Features

Detailed features of the Booking Platform organized by module and workspace. The platform has 188 features across 10 workspaces with 295 route files in the website alone.

Website Modules (18 top-level modules)

The main web app (apps/website) contains 18 top-level feature modules under src/modules/, totaling 126 features across 20 sub-modules:

Module	Path	Description
Admin	`src/modules/admin/`	Admin panel — users, providers, disputes, promotions, reports
Auth	`packages/auth/src/`	Authentication via Supabase — 5 roles, 30+ permissions
Billing	`src/modules/billing/`	Billing and subscription management
Config	`packages/config/src/`	App configuration and feature flags
Database	`packages/database/src/`	Drizzle ORM schema, migrations, and queries
Devtools	`src/modules/devtools/`	Developer tools and debugging utilities
Feature Flags	`packages/feature-flags/src/`	Feature flag management and toggles
Infrastructure	`packages/infrastructure/src/`	Server infrastructure, middleware, and oRPC setup
Layout	`src/modules/layout/`	App layout — header, footer, navigation, sidebar
Bookings	`src/modules/bookings/`	Customer booking management and history
Native	`src/modules/native/`	Capacitor native bridge — biometric, haptics, camera
Provider	`src/modules/provider/`	Provider dashboard — bookings, staff, services, settings (30+ sub-modules)
Public Pages	`src/modules/public-pages/`	Public-facing pages with custom domains and templates
Search	`src/modules/search/`	Provider and service search with filters
Settings	`src/modules/settings/`	User and provider settings — profile, security, payments
Shared	`src/modules/shared/`	Shared utilities and common components
Support	`src/modules/support/`	Support tickets, SLA, and AI assistant
User	`src/modules/user/`	User profile, verification, and badges

Provider Sub-modules (30+ modules)

The provider module is the largest, containing 30+ sub-modules under src/modules/provider/:

Sub-module	Description
`analytics`	Provider analytics dashboard and reporting
`availability`	Availability and time slot management
`bookings`	Booking management and operations
`calendar`	Calendar view and scheduling
`chat`	Real-time chat between customers and providers
`communication`	Email, SMS, and push notification templates
`customers`	Customer management
`dashboard`	Provider dashboard with overview stats
`integrations`	Third-party integrations
`loyalty`	Loyalty program management
`notifications`	Smart notification system with preferences
`onboarding`	Provider onboarding wizard and business setup
`pages`	Provider-specific pages
`promotions`	Promotions, campaigns, and referral programs
`realtime`	Real-time updates
`recurring-bookings`	Recurring booking support
`reviews`	Review management
`services`	Service management
`social-sharing`	Social sharing features
`staff`	Staff management and scheduling
`subdomain`	Custom subdomain configuration
`video-consultations`	Video call integration for virtual consultations

Booking Cart & Checkout

The booking cart system includes pre-checkout slot validation to prevent double-booking.

Checkout Flow

1. Fetch cart items for user
2. For each item: validate slot availability (provider availability + capacity + overlap check)
3. If any slot invalid → throw ConflictError with reason
4. Convert cart items to bookings via repo.checkoutBookingCart
5. For each booking: insert audit log + send booking confirmation notification

Slot Validation (`validateBookingSlotAvailability`)

Three checks performed per cart item:

Check	Description
Provider availability	Checks if provider works on the requested day
Capacity availability	Verifies sufficient capacity at the requested slot
Overlap check	Queries confirmed bookings that overlap with the requested time

Cancellation Policy

Scenario	Refund	Fee
Default (no policy)	50% of price	Remaining balance
Late cancellation (< `hoursBeforeBooking`)	0	`lateCancellationFee` or 0
Normal cancellation (>= `hoursBeforeBooking`)	`priceCents * refundPercentage / 100`	`priceCents - refundCents`

Policy supports allowProviderOverride for late cancellations.

Loyalty Program

Loyalty points with duplicate prevention, tier system, and streak tracking.

