PropertiX Platform Audit

Platform Audit Report

PropertiX Platform

South African student accommodation platform

Date: 12 October 2026 · Status: Read-only audit

Audit basis & limitations

This review uses the current route configuration, the inspected Home, Available Rooms, Admin Dashboard and Inspection Runner pages, the available entity schemas and project snapshot, plus the platform's current integration and function inventory. It is read-only; no app data, settings or files were changed.

Not every page, component, workflow definition, backend function body, live database record, or entity-level access rule was inspected. Items below distinguish what is directly visible from what remains unverified.

1. Pages & key functionality

Page / route	Purpose & status
Home `/`	Public landing with search, landlord entry, trust messaging. Loads Property/Room data but featured area shows "Coming Soon" placeholder. Search choices pass into the rooms route.
About `/about`	Public info page. Detailed behaviour not inspected.
Available Rooms `/rooms`	Full filter set (province, city, suburb, institution, price, room type, gender, NSFAS, accommodation type). Computes filtered results in-browser but renders "Coming Soon" instead of listing cards.
Property Details `/property/:id`	Intended property/room detail + actions. Redirects to `/rooms` while maintenance/coming-soon state is active.
Login / Register / Forgot / Reset	Auth routes registered. Detailed implementation not inspected.
OAuth Consent	File exists in project inventory but is not registered as a route in the inspected router.
Profile Setup `/profile-setup`	Authenticated onboarding; role selection. Onboarded users redirected to their role dashboard.
Tenant / Landlord / Contractor Dashboards	Require login + completed onboarding + matching `Profile.user_type`. Detailed operations not inspected.
Admin Dashboard `/admin-dashboard`	Requires Base44 system role `admin`. Tabs: overview, properties, units, rooms, applications, viewings, payments, documents, profiles, services, issues, reports, suspicious activity, inspections, failed notifications.
Admin Issues `/admin-issues`	Admin-only issue page. Detailed functionality not inspected.
Inspection Runner `/inspection/:inspectionId`	Admin-only, mobile-oriented. Loads spaces, records conditions/notes/photos per space, review, and marks inspection complete.

Authentication, query state and toast wrappers are present at the app root. A not-found page handles unmatched routes.

Components: Groups exist for admin management, inspections, property browsing/applications, onboarding, notifications, reviews, services, and shared navigation/forms. This is a functional-area summary, not an exhaustive component audit.

2. Database & entities

21 entities (including built-in User). Relationships are represented by ID-like string fields; reviewed schemas show no database-enforced foreign keys.

