Erin Rai
← All work
Proptech, 2026

GC LAL — gamified cohousing platform

Multi-tenant property, booking, tasks-for-points and payments backend, with a React admin and Flutter tenant app.

Role
Architect and lead developer
Context
GC LAL, Nepal
Scale
~45 Prisma models, 3 clients, staging + production pipelines, Aug – Sep 2026

Background

A cohousing operator needed one system for properties, floors and spaces, booking requests, inventory, resident tasks, invoices and support. Residents earn points for tasks they complete with photo evidence, which feeds into gamified standings.

I designed the whole platform from an empty repo: the NestJS API, the admin web app and the Flutter tenant app, plus the delivery pipeline.

The problem

Several properties share one system, and a resident of one must never see another's data. On a Phase 1 MVP timeline, the usual approach of a tenant filter on every query is the first thing to be forgotten.

Push notifications for bookings and invoices had to be reliable: a notification about a payment that later rolled back is worse than none.

Approach

  1. Enforce tenancy in one place. A Prisma client extension scopes every query by property, so a missing filter is impossible rather than a code-review item.
  2. Auth built for a long-lived mobile session: JWT access tokens with rotating refresh tokens hashed with argon2id, refresh reuse detection, login throttling, invite and access codes.
  3. Transactional outbox for Firebase Cloud Messaging. A push row is written in the same transaction as the change and delivered by a scheduler, so a rollback never sends a notification.
  4. eSewa payment gateway, UAT and production, behind a PaymentIntent model. Audit events and an activity log on every mutation.
  5. Both clients generate their API layer from the backend's OpenAPI spec: openapi-fetch on the web, Retrofit via swagger_parser in Flutter. A breaking API change fails the client build.
  6. Ship with docs: ARCHITECTURE.md, ADRs, SECURITY.md, a delivery plan, and Docker Compose for dev, staging and production with GitHub Actions deploys.

Architecture

gc-backendNestJS 11, Prisma 7, PostgreSQL 17, S3/Spaces, Brevo mail, Swagger, Jest.
gc-adminVite + React 19, Tailwind 4, TanStack Query, Leaflet maps, Vercel. Access token in memory only with silent refresh.
gc-mobileFlutter, Bloc, Clean Architecture, sealed Result and Failure types, FCM.

Outcome

  • Phase 1 MVP delivered as three deployable clients with staging and production pipelines in under a month.
  • API at api.gclal.np with an OpenAPI spec that both clients build against.

Lessons

  • Tenancy at the data-access layer costs a day and removes a category of security bugs for the life of the project.
  • Generated clients are the cheapest contract test a small team can have.

Stack

NestJSPostgreSQLPrismaReactViteTanStack QueryFlutterBLoCeSewaFirebase FCMDockerGitHub Actions