Feature	Description
Earn points	`earnLoyaltyPointsForBooking` with `hasLoyaltyEarnedForBooking` duplicate check
Redeem points	`redeemUserLoyaltyPoints` with optional description
Tiers	bronze, silver, gold, platinum with automatic upgrade checks
Streaks	Current streak, longest streak, and streak history
Badges	User badges with rarity and earned date
Point expiry	Expiring points within a timeframe

Payments

Payment Methods

Method	Validation	Description
Stripe	Zod + Stripe SDK	Payment intents with deposit/full payment, gift cards, session passes
LINE Pay	HMAC-SHA256 + Zod response schemas	7 currencies (THB, USD, EUR, JPY, SGD, MYR, TWD), 30s timeout

Payment Intent Flow

1. Build payment breakdown (deposit or full amount)
2. Fetch customer ID from payment gateway
3. Validate amount is positive
4. Create Stripe payment intent with metadata (bookingId, type, depositPercentage)
5. Generate invoice with tax and discount calculations
6. Create deposit payment record if deposit > 0
7. Create ledger entry
8. Insert audit log for financial change
9. Apply gift card transaction if applicable
10. Use session pass if applicable

LINE Pay Response Validation

All LINE Pay API responses are validated with Zod schemas:

Payment response: returnCode, returnMessage, info.paymentUrl.web, info.paymentUrl.app, info.transactionId
Refund response: returnCode, returnMessage, info.refundTransactionId
Success determined by returnCode === "0000"

Security & Infrastructure

Production Environment Validation

Strict env validation via Zod superRefine — in production mode, requires:

Variable	Required In
`STRIPE_SECRET_KEY`	Production
`STRIPE_WEBHOOK_SECRET`	Production
`DATABASE_URL`	Production

Fail-Closed Authorization

Authorization errors (FORBIDDEN) are handled separately from service errors. Non-authorization errors (database timeout, service unavailable) are re-thrown rather than silently ignored.

FCM Token Cleanup

After sendEachForMulticast(), invalid registration tokens are automatically deleted via deleteDeviceToken() when Firebase returns messaging/invalid-registration-token error code.

Redis Cache Error Logging

All Redis cache methods (get, set, mget) catch errors and log via secureError with [Redis Cache] prefix. Cache failures return default values (undefined or empty array) instead of throwing.

Webhook Payload Redaction

Webhook payloads are sanitized via redactValue() before logging to prevent sensitive data leaks.

Deployment Typecheck Enforcement

GitHub Actions deploy workflow runs typecheck as a gate before deployment for both apps/website and apps/admin.

Authentication System

The platform supports three authentication methods with server-side session management and RBAC enforcement.

Auth Methods

Method	Implementation	Description
Email/Password	`apps/website/src/server/auth/session.ts`	Supabase auth with rate limiting (5 attempts/email, 20/IP per minute)
OAuth Social Login	`packages/auth/src/adapters/supabase/oauth-adapter.ts`	Google, LINE, Facebook with redirect path whitelist
Passkey/WebAuthn	`apps/website/src/server/user/security/passkey.ts`	`@simplewebauthn/server` with 5-minute challenge TTL in Redis

Password Requirements

Sign in: Minimum 8 characters
Sign up: Minimum 12 characters, must contain lowercase, uppercase, number, and special character

Server-Side Sessions

Cookie-based sessions with automatic refresh:

Cookie	Purpose	HttpOnly	Secure
`sb-access-token`	Public session data	No	Production
`sb-refresh-token`	Refresh token	Yes	Production
`sb-auth-token`	Legacy auth token	—	—

Session functions: getSession, refreshSession, signInWithEmailPassword, signUpWithEmailPassword, signOut.

Passkey/WebAuthn Flow

Registration: registrationBegin → cache challenge (5 min TTL) → browser WebAuthn API → registrationFinish → store in biometric_credentials
Authentication: authenticationBegin → cache challenge → browser WebAuthn API → authenticationFinish → Supabase magic link OTP → session

Credential storage includes: credentialId, publicKey, signCount, transports, deviceType, backup status. Counter tracking prevents replay attacks.

MFA (TOTP)

Endpoint	Description
`enroll`	Generate TOTP secret and OTPAuth URI for QR code
`verify`	Verify TOTP token, enable MFA, generate 10 backup codes
`disable`	Disable MFA after TOTP verification
`regenerateBackupCodes`	Regenerate backup codes
`status`	Return MFA enrollment status

MFA enforcement via requireMFA() guard — throws FORBIDDEN if MFA not enabled for sensitive operations.

RBAC

5 roles with 54 total permissions:

Role	Permissions	Key Access
CUSTOMER	8	Book services, view/cancel own bookings, write reviews
PROVIDER	16	Manage services, bookings, staff, customers, promotions, earnings
PARTNER	5	Partner dashboard, referrals, sellers, earnings
STAFF	6	View assigned bookings, manage own bookings, availability
ADMIN	54	All permissions including users, providers, system settings, security, compliance

Authorization guards: requireAuth, requireMFA, requireVerifiedEmail, requirePermission, requireRole, requireOwnership, requireProviderOwnership (with circuit breaker).

