Waypoint

I started Waypoint to organise my own career research: employers to look into, opportunities worth following and applications already in progress. I wanted the links, notes and deadlines to stay connected, with a clear next action when I returned to them.

The result is a private careers workspace. It separates researching an opportunity from applying for it, while keeping both attached to the relevant employer.

Applications have stages, deadlines, notes, links and a next action. Board and list views provide different ways to review progress, while checklists and stage history retain the detail behind each application.

Company and opportunity records hold research separately, including locations and relevant links. Search and filters help narrow the workspace. I have focused on making the next step easy to find without needing to open every record.

The web app uses React and TanStack Start, with Convex for data and WorkOS AuthKit for sign-in. Companies, opportunities and applications are separate tables linked by IDs. An application can refer to a specific opportunity or directly to an employer.

Convex functions verify the authenticated user and check ownership of related records. They also check that a selected opportunity belongs to the chosen company. Keeping these rules on the server matters even when the interface already filters the available choices.

A real issue was a login that could succeed initially but fail to restore reliably on the public hostname. The authentication investigation found a mismatch between the browser session approach and the deployment, as well as a separate token-refresh problem.

The web implementation moved to WorkOS’s TanStack Start SDK with an encrypted, HTTP-only session cookie. Refresh tokens stay with the server session, and the Convex bridge forwards forced-refresh requests. Local production-build checks covered reloads, direct navigation, another tab and sign-out.

Those local checks do not establish that the public deployment has the matching configuration. The public sign-in page is available, but a full authenticated production session still needs separate verification.

Working on Waypoint has helped me connect database relationships with everyday usability. Separating an employer, an opportunity and an application makes the data clearer, but the interface still needs to make moving between them straightforward.

It has also shown me why a visible signed-in interface is only part of authentication: the backend needs to accept the session, restore it consistently and enforce ownership on every operation.