Wings Cup.
Wings Cup is a social prediction platform built around the 2026 World Cup, where groups of friends compete in private rooms by forecasting the score of every match.
Overview
Wings Cup is a social prediction platform built around the 2026 World Cup, where groups of friends compete in private rooms by forecasting the score of every match. Each room has an owner, an invitation code and its own leaderboard, with a weighted scoring system that rewards exact scores over goal-difference over plain outcomes. The core engineering challenge was fairness: predictions must lock the instant a match kicks off, with no possibility of editing after the fact. Rather than trusting client clocks or fragile HTTP cron endpoints, the locking runs inside PostgreSQL via Supabase pg_cron, making the rules enforceable at the data layer itself.
Core Pillars
Private Rooms & Invitations
A guided multi-step flow to create rooms, each with an owner, a shareable invitation code and join links to onboard friends.
Weighted Scoring Engine
Exact score (+5), goal difference (+3) and correct outcome (+1) — configurable rules that turn every match into a strategic call.
Predictions Locked at Kickoff
Forecasts are frozen the moment a match starts and revealed to other members, keeping the game tamper-proof.
Live Leaderboard
Per-room standings update automatically as results are loaded, with progress tracking across all 104 matches.
Admin Match Console
An admin panel to load results, drive match states (Scheduled, Live, Finished, Postponed) and bulk-lock predictions for matches already underway.
Database-Enforced Rules with RLS
Row-Level Security and scheduled jobs run in PostgreSQL via Supabase, so access control and prediction locking live where the data does.
Locking Predictions Without Trusting the Client
The integrity of the whole game depends on a single rule: no prediction can change after a match kicks off. Relying on the browser's clock or a user-triggered request would let anyone edit a forecast after seeing how the match unfolds.
The Solution
Prediction locking was moved off the client entirely and into the database. A scheduled job runs through Supabase pg_cron, freezing every match whose start time has passed, while an admin action can bulk-lock matches already in progress. The rule is enforced server-side, in PostgreSQL, independent of any client.
"Fairness enforced by the database clock, not the player's browser."
Multi-Tenant Visibility Without Leaking Predictions
Rooms are private competitions: members should only see each other's predictions once a match starts, and never the data of rooms they don't belong to. Mishandling this leaks strategy between rivals or exposes other groups entirely.
The Solution
Access boundaries were encoded as Supabase Row-Level Security policies, so a member can only read predictions for rooms they belong to and only after the reveal condition is met. Authorization lives in the database, not scattered across UI guards that are easy to bypass.
"Visibility rules expressed as RLS policies instead of trusted client checks."
A Tournament's Worth of Matches and State
A World Cup spans 104 matches across group and knockout stages, each moving through scheduled, live, finished and postponed states — and every state change ripples into scoring, locking and the leaderboard.
The Solution
Match lifecycle was modeled as explicit states with clear transitions, paired with Zod validation and Pinia stores on the frontend. Finishing a match with a final score triggers automatic point distribution, so the admin manages state while scoring stays a derived, deterministic outcome.
"Match state as the single source of truth that drives scoring automatically."
Ready to explore the code?
Wings Cup is open-source and available for review. Dive into the architectural decisions that power this project.