Entity	Main fields & types	Connections / purpose
Property	Name, address, coordinates, accommodation/category/status/verification, NSFAS, room & rent summaries, amenities/rules/images, description, landlord ID.	Parent listing. Unit, Room, PropertyStats reference it by ID.
Unit	Property ID/name, unit number/name, floor, description, status, bedrooms/bathrooms/capacity, furnished.	Belongs to Property; parent of Space; linked from inspections & rooms.
Space	Unit ID, space name/type, notes, display order.	Belongs to Unit; inspection checklist scope & media owner.
Room	Property ID/name, public title/reference, room/accommodation type, gender, status, rent/deposit/bed counts, availability date, advance options, NSFAS, features/images, unit/space/landlord IDs.	Public/commercial offering. Linked to Property and optionally Unit/Space.
Media	Owner type/ID, URL, category, source, status, capture date, inspection ID, public approval, display order.	Polymorphic attachment to property/unit/space/room; inspection photos link to Inspection & Space.
PropertyStats	Property ID, available-room count, min rent/deposit, room types/genders, NSFAS.	Cached summary for Property. Updated by a room-change workflow.
Inspection	Property/unit/room IDs & names, type/status/condition, inspector details, timestamps, notes.	Belongs to Property & optionally unit/room; parent of InspectionItems & Media.
InspectionItem	Inspection ID, Space ID/name, condition/cleanliness/notes, maintenance/completed flags, photo count.	One checklist record per inspection-space pairing.
Profile	User ID, contact, role/verification, institution, personal details, onboarding flags, budgets, uploaded docs/photos, service areas.	App-level profile linked to User by user_id. `user_type` drives role routing.
User (built-in)	ID, email, name, system role.	Platform-managed identity. Admin routing checks system role, not Profile role.
Application	Student/contact, property/room IDs & names, room type, institution, status/date, NSFAS.	Student application linked to property & optionally room.
Viewing	Student contact, property/room IDs & names, date/time/status/message, reminder flag.	Viewing request linked to property & optionally room.
WaitingList	Property/room IDs, scope, contact, preferences, tenant type/funding/status, budget, move-in date.	Waiting interest for specific room, room type, or any room at a property.
Favorite	User ID, property ID/name, optional room ID.	Saved property/room for a user.
Review	Target ID/type, reviewer ID/name, comment, service request ID, linked property ID, rating.	Review of property/landlord/tenant/contractor.
SuspiciousReport	Property/room IDs, reporter details, reason/comments/status.	Reports tied to property & optionally room.
Payment	Tenant, property, room, type, due date, status, proof, amount.	Payment record. Admin record management visible; no payment-provider flow confirmed.
Document	Owner, owner type, document type, property, upload date, status, file reference.	User/property document tracking & review.
ServiceRequest	Title, property/location/room, category, description, priority/status, tenant/contractor, notes, estimated payment, photo references.	Maintenance request tied to tenant/property & optionally contractor.
Notification	Recipient ID/role, type/title/message, related record, channel, status/error/link/dedupe key, read flag.	In-app/email notification for a user & optional related entity.
Issue	Title, affected page/role, description, screenshot reference, priority/status, assignee, resolution notes.	Internal product issue tracking.

Relationship model: Property → Unit → Space; Property → Room (optionally Room → Unit/Space). Inspection → InspectionItem → Space; Media attaches to space + inspection. Applications, viewings, waiting lists link people to properties/rooms. Profiles connect to users by user ID.

3. Backend functions, workflows & integrations

Backend functions (18)

Booking & service: createBookingRequest, createServiceRequest
Map support: getGoogleMapsKey
Stats: updatePropertyStats
Notification delivery: sendNotification
Status/event handlers: notifyAdminEvent, notifyApplicationStatus, notifyInspectionStatus, notifyNewRequest, notifyProfileStatus, notifyPropertyStatus, notifyRoomAvailability, notifyRoomVerification, notifyServiceStatus, notifyStaleWorkflows, notifySuspiciousReport, notifyViewingReminders, notifyViewingStatus

Names confirmed; exact logic, authorization, error handling and side effects were not audited function-by-function.

Workflows (15)

New-event notifications: New Application, New Viewing, New Service Request, Suspicious Report Admin Alert, Inspection Notification
Status notifications: Application Status Email, Viewing Status Email, Service Request Status Email, Property Status Notification, Profile Verification Notification, Room Verification Notification, Room Availability & Price Notification
Scheduled: Daily Viewing Reminders, Daily Stale Workflow Check
Data update: Sync Property Stats on Room Change

Trigger definitions, filters, recipient resolution, retry behaviour and enabled status were not verified by reading each workflow file.

External services & integrations

Google Maps: GOOGLE_MAPS_API_KEY secret set; getGoogleMapsKey function. Nearby places is a known issue.
Base44 Core: LLM, email, file uploads, image/speech/video generation, transcription, extraction, signed URLs available. Availability ≠ usage.
Connectors: none authorized.
Payments: Stripe available in region; no checkout/processing confirmed in reviewed code.
Support chat: Botpress webchat reportedly added to index.html; current file not inspected.

4. User roles & permissions

Role	Access & capabilities
Administrator	Base44 system role `admin` required for Admin Dashboard, Admin Issues, Inspection Runner. Dashboard exposes management actions across listings, units/spaces, applications, viewings, payments, documents, profile verification, inspections.
Tenant	Login + completed onboarding + `Profile.user_type === 'tenant'` required for tenant dashboard.
Landlord	Same route requirements, `user_type === 'landlord'`. Detailed dashboard flow not inspected.
Contractor	Same route requirements, `user_type === 'contractor'`. Assignment/status flows not verified.

