions, and 6 browser scenarios. The browser suite covers protected routing, real password-recovery email, login/logout, host creation and isolation, survey validation, invalid/expired/full/declined states, concurrent last-seat submissions, phone-width layout, keyboard navigation, and zero-exclusion axe scans.

Lighthouse was run three times against equivalent local production builds. The table uses the median desktop landing-page result.

Run locally

Prerequisites:

• Node.js 24 (see .nvmrc)
• Docker
• Supabase CLI

npm install
supabase start
supabase status -o env

Copy .env.example to .env.local, then set VITE_SUPABASE_KEY to the local ANON_KEY printed by the last command.

npm run dev

Open http://127.0.0.1:5173.

Verify the rescue

npm run verify:full

The full command runs type, lint, unit/component, build and bundle-budget, database lint/integration, browser, accessibility, and production-audit gates. Install the browser once with npx playwright install chromium.

Evidence and attribution

• Reproducible starting point: fixmymvp-baseline-2026-07-25
• Original upstream commit: d0027aab907a3d88c1edbd9ba3c9c4ac3a62da15
• Original creator: Ansell Maximilian
• Rescue: FixMyMVP

License

MIT