Built by 
About this software
About Haven — Small Hotel Front Desk & Room Booking
Haven gives guesthouses and small hotels with 5–50 rooms one place to run their front desk. See room availability, manage reservations, check guests in and out, track housekeeping and record payments already received. Print a stay invoice or save it as PDF. Booking confirmations open an email draft, with optional direct delivery through your own Resend account.
Includes React web application, Node.js 24+ server, SQLite storage and optional Neon PostgreSQL, setup guides, database scripts and tests. Shared administrator access serves one property. No card charging, separate staff accounts, OTA sync, tax engine, automatic refunds or native mobile app. Hosting, domains and email-provider costs are separate.
Customization: Settings edits the hotel name, address, email and phone used on invoices and confirmations. Changing the app logo, brand colours or favicon requires editing src/main.jsx, src/style.css, index.html and public/favicon.svg, then rebuilding the app. Amounts are fixed to USD. There is no currency selector or tax setting.
Why Haven — Small Hotel Front Desk & Room Booking
What makes it better
than the alternatives
- 01
Room status at a glance
See available, occupied and cleaning rooms with floor filters.
- 02
Reservation calendar
View upcoming stays by room and prevent overlapping bookings.
- 03
Guided arrivals and departures
Check guests in and out with room-readiness and balance checks.
- 04
Clear stay balances
Record deposits and payments, then print a stay invoice.
- 05
Flexible hosting
Run with SQLite or optional Neon PostgreSQL using included setup guides.
Rooms and housekeeping
- inventory
- floor/status filters
- add rooms
- cleaning and ready transitions.
Reservations and guests
- seven-day room calendar
- searchable booking list
- guest directory
- reservation details and overlap validation.
Arrivals and departures
- check-in within booked dates
- clean-room guard
- checkout balance guard and room-status updates.
Payments and invoices
- manual deposit/payment records
- cent-precision balances
- overpayment checks and printable stay invoices.
Confirmations
- email-app drafts; optional direct delivery using buyer-owned Resend account and verified sender.
Workspace and hosting
- property contact settings
- shared administrator login
- signed sessions
- SQLite or Neon PostgreSQL
- conflict protection and 15-second refresh.
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| CSS | — | — | Styling | 53.6% |
| JavaScript (React) | — | — | Front-end | 40.6% |
| JavaScript | — | — | Front-end | 5.3% |
| SQL | — | — | Database | 0.5% |
| HTML | — | — | Front-end | 0% |
- Primary language
- JavaScript (Node.js 24+)
- Framework
- React 19.3.1 + Vite 8.0.0
- Database
- SQLite bundled with Node.js 24+; optional Neon PostgreSQL 17 (verified)
- Authentication
- Single shared administrator password; HMAC-signed HttpOnly session cookie; HTTPS Secure cookie on hosted demo
- Licence
- Single-site
- Screens
- 8
- Database tables
- 1
- Supported languages
- English only
- Browser support
- Modern browsers (Chrome, Firefox, Safari, Edge); tested with Chrome via Playwright
| Minimum | Recommended | |
|---|---|---|
| CPU | Shared CPU | 1 vCPU |
| RAM | 512 MB RAM (hosted demo verified) | 1 GB RAM; size for actual usage |
| OS | Node.js 24+ on Linux, macOS or Windows | Node.js 24+ on Linux, macOS or Windows |
| Est. monthly hosting | $0 | $0 |
From extracted Node Project directory, with Docker Engine and Compose installed: ```sh cp .env.example .env # Edit .env: set your own ADMIN_PASSWORD (12+ characters) and long random SESSION_SECRET. docker compose up --build -d ``` Open http://127.0.0.1:5177. Compose binds loopback; use an HTTPS reverse proxy for public hosting and set COOKIE_SECURE=true. SQLite persists in haven-data volume. Optional server-side DATABASE_URL selects Neon.
Install Node.js 24+ and npm. Use a dedicated unprivileged account. From Node Project directory: ```sh npm ci cp .env.example .env # Edit .env with your own ADMIN_PASSWORD and SESSION_SECRET; set persistent DATA_DIR or private Neon DATABASE_URL. npm run build npm start ``` On Windows, copy .env.example to .env in File Explorer or use Copy-Item .env.example .env in PowerShell. Database initializes automatically on all supported platforms; no sqlite3 CLI or mkdir command is needed. Fictional guest seed requires DEMO_MODE=true. Keep HOST=127.0.0.1 behind HTTPS reverse proxy. Set COOKIE_SECURE=true for HTTPS. Use a process manager; systemd example in HowToSetup.md. Keep real guest records out of public demo. Demo currently uses free Render/Neon tiers, subject to limits and idle sleep. Production hosting, domain, backups and optional email delivery may cost extra. Setup guide covers backup, migration and rollback.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (2 minor)
Strong authentication on all mutating endpoints; minor ownership gap on guest reads; database access is mostly safe; missing foreign key indexes and one unscoped delete. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