Route guards establish page-level checks, not necessarily entity-level security. Entity RLS/access rules and backend authorization were not audited, so record-level isolation cannot be confirmed.

5. User journeys

Tenant / Student

Register/login → Profile Setup → browse/search rooms → property detail → request viewing, apply, or join waiting list → track in tenant dashboard. Currently constrained by "Coming Soon" listing display; property detail redirects during maintenance mode.

Landlord

Register/login → Profile Setup as landlord → submit listing → await verification → manage rooms, applications, viewings via dashboard. Full flow & permission rules not inspected.

Contractor

Register/login → Profile Setup as contractor → access contractor dashboard & service work. Assignment, status updates, completion flow not verified.

Administrator

Login with admin role → admin dashboard → manage listings, profiles, applications/viewings, inspect units, review issues/reports, view failed notifications. Inspection flow: open → start → record per-space conditions/notes/photos → review → complete.

Account recovery

6. Feature status

Status	Findings
Implemented (inspected)	Router & role guards; admin dashboard tabs & CRUD; Home search navigation; room filter controls; inspection load/record/review/complete flow; unit/space management hooks.
Implemented but not surfaced	Room discovery: filter logic exists but Home & Available Rooms render "Coming Soon" placeholders. Property Details redirects during maintenance mode.
Partially confirmed	Registration/onboarding, role dashboards, service requests, notifications, email workflows — represented by routes/schemas/inventories but full journeys not inspected.
Known issue	Nearby places feature listed as non-functional.
Not verified as connected	Stripe payment processing, external connectors, end-to-end email delivery, workflow enablement/retries, entity-level permission rules.
Not a registered route	OAuth Consent exists in file inventory but is not registered in App.jsx.

7. Technical & architectural concerns

Public listings hidden despite browsing logic. Home advertises rooms and loads data while showing a placeholder; Available Rooms computes filters and a count but also renders a placeholder. Public listing journey is incomplete.
Maintenance mode may not be a single source of truth. Home still shows "Rooms available" messaging and search entry while listing/detail restrictions are active. Full maintenance-mode implementation not reviewed.
Client-side collection loading. Dashboard uses a shared collection hook for many datasets and computes counts/slices/groupings in-browser. May become costly or incomplete at scale; paging behaviour of the hook not inspected.
Manual, incomplete deletion cascades. Deleting a Property removes Rooms; deleting a Unit removes Spaces. Visible handlers don't clean up all related records (media, inspections, requests) — orphaned-record risk unless handled elsewhere.
Inspection photo privacy — RESOLVED. Inspection Runner now uploads photos via UploadPrivateFile (stored privately, accessed via time-limited signed URLs). A PrivateImage component handles signed-URL resolution in SpaceInspector and InspectionDetailView. No previously uploaded public inspection photos remain in the database (verified: 0 Media records with public URLs).
Permission audit incomplete. Frontend route guards protect pages; record-level isolation cannot be concluded without reviewing entity RLS and backend authorization. Inspection data and personal documents are especially important.
Possible duplicate notification logic. Central sendNotification alongside many specialized notification functions and workflows. Shared responsibilities and duplicate sends cannot be ruled out without examining bodies and triggers.
Schema relationships are convention-based. Relationships are string IDs with no visible foreign-key enforcement. Consistency and cleanup depend on application logic.
PropertyStats may be stale or costly. Denormalized summary design; reliability depends on trigger coverage and failure handling, which were not audited.
User-facing claims outpace functionality. Home messaging describes available rooms and search/view/apply flows while listing pages show placeholders — gap between advertised and usable functionality.

Overall assessment

PropertiX has a broad, multi-role platform structure and a substantial admin/inspection foundation. The most visible product gap is that public room discovery remains in a "Coming Soon" state. Several important areas — record-level security, full user journeys, workflow reliability, payment processing, and live database behaviour — need further code-level verification before they can be called complete.