Potluck - Handling Auth × Are Web Dev Real Developers? × Handling Git Conflicts × Converting PNG to Box-Shadow × Bad Docs vs No Docs × Making Shopify Headless

Episode Summary

Executive Summary: This Syntax potluck episode covers practical web dev advice on auth/permissions, dismissing “not real developer” gatekeeping, resolving lockfile merge conflicts, the 2038 timestamp problem, TypeScript vs PropTypes, documentation quality, finishing side projects, headless Shopify/CMS architecture, query-string tokens, and Next.js API routes vs Express. The hosts emphasize server-side enforcement, keeping systems simple, and choosing tools based on actual product needs rather than hype.

Main Topics: Role-based authentication and permissions: The hosts recommend modeling access as granular permissions grouped into roles, with server-side enforcement and optional UI gating via permission components or auth directives. Developer identity and gatekeeping: They dismiss claims that front-end developers are not real developers, framing such opinions as insecurity or inexperience rather than meaningful critique. Lockfile merge conflicts and dependency safety: Their practical advice is to regenerate package lock files instead of manually resolving noisy conflicts, noting lockfiles can also obscure malicious dependency changes. 2038 timestamp overflow problem: They discuss the 32-bit integer epoch limit around 2038, compare it to Y2K, and speculate about fixes like BigInt or moving away from numeric timestamps. TypeScript vs PropTypes and runtime validation: They explain that TypeScript is compile-time only, while PropTypes validate at runtime, but note they typically skip PropTypes in TS projects because it feels redundant. Side projects, documentation, and finishing work: They argue bad documentation is preferable to none, encourage contributing doc fixes, and suggest side-project motivation should be tied to a clear goal while accepting that some projects should be abandoned after learning goals are met. Headless Shopify architecture and CMS complexity: They caution against overcomplicating headless commerce by adding multiple CMSs, recommending simpler architectures and noting Shopify may already cover most CMS/product needs for many stores.

Key Arguments: Permissions should be enforced on the server, not just hidden in the UI; client-side role toggles are only presentational. The cleanest auth model is granular permissions grouped into roles, allowing flexible access control and future expansion. Gatekeeping about what counts as a “real developer” is not worth engaging; such opinions usually reflect insecurity or inexperience. When lockfiles conflict, regenerating them is often safer and faster than hand-merging thousands of lines. Lockfiles deserve caution because they can hide dependency-chain changes that may introduce malicious packages or versions. TypeScript catches errors at build time, but PropTypes can still be useful for runtime checks and custom validation; however, many TS users omit them as redundant. No documentation is worse than bad documentation because at least bad docs provide clues to the system’s surface area and usage. Finishing side projects matters because the last 10% often contains disproportionately more work and is where professional-level skill is built. For headless ecommerce, adding too many systems increases operational complexity, training burden, and data inconsistency risk. Query-string tokens are useful for payments, email tracking, and analytics attribution, but should be scrubbed when they are only for tracking. Next.js API routes can support HTTP-only cookies similarly to Express because cookies are set through response headers on the server. If a current architecture is stable and cheap to run, switching to serverless or Next.js APIs may not be worth the migration cost.

Data Points: Timestamp overflow date: January 19, 2038 - Mentioned as the end of epoch for a 32-bit integer timestamp problem. Timestamp value at overflow: 3:14:08 (03:14:08 UTC implied) - Referenced as the moment the 32-bit epoch limit is reached. 32-bit signed integer max: 2,147,483,647 - Used to explain the 2038 problem. Snow cover duration in Denver: Between snows, often fully disappears - Used to describe the climate and road-clearing conditions. Sunshine days in Denver: 300+ days of sun - Given as the reason snow melts quickly and roads clear fast. Course platform issue volume: Thousands and thousands of errors - Sentry example describing a route bug generating many exceptions. Sentry trial offer: 2 months free - Promotional offer mentioned during the sponsorship segment. FreshBooks trial offer: 30-day free trial - Promotional offer mentioned during the sponsorship segment. Hand cream weight: About 800 grams - Wes described heavyweight hoodies he made as gifts. Side-project abandonment: Last 10% can be 50% of actual work - Used to emphasize how finishing is disproportionately difficult.

Pivotal Quotes: "who cares?" — Wes Boss: Response to the claim that front-end developers are not real developers. "The last 10 is often like 50% of the actual work." — Scott Tolinski: Explaining why finishing projects is disproportionately hard. "If it isn't broke, don't fix it." — Both hosts: Their general stance on not migrating stable backend setups without clear benefit.

Implications: Listeners are encouraged to build simpler, server-enforced systems, avoid unnecessary migration or tool sprawl, and focus on practical engineering over gatekeeping or perfectionism. The episode reinforces that architecture choices should be driven by real product needs and maintainability.