Key Routes (295 route files)

Public Routes

Route	Purpose
`/`	Home page
`/about`	About page
`/pricing`	Pricing plans
`/faqs`	FAQ page
`/why`	Why choose us
`/features`	Features overview
`/developers`	Developer page
`/blog`	Blog listing
`/changelog`	Changelog page
`/contact`	Contact page
`/resources`	Resources page
`/search/:query`	Search providers and services
`/provider/:id`	Provider public page
`/provider/:id/services`	Provider services list
`/provider/:id/reviews`	Provider reviews
`/provider/:id/availability`	Provider availability
`/provider/:id/contact`	Contact provider
`/provider/create`	Create new provider account
`/for-business`	For business landing
`/products`	Products page
`/policies/*`	Policy pages (terms, privacy, etc.)
`/template/*`	Template pages

Auth Routes

Route	Purpose
`/auth/signin`	Sign in
`/auth/signup`	Sign up
`/auth/reset-password`	Reset password
`/oauth/*`	OAuth callback handling

Provider Dashboard Routes

Route	Purpose
`/provider/:id/dashboard`	Dashboard overview
`/provider/:id/dashboard/bookings`	Manage bookings
`/provider/:id/dashboard/calendar`	Calendar view
`/provider/:id/dashboard/customers`	Customer management
`/provider/:id/dashboard/staff`	Staff management
`/provider/:id/dashboard/services`	Service management
`/provider/:id/dashboard/earnings`	Earnings reports
`/provider/:id/dashboard/reviews`	Review management
`/provider/:id/dashboard/promotions`	Promotion management
`/provider/:id/dashboard/chat`	Chat conversations
`/provider/:id/dashboard/settings`	Provider settings
`/provider/:id/dashboard/notifications`	Notifications
`/provider/:id/dashboard/disputes`	Dispute management
`/provider/:id/dashboard/realtime`	Real-time updates

Admin Routes

Route	Purpose
`/admin/overview`	Admin overview
`/admin/users`	User management
`/admin/providers`	Provider management
`/admin/provider/:id`	Provider detail
`/admin/bookings`	All bookings
`/admin/payments`	Payment management
`/admin/subscriptions`	Subscription management
`/admin/disputes`	Dispute resolution
`/admin/promotions`	Promotion management
`/admin/referrals`	Referral management
`/admin/seller-leads`	Seller leads
`/admin/reviews`	Review moderation
`/admin/reports`	Platform reports
`/admin/settings`	System settings
`/admin/verifications`	Provider verifications
`/admin/certifications`	Certification management
`/admin/audit-log`	Audit log
`/admin/security`	Security settings
`/admin/feature-flags`	Feature flag management
`/admin/communications`	Communication management
`/admin/compliance`	Compliance settings
`/admin/domains`	Domain management
`/admin/integrations`	Integration management
`/admin/marketing`	Marketing campaigns
`/admin/notifications`	Notification management
`/admin/partners`	Partner management
`/admin/privacy`	Privacy settings
`/admin/support`	Support management

User Routes

Route	Purpose
`/settings`	User settings
`/settings/profile`	Profile settings
`/settings/security`	Security settings
`/settings/notifications`	Notification preferences
`/settings/payments`	Payment methods
`/settings/api-keys`	API key management
`/settings/loyalty`	Loyalty program
`/settings/account`	Account settings
`/settings/plan`	Plan management
`/settings/provider`	Provider settings
`/settings/smart-notifications`	Smart notification settings
`/checkout`	Checkout and payment
`/onboarding`	Provider onboarding wizard
`/nps-survey`	NPS customer satisfaction survey
`/[user]/bookings/:id`	Booking details
`/[user]/my-bookings/:id`	My booking history
`/[user]/chat/:conversationId`	Chat conversation
`/[user]/notifications/:notificationId`	Notification details
`/[user]/badges`	Achievement badges
`/[user]/checkin-qr`	Check-in QR codes
`/[user]/deposits`	Deposit payments
`/[user]/group-bookings`	Group bookings
`/[user]/loyalty-level`	Loyalty level
`/[user]/recurring-bookings`	Recurring bookings
`/[user]/streaks`	Booking streaks
`/[user]/video-consultations`	Video consultations
`/[user]/waitlist`	Waitlist
`/[user]/settings/device-tokens`	Device token management
`/[user]/settings/notification-batching`	Notification batching
`/[user]/settings/notification-preferences`	Notification preferences
`/[user]/settings/preferences`	User preferences
`/[user]/settings/security`	Security settings

