Description
A booking SaaS I built on my own, around 27 thousand lines. Clients book through a widget embedded in the business's own site, the owner runs everything from a panel, and each tenant's data is isolated by Row Level Security.
Features
- Row Level Security forced on every tenant table, including for the table owner
- Booking widget that embeds into third-party sites
- Owner panel with week view, pending requests, blocks and services
- Runs on a VPS with Docker Compose, reverse proxy and a daily backup routine
- 299 tests over business rules and access policies, in Vitest and Playwright
Challenges
- Stopping double bookings for good, which ended up as an exclusion constraint in Postgres instead of a check in the code
- Keeping the availability calculation in one place, shared by the widget, the panel and the API
- Moving the whole thing off a managed platform without rewriting the business rules
Learnings
- That an invariant the database can enforce should not live in application code
- How much a versioned migration file is worth on the day you change platforms
- Testing what breaks expensively, business rules and access policies, instead of chasing coverage