Developer Builds Production RAG System with HMAC Auth, Multi-Tenancy, and Citation Checks

·2 views

A developer has published a production-grade Retrieval-Augmented Generation (RAG) system designed to address four common weaknesses in real-world RAG deployments: hallucination, data leakage between tenants, demo friction, and lack of quality measurement. The system uses stateless HMAC-signed guest cookies with a one-hour TTL to enable frictionless onboarding without database overhead, allowing users to try the product before signing up. Multi-tenancy is enforced through layered permission checks at the retrieval, session, and mutation levels, with zero cross-workspace data leaks confirmed via SQL injection testing. Hybrid search combines BM25 keyword matching via PostgreSQL tsvector with vector similarity search using pgvector, merged through Reciprocal Rank Fusion. A 15-case evaluation framework measured retrieval recall at 66.7%, citation precision at 74.6%, and answer correctness at 80%, with the full codebase available on GitHub and a live demo hosted on Vercel.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Handle Expensive Tax Form Generation Using Async Job Queues in Node.js

A Node.js service that fills tax forms must separate fast synchronous validation from slow background tasks like redaction, archiving, and rendering to avoid tying up request latency. The recommended approach is to validate input immediately, return a 202 Accepted response with a job ID, and process the document in a bounded worker pool with retry logic for transient failures. Two distinct latency budgets should be tracked separately — one for API acceptance and one for job completion — so bottlenecks can be diagnosed accurately. Output validation should be treated as a second, independent pass that checks the generated document for correctness and absence of personal data, distinct from input validation. Under variable load, capping worker concurrency and allowing queue depth to grow is safer than spawning unlimited render tasks, and any switch to lower-fidelity output must be an explicit, named option rather than a silent fallback.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Context-Driven Product Signals Beat Generic SaaS Reactivation Emails

Many SaaS teams trigger reactivation emails after a set period of inactivity, but sending the same message to all lapsed users often fails because it ignores why each person stopped engaging. A user who never completed onboarding has different needs than one who built value but never invited teammates, yet both frequently receive identical campaigns. The author argues that reactivation should function as a product continuation, anchored to a single, specific behavioral signal rather than a broad inactivity threshold. For example, targeting a user who created a workspace but never connected a data source within 72 hours allows the message to reference a concrete next step and link directly to the relevant screen. Tracking granular events such as the trigger signal, affected object, time since last action, and post-click outcome enables teams to measure whether reactivation actually worked rather than relying on open or click rates alone.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Laravel package Lararand tackles modulo bias for truly uniform random number generation

A subtle but significant flaw exists in common PHP random number generation: using a byte's 256 possible values modulo 78 (for a tarot deck) causes 22 outcomes to appear 33% more often than the remaining 56, silently skewing results in production. Standard range-checking tests pass without detecting this bias, since the error lies in the distribution rather than the output shape. The fix, known as rejection sampling, discards byte values above the largest multiple of 78 that fits in 256 and redraws, ensuring each outcome is equally likely at a small 8.6% redraw cost. Developer Lararand was built to centralise this corrected logic in a single Laravel package, preventing the bug from being independently and incorrectly reimplemented across a codebase. The package also addresses an analogous modulo-bias trap in array shuffling, and is aimed at use cases where the provable fairness of randomness is itself a product requirement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Credits Commute Micro-Learning Habit for Reaching First Million in Tech

A software professional with nearly two decades in the tech industry attributes reaching their first million in career earnings to consistently using small pockets of idle time — such as commutes — to learn new skills. Rather than relying on single long study sessions, they accumulated knowledge in ten-to-twenty-minute intervals over many years, allowing skills and opportunities to compound. The author found existing tech learning resources fragmented and difficult to use in short bursts, requiring too much self-direction around what to study next. Drawing inspiration from Duolingo's structured, guided approach to language learning, they identified a gap in how technical education is delivered for micro-learning. The piece argues that the key advantage of app-guided learning is removing the overhead of planning, so learners can focus entirely on the content itself.

0 comments Read more at DEV Community