Partner Routes

Route	Purpose
`/partner`	Partner dashboard
`/partner/referral`	Referral overview
`/partner/referral/overview`	Referral overview
`/partner/referral/links`	Referral links
`/partner/referral/earnings`	Referral earnings
`/partner/referral/referrals`	Referred accounts
`/partner/referral/leaderboard`	Leaderboard
`/partner/referral/resources`	Partner resources
`/partner/referral/settings`	Partner settings
`/partner/seller`	Seller overview
`/partner/seller/overview`	Seller overview
`/partner/seller/leads`	Seller leads
`/partner/seller/deals`	Deal management
`/partner/seller/earnings`	Seller earnings
`/partner/seller/leaderboard`	Seller leaderboard
`/partner/seller/materials`	Seller materials
`/partner/seller/settings`	Seller settings

API Routes

Route	Purpose
`/api/rpc/$`	oRPC API endpoints
`/api/rest/$`	REST API fallback
`/api/docs`	API documentation page
`/api/template/:templateId/contact-send-message`	Template contact form

Additional Routes

Route	Purpose
`/search/:query`	Search results
`/search/semantic`	Semantic search
`/redirect/:code`	Short URL redirect
`/portal`	Portal access
`/products`	Products page
`/policies/*`	Policy pages (terms, privacy, cookies, etc.)
`/resources`	Resources overview
`/resources/providers-guide`	Provider guide
`/resources/user-guide`	User guide

Server Handlers (21 handler groups)

Server-side oRPC handlers under src/server/ with 780+ files:

Handler Group	Path	Description
Admin	`src/server/admin/`	Admin operations — users, providers, disputes, promotions
AI	`src/server/ai/`	AI-powered features and OpenAI integration
Billing	`src/server/billing/`	Billing and subscription operations
Blog	`src/server/blog/`	Blog content management
Chat	`src/server/chat/`	Real-time chat operations
Checkout	`src/server/checkout/`	Payment checkout and Stripe integration
Communication	`src/server/communication/`	Email, SMS, and notification dispatch
Feature Flags	`src/server/feature-flags/`	Feature flag management and evaluation
Integrations	`src/server/integrations/`	Third-party integrations
Loyalty Program	`src/server/loyalty-program/`	Loyalty points and rewards management
Notifications	`src/server/notifications/`	Notification management
Partners	`src/server/partners/`	Partner referral and seller operations
Payments	`src/server/payments/`	Payment processing and Stripe Connect operations
Provider	`src/server/provider/`	Provider operations — bookings, services, staff, reviews
Realtime	`src/server/realtime/`	Real-time update handlers
Reviews	`src/server/reviews/`	Review and rating operations
Search	`src/server/search/`	Search and filtering operations
Social Sharing	`src/server/social-sharing/`	Social sharing link generation
Support	`src/server/support/`	Support ticket operations
User	`src/server/user/`	User profile and settings operations
Video	`src/server/video/`	Video consultation operations

Integration Workspaces

Apple Business Connect (`integrations/apple-business-connect`)

Server-side API client for Apple Business Connect, enabling booking actions and business data sync.

Feature	Description
Booking Actions	Create book, reserve, and waitlist actions
Business Connect Client	API client for Apple Business Connect
Server-side Only	Never imported into client-side code
Zod Validation	All API inputs validated with Zod

Google Maps Booking (`integrations/google-maps-booking`)

Server-side API client for Google Maps Booking (Google Business Profile), enabling merchant/service feed management, booking server callbacks, waitlist, and channel orders.

Feature	Description
OAuth2 Auth	Google service account JWT signing via jose
Feeds	Create merchants, services, and availability slots
Booking Server	Router for Google Booking Server callbacks (9 endpoints)
Waitlist	Join, get info, and leave waitlist via `/v3/JoinWaitlist`, `/v3/GetWaitlistInfo`, `/v3/LeaveWaitlist`
Channel Orders	Create and update orders via `/v3/CreateOrder`, `/v3/UpdateOrder` with `channel_orders` and `channel_order_items` tables
Webhook Security	HMAC-SHA256 signature verification with constant-time comparison, 5-minute replay window, idempotency via event ID
Platform Adapter	Maps Google entities to platform via `channel_connections` and `channel_listings` with status mapping
Sandbox Mode	Configurable via `GOOGLE_MAPS_BOOKING_SANDBOX` env var
Server-side Only	Never imported into client-side code

Channel Orders (New)

Channel orders use migration 0040-channel-orders.ts with two tables: channel_orders (status: pending/confirmed/cancelled/fulfilled) and channel_order_items (links to inventory_items). External order ID format: gmo-{connection_id}-{service_id}-{timestamp}.

