FlexRide – Car Rental Platform

The hackathon version worked well enough to demo, but it carried real bugs: an admin self-promotion endpoint, a reservation-override flow that could silently drop a booking, and payment logic with no protection against concurrent double-submits. The challenge for the rebuild wasn't just re-implementing features — it was auditing every security- and money-adjacent path for the kind of bug that only shows up under real concurrent load, and fixing what I found instead of re-shipping it.

Next.js App Router throughout, with Server Components doing data fetching and Suspense isolating anything auth-dependent so the shell renders instantly instead of blocking on session checks. Auth is NextAuth v5 (Credentials provider) backed by MongoDB/Mongoose. Payments use a two-PaymentIntent Stripe pattern — a manual-capture deposit hold plus an auto-capture rental charge — with atomic findOneAndUpdate claims guarding both the checkout flow and referral-reward crediting against double-charge and double-credit race conditions. The data layer wraps reads in unstable_cache with granular tags, exposed through thin Route Handlers to a TanStack Query client. The admin dashboard is demo-safe: any authenticated user can browse it, but every mutation checks isAdmin server-side, with non-admins seeing disabled controls instead of a locked-out screen.

Built incrementally, phase by phase, with every phase typechecked, linted, built, and verified live in a browser before moving on — not just checking that a build agent's summary sounded right. That verification pass caught real bugs after the fact, not just during initial development: two payment/referral race conditions found by reading the actual money-handling code path, a layout bug where the public navbar bled through and ghosted over the admin sidebar's logo on admin routes, and a full-page loading flash on the homepage and after logout caused by an auth check blocking the entire route instead of just the section that needed it.