Atlas — Personal Research Workspace

Atlas is a private web app for researching one subject across many sources. You drop links into an Inbox with a comment, then file them under topics, connect them, take notes and write reports in a rich-text editor. Each claim keeps its statement, the evidence for or against it, and your own conclusion apart. It has workspace-scoped FULLTEXT search, a knowledge graph, export/import and installs as a PWA. There is one owner and no public sign-up, AI, queue or third-party login. I designed the screens, the database (35 Prisma models) and the security layer myself, and it now runs in production on a host that uses Phusion Passenger.

1. 01Research ends up scattered across bookmarks, half-watched videos, PDFs and notes, so coming back later you can’t tell which source supports which conclusion.
2. 02General note apps don’t separate a claim from its evidence, and don’t say how sure you are of the conclusion.
3. 03Capturing links is the risky part: the server has to fetch URLs a user supplies, which opens the door to SSRF, and attachments can be malicious files or HTML that runs scripts.
4. 04Long writing across several tabs, or a session that expires mid-edit, can overwrite work or lose text without you noticing.

1. 01Capture: paste a URL with a comment, topic, tags and priority. URLs are normalised and checked for duplicates, and metadata for YouTube, GitHub and generic web pages is fetched through adapters — a failed fetch never blocks saving.
2. 02Inbox → Topics: file many sources under a topic, tag and priority at once with keyboard shortcuts. Topics have aliases, pins, favourites, collections, 14 relation types, and transactional merging of duplicates.
3. 03Notes and reports use TipTap: headings, bold, links, images, code blocks, tables, checklists and callouts, with autosave and a visible status. Optimistic concurrency stops another tab overwriting your edit. Reports keep explicit versions that can be viewed and restored as a new version.
4. 04Claims separate the statement, the stance of each piece of evidence (supports, contradicts, neutral, context) and your own conclusion, with a 0–100 confidence. Research tasks carry a priority and due date and can be tied to a topic, source or claim.
5. 05A monochrome knowledge graph with React Flow and dagre: filter by relation and tag, search for a topic, view 1–2 hop neighbourhoods, with rendering capped at 150 topics and 500 edges. Workspace-scoped FULLTEXT search and a command palette (Ctrl/⌘+K).
6. 06Security: a single owner created on first run, Argon2id passwords, opaque 30-day sessions stored only as SHA-256 hashes, login throttling, every query scoped to the workspace, every mutation checking the request origin, plus a CSP and anti-framing headers.
7. 07Attachments live in a private S3 bucket. Size (50 MB maximum), MIME type, extension and binary signature are checked, a SHA-256 is stored, downloads use 2-minute signed links, there is an authenticated server-upload fallback, and HTML previews are sanitised, sandboxed and covered by a CSP.
8. 08Export/import: versioned JSON and a Markdown ZIP. Imports are transactional, remap IDs, merge existing source URLs, keep report versions and sanitise snapshots. It installs as a PWA (manifest, service worker, offline page) and ships with a multi-stage Dockerfile and GitLab CI.

1. 01One workspace that goes from link → topic → claim and evidence → versioned report, with all data in a database I control and exportable at any time.
2. 0255 unit tests in 11 files pass, covering URLs, SSRF, safe fetching, passwords and sessions, files, HTML sanitising, import, origins, PWA and error handling. The repo also has integration tests against a real MySQL database and Playwright end-to-end tests.
3. 03GitLab CI runs lint, typecheck, tests and a build on every push, and the app runs for real at atlas.phatphum.me (sign-in required).

• A Next.js 16 + Prisma/MySQL web app (35 models, migration and FULLTEXT indexes)
• Inbox, Topics, Sources, Notes, Claims, Tasks, Reports, Graph, Collections, Tags, Trash and Settings
• The TipTap editor and versioned reports
• The security layer: Argon2id, hashed sessions, safe fetching, sanitised and sandboxed previews, CSP
• JSON and Markdown ZIP export/import
• PWA support, a multi-stage Dockerfile, sample S3 policy and nginx config, and GitLab CI
• Unit, integration (MySQL) and end-to-end (Playwright) tests

• Next.js
• React
• TypeScript
• Tailwind CSS
• Radix UI
• Prisma
• MySQL
• Zod
• React Hook Form
• TipTap
• React Flow
• Dagre
• AWS S3
• Argon2id
• PWA
• Vitest
• Playwright
• Docker
• GitLab CI
• Phusion Passenger

• 2026graph.phatphum.me — Visual Knowledge AtlasOne knowledge model, several ways to read it: a dependency graph, a roadmap, an outline and a focus view — with Frontend, Computer Networks and Cybersecurity curricula I wrote and validated myselfPersonal
• 2026BookNest — A Personal Library with Book Knowledge MapsA local-first library of books and magazine issues that keeps each book’s real table of contents, terms, diagrams and reading paths as validated JSON — no account or cloudPersonal
• 2026Catadex — A Directory of Specialist Catalogs1,248 specialist data catalogs in 34 fields, explored through cards, a relationship graph and guided trails, and searchable in Thai and EnglishPersonal