Adamo Compliance

Compliance work is queue work: payment alerts to clear, names to screen against restricted lists, beneficiary files to keep current, KYB documents to check. Adamo Compliance puts those queues on one screen. I built it for Adamo end to end on Next.js 15 and React 19: the component library on shadcn/ui and Tailwind CSS 4, the TanStack Query data layer, Zod validation on every form, Spanish and English copy through next-intl, and a Supabase auth layer with TOTP two-factor.

One requirement shaped the architecture: the portfolio demo had to run with no backend at all. Instead of ripping auth out, I kept the real Supabase integration and wrote a mock behind the same three client factories. It implements exactly the supabase-js surface the app touches, keeps the session in a cookie the Next.js middleware can read, remembers MFA enrollment across sign-outs, and saves profile edits to localStorage. The same code runs against live Postgres, Auth and TOTP MFA once two env vars are set; the mock is there so the public demo needs zero configuration.

Every flow on the live demo is clickable with the pre-filled credentials. First login forces a password change and TOTP enrollment with a generated QR code, a return visit gets the six-digit challenge, and the forgot-password loop completes without sending an email. 71 Vitest tests cover the same service layer the UI runs on.

The performance pass was mostly deleting things. The data services shipped with a hard-coded 800 ms delay, so it went first. Lodash moved to per-method imports, which cut the heaviest route's JavaScript by 65%, from 36.6 kB to 13 kB. A route-level loading state covers the gap, and ESLint and tsc come back clean.