Family Kitchen

Household food apps usually model one cook with a shopping list. A family is different: several people with different permissions, allergies that matter per person, and a pantry that only works if someone records what left it. Family Kitchen treats the whole household as the user.

A mobile-first app with a FastAPI backend on GCP Cloud Run and Firestore for storage, under a hierarchical RBAC model dressed as a kingdom: Visitor, Worker, Prince/Princess, and King/Queen, each tier inheriting the permissions below it. Roles are enforced on every route, so a Visitor cannot edit inventory and a Worker cannot change household settings.

Auth is OAuth2 plus JWT with 15-minute access and 7-day refresh tokens, JTI-based blacklisting, refresh rotation, and audit logging; PII is encrypted at rest with AES-256-GCM through Secret Manager. Inventory tracks best_before dates plus max and total use counts and raises configurable expiring-soon alerts. The allergy vault keeps a per-user allergen registry against a known-allergen database, and recipe creation runs a conflict check that blocks a recipe when it would expose a kingdom member. The Flutter app holds a SQLite offline cache with a sync manager, scans barcodes with ML Kit, and wakes in the background for notifications.

The sync manager was the last piece written and it shows: conflict resolution was underspecified when the offline cache shipped. I would design the sync protocol before the cache, with an explicit last-write-wins rule per field.