Palmera - Compound Management and QR Gate Access SaaS

Multi-tenant platform for compounds and resorts with units, rentals, visitor invitations, signed QR gate passes, service requests and a WhatsApp, SMS and email notification engine.

Client

Date

July 2026

Duration

2 weeks

Technologies

13 tools

Technologies Used

Next.js

React

TypeScript

Prisma

PostgreSQL

Tailwind CSS

Zod

Redis

Leaflet

Docker

Vitest

Nodemailer

WhatsApp Cloud API

Project Overview

Palmera is a multi-tenant SaaS for gated compounds, resorts and villages. One database serves many communities, and each tenant gets its own branding, language, feature flags and plan limits. Staff work in an operations console covering units, owners, rentals, visitors, gates, service requests, complaints, invoices, announcements and reports. Owners and residents use a separate portal to invite guests, book amenities, request services and view their QR passes. I built it as a Next.js 16 App Router app with Server Actions, Prisma on PostgreSQL and about 40 data models, with Arabic and English support including RTL layouts.

Challenge

The legacy system this replaces put a visitor's national ID in cleartext inside the QR code, which is a privacy problem and gives guards no way to revoke a pass. The platform also had to keep every tenant's data separate, work when a gate has a weak connection, and reach residents on the channel they actually read. Roles ranged from super admin to guard and resident, and each needed different access. Admin accounts needed stronger protection than a password alone, and the app had to be safe to run across several instances behind a load balancer.

Solution

The QR now carries only a signed token in the form version, pass id, expiry and HMAC signature, so it never contains personal data. The gate verifies the signature offline, then the server checks revocation, the validity window, the assigned gate and scan limits, and writes every scan to an audit table. Tenant isolation is enforced through a single scope helper so every query is filtered by tenantId. Access control uses RBAC plus ownership checks, and admin roles are forced into TOTP two-factor login. Notifications go through a driver layer for the WhatsApp Cloud API, SMS, SMTP email and in-app alerts, with templates, channel fallback and a retry cron. Rate limiting uses Redis when configured.

Results & Impact

The delivered product is a working multi-tenant platform with a console for admins, managers, staff and guards, plus a resident portal. It includes a gate scanner, signed and revocable passes, rental and visit approval workflows with overlap protection, a service catalog with request routing, invoices with printable output, private document storage and audit logging. It ships with a Docker image, health and readiness endpoints, a backup script, a fail-closed secrets check at boot, a GitHub Actions pipeline and a test suite covering access passes, tenant scoping, authorization and notifications. The repo history shows 65 commits over about two weeks in July 2026.