{"slug": "building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack", "title": "Building a passwordless, Gemini-advised dashboard on the \"zero stack\"", "summary": "A developer built Kajota Pulse, a Bloomberg-terminal-style dashboard for African micro-commerce co-sellers that uses Gemini 2.5 Flash to recommend what stock to buy. The app runs on the 'zero stack'—Vercel for compute and AWS Aurora Serverless v2 for state—with no servers to manage. Key engineering challenges included mandatory IAM database authentication, Lambda environment variable shadowing, and handling MongoDB Extended JSON format from production data triggers.", "body_md": "*I built Kajota Pulse and wrote this article as my entry for the **AWS × Vercel \"H0: Hack the Zero Stack\"** hackathon (**#H0Hackathon**). Live app: [kajota-pulse.vercel.app](https://kajota-pulse.vercel.app) · Code: [github.com/KaJota-inc/kajota-pulse](https://github.com/KaJota-inc/kajota-pulse)*\n\nAcross African micro-commerce, \"co-sellers\" buy stock from wholesalers and resell to their network for a markup. There's a whole industry of tools for *writing the listing*. There's almost nothing for the question that actually decides whether a co-seller makes money: **what should I stock this week?**\n\nSo we built **Kajota Pulse** — a Bloomberg-terminal-style dashboard that watches the marketplace and, in one click, tells a seller what to buy and why. It's the \"monitor\" pillar of a three-app stack: **Coach** drafts the listing, **Pulse** says what to stock, **Mesh** settles the deal on-chain.\n\nThe hackathon constraint was the fun part: build it on the **zero stack** — Vercel for compute, an AWS database for state, no servers to manage. Here's what that actually took.\n\nNext.js 16 (App Router) on Vercel → **AWS Aurora Serverless v2 (PostgreSQL)** for every number on the dashboard → **Gemini 2.5 Flash** for the advice → **MongoDB Atlas Database Triggers** streaming the real Kajota catalogue in. Five Postgres tables, two SQL views, two Gemini endpoints, one ingest endpoint. No VPC, no connection pooler, no server.\n\nThe interesting engineering wasn't the UI. It was three things that don't show up in tutorials.\n\nWe provisioned Aurora Serverless v2 with the new internet-access-gateway networking model so Vercel could reach it without VPC plumbing. Then every password connection failed with `PAM authentication failed`\n\n.\n\nThe new model **mandates IAM database authentication** — and as a bonus, it doesn't support the RDS Data API either. So instead of a stored password, every connection mints a short-lived (15-minute) IAM auth token:\n\n``` js\nconst signer = new Signer({ hostname, port, username, region, credentials });\npool = new Pool({\n  host, port, user, database,\n  password: () => signer.getAuthToken(), // fresh token at each handshake\n  ssl: { rejectUnauthorized: false },\n});\n```\n\n`pg`\n\nsupports an async `password`\n\ncallback, so this is clean. And the security property is genuinely nice: **there is no long-lived database password anywhere** — not in Vercel, not in the repo, not in a secret manager.\n\nThis one cost an hour. The IAM signer needs AWS credentials to sign the token. We set `AWS_ACCESS_KEY_ID`\n\n/ `AWS_SECRET_ACCESS_KEY`\n\nin Vercel… and it still failed.\n\nVercel functions run on Lambda, and **the Lambda runtime injects its own execution-role AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY**, which shadow yours. The signer was minting tokens with the wrong (no-\n\n`rds-db:connect`\n\n) identity.The fix: use custom env names and pass them explicitly to the signer.\n\n``` js\nfunction signerCredentials() {\n  const accessKeyId = process.env.PULSE_AWS_ACCESS_KEY_ID;\n  const secretAccessKey = process.env.PULSE_AWS_SECRET_ACCESS_KEY;\n  return accessKeyId && secretAccessKey ? { accessKeyId, secretAccessKey } : undefined;\n}\n```\n\nA dedicated IAM user with *only* `rds-db:connect`\n\non the cluster's dbuser resource, surfaced under `PULSE_AWS_*`\n\n, and the shadowing problem disappears.\n\nThe dashboard is only as good as its data, so we wired **three MongoDB Atlas Database Triggers** on the real Kajota collections (`products`\n\n, `cosell_products`\n\n, `orders`\n\n). Each trigger POSTs its change event to `/api/ingest`\n\n, which upserts into Aurora. Hooking this to *production* data immediately surfaced three bugs that a seed file would never reveal:\n\n`_id`\n\narrives as `{\"$oid\":\"…\"}`\n\nand a price as `{\"$numberInt\":\"9500\"}`\n\n— not as a string and a number. Without decoders you get `id=\"[object Object]\"`\n\nand `price=NaN`\n\nin your database. Two small helpers (`ejsonId`\n\n, `ejsonNum`\n\n) fixed it.`cosell_products`\n\n(underscore), but our router matched `cosellproducts`\n\n. Events silently fell through as \"ignored.\" Now the router normalizes names.None of these reproduce against fixtures. They only appear when real production writes hit your pipeline — which is exactly why we wired it to live data instead of demoing on a seed.\n\nA dashboard shows you numbers and makes you do the synthesis. We wanted Pulse to *answer the question*. So `/api/recommend`\n\npulls the live signals — trending demand, category margins, competitor stock-outs, price position — and hands them to Gemini 2.5 Flash with a **structured-output schema**:\n\nOrganic Shea Butter→Stock 10–15 units before the weekend.\n\n\"+27 favorites, sits in the high-margin Beauty category (18%), and a competitor just ran out of a similar cream.\"\n\nTwo details that matter for a demo that can't break:\n\n`responseMimeType: \"application/json\"`\n\n+ a `responseSchema`\n\n) means we render a clean ranked list, not parse prose.`node scripts/verify-live.mjs`\n\nchecks the live landing page, the Aurora badge, both Gemini endpoints, the ingest auth gate, and a real IAM-authenticated row count — 5/5. Anyone can run it.**Live:** [kajota-pulse.vercel.app](https://kajota-pulse.vercel.app) · **Code:** [github.com/KaJota-inc/kajota-pulse](https://github.com/KaJota-inc/kajota-pulse) · Built on Next.js 16 (Vercel) + Aurora Serverless v2 + Gemini 2.5 Flash.", "url": "https://wpnews.pro/news/building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack", "canonical_source": "https://dev.to/kajotainc/building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack-3di2", "published_at": "2026-06-29 23:19:04+00:00", "updated_at": "2026-06-29 23:48:37.891071+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "developer-tools", "ai-products"], "entities": ["Kajota Pulse", "Vercel", "AWS", "Aurora Serverless v2", "Gemini 2.5 Flash", "MongoDB Atlas", "Lambda", "IAM"], "alternates": {"html": "https://wpnews.pro/news/building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack", "markdown": "https://wpnews.pro/news/building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack.md", "text": "https://wpnews.pro/news/building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack.txt", "jsonld": "https://wpnews.pro/news/building-a-passwordless-gemini-advised-dashboard-on-the-zero-stack.jsonld"}}