Claude App (`integrations/claude-app`)

MCP server for Claude AI integration using Claude Agent SDK.

Feature	Description
MCP Protocol	Standard MCP server over stdio
Booking Tools	Query bookings, create bookings, manage availability
Customer Tools	Search customers, update customer info
Provider Tools	Get provider info, manage services
Auth	API key based authentication

ChatGPT App (`integrations/chatgpt-app`)

MCP server for ChatGPT integration using Codex Plugin format.

Feature	Description
Codex Plugin	ChatGPT-compatible plugin format
MCP Protocol	Standard MCP server
Shared Tools	Uses `@booking/integrations-shared` for tool definitions

LINE LIFF (`integrations/line-liff`)

LINE LIFF web app running inside LINE in-app browser.

Feature	Description
LIFF SDK	`@line/liff` for LINE integration
Profile	Get LINE profile and login
Messages	Send messages via LIFF
Share	Share content via LINE

Integrations Shared (`integrations/shared`)

Shared utilities for all integration workspaces.

Export	Description
`src/index.ts`	Common types and utilities
`src/tools.ts`	MCP tool definitions
`src/client.ts`	Client utilities for API communication

Mobile App (`apps/mobile`)

Capacitor-based mobile app with native features:

Feature	Plugin	Description
App Lifecycle	`@capacitor/app`	App lifecycle management
Camera	`@capacitor/camera`	Camera access for photos
Geolocation	`@capacitor/geolocation`	Location services
Haptics	`@capacitor/haptics`	Haptic feedback
Local Notifications	`@capacitor/local-notifications`	Local push notifications
Preferences	`@capacitor/preferences`	Local data persistence
Push Notifications	`@capacitor/push-notifications`	Remote push notifications
Share	`@capacitor/share`	Native share sheet
Biometric Auth	`@capgo/capacitor-native-biometric`	Fingerprint/face authentication

Documentation Site (`apps/docs`)

VitePress documentation with dynamic data:

Component	Data Source	Description
`ProjectOverview`	`project.json`	Project info, version, branch, last commit
`FeaturesTable`	`features.json`	All routes and modules from codebase scan
`TestResults`	`test-results.json`	Test status across workspaces
`ReleaseTimeline`	`releases.json`	Git tags and release history
`CommitHistory`	`releases.json`	Recent commits with conventional commit types

Health CLI (`tools/health`)

Project health analysis CLI (@booking/tools-health) with 60+ category analyzers across 5 domains:

Domain	Categories	Description
User-Facing	9	Accessibility, responsive design, i18n, UX/UI, PWA
Security & Compliance	8	Auth, RBAC, secrets, input sanitization, data leak
Backend & Data	16	API, database, caching, queue, webhooks, migrations
Infrastructure	10	Deployment, CI/CD, monitoring, caching, cost
Code & Architecture	17	Code quality, types, naming, testing, dependencies

Project Overview — Architecture and tech stack
Workspaces — Workspace details
All Features — Dynamic features table from codebase
API Overview — API endpoints reference

previous: Project Overviewnext: Workspaces

Features ​

Website Modules (18 top-level modules) ​

Provider Sub-modules (30+ modules) ​

Booking Cart & Checkout ​

Checkout Flow ​

Slot Validation (validateBookingSlotAvailability) ​

Cancellation Policy ​

Loyalty Program ​

Payments ​

Payment Methods ​

Payment Intent Flow ​

LINE Pay Response Validation ​

Security & Infrastructure ​

Production Environment Validation ​

Fail-Closed Authorization ​

FCM Token Cleanup ​

Redis Cache Error Logging ​

Webhook Payload Redaction ​

Deployment Typecheck Enforcement ​

Authentication System ​

Auth Methods ​

Password Requirements ​

Server-Side Sessions ​

Passkey/WebAuthn Flow ​

MFA (TOTP) ​

RBAC ​

Key Routes (295 route files) ​

Public Routes ​

Auth Routes ​

Provider Dashboard Routes ​

Admin Routes ​

User Routes ​

Partner Routes ​

API Routes ​

Additional Routes ​

Server Handlers (21 handler groups) ​

Integration Workspaces ​

Apple Business Connect (integrations/apple-business-connect) ​

Google Maps Booking (integrations/google-maps-booking) ​

Claude App (integrations/claude-app) ​

ChatGPT App (integrations/chatgpt-app) ​

LINE LIFF (integrations/line-liff) ​

Integrations Shared (integrations/shared) ​

Mobile App (apps/mobile) ​

Documentation Site (apps/docs) ​

Health CLI (tools/health) ​

Related Documentation ​