Built by 
About this software
About Velora - Car Rental Booking Platform
Velora is a Next.js 16 / React 19 car rental platform backed by Postgres (Neon or standard Postgres) via Drizzle ORM. The public storefront covers fleet browsing, car detail with a price quote, booking, a booking lookup by reference, branch listings, CMS pages and per-vendor storefronts. An /admin console manages cars, categories, locations, coupons, bookings, customers, testimonials, FAQs, pages, media, users, settings and vendors. The digest shows 24 admin screens and 13 public page routes (routes counted from the file tree; some are dynamic). Docker Compose and Dockerfile deployment is included, plus a Playwright test file for multivendor behaviour. No mobile app, payment gateway, or multi-language support is evidenced in the digest.
Why Velora - Car Rental Booking Platform
What makes it better
than the alternatives
- 01
Double-booking protection
Checkout uses a Postgres advisory transaction lock (pg_advisory_xact_lock on the car) through a dedicated WebSocket transaction client, per the README and CLAUDE.md.
- 02
Multi-vendor tenancy
Admin users carry a vendorId or superadmin flag, with a requireSuperAdmin guard, per-vendor storefront routes ([vendor_slug]) and vendor-scoped queries.
- 03
Media stored in the database
Pre-encoded AVIF car images (90 files) are kept in Postgres and served from a /media/[id]/[checksum] route, avoiding third-party image hosts.
- 04
Hardened admin auth
Scrypt password hashing, hashed session tokens in the DB, httpOnly cookie with 14-day TTL, login throttling (5 attempts per 15 minutes by IP and email) and safe redirect checks. Throttle state is in-memory, so it is per-process.
- 05
Self-host ready
Dockerfile and docker-compose with Postgres 16, schema.sql and seed.sql, drizzle migrations, seed scripts with generated passwords if unset, plus setup, ERD and API reference docs.
Storefront
- Home page with hero
- stat band
- and FAQ list
- Fleet listing with filters
- sort and pagination
- Car detail page with gallery and booking panel
- Locations
- how-it-works and CMS pages (/
p/[slug]) - Sitemap and robots routes
Booking Engine
- Pricing logic with daily
- weekly and monthly rate tiers per README
- Add-on extras and tax rate calculation per README
- Coupon engine with percentage or fixed discounts
- minimum days
- usage limits and validity windows per README
- Booking confirmation page by reference
- Self-service lookup at /my-bookings by reference and email
Fleet and Catalog Admin
- Car create and edit forms
- Category management
- Branch/location management
- Media library
Booking Operations
- Bookings list and booking editor
- Customers screen
- Coupons admin
CMS Content
- Pages
- FAQs and testimonials editors
- Site settings form (hero copy
- tax rate
- announcement bar per README)
Multi-Vendor
- Vendor create
- edit and list screens for superadmin
- Vendor-specific storefront and car listing pages
- Tenant-scoped server actions via requireUser and canManage
Users and Security
- Admin login with role-based access
- User management screen
- Activity log recording login
- logout and changes
- Zod validation on server actions
Analytics Dashboard
- Admin dashboard with revenue chart
- Revenue metrics
- top vehicles and activity log per README
Deployment and Tooling
- Docker and Compose setup
- Drizzle migrations
- seed and reset scripts
- Playwright E2E config and multivendor spec
- VPS setup guide (HowToSetup.md)
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| TypeScript (React) | — | — | Front-end | 60% |
| TypeScript | — | — | Front-end | 33% |
| SQL | — | — | Database | 6% |
| CSS | — | — | Styling | 1% |
- Primary language
- TypeScript 5.9.3 on Node.js 20+ (Dockerfile builds on Node 22 Alpine)
- Framework
- Next.js 16.4.3 (App Router) with React 19.2.8
- Database
- PostgreSQL 15+ (Neon serverless or standard Postgres; docker-compose uses postgres:16-alpine)
- Authentication
- Email and password admin login with hashed passwords, server-side sessions stored as SHA-256 token hashes in a cb_session cookie, and per-IP and per-email login throttling
- Licence
- Single-site
- Screens
- 30
- Database tables
- 15
- Supported languages
- English only; no i18n library or translation files in the code. RTL not supported.
- Browser support
- Modern evergreen browsers (Next.js 16 baseline). The code does not define an explicit browser matrix.
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU |
| RAM | 4 GB RAM for the app, plus a PostgreSQL instance | 8 GB RAM for the app, plus a dedicated PostgreSQL instance |
| OS | Linux (Ubuntu VPS or Alpine container) with Node.js 20+ and PostgreSQL 15+ | Linux (Ubuntu VPS or Alpine container) with Node.js 20+ and PostgreSQL 15+ |
| Est. monthly hosting | $20 | $20 |
Runs the Next.js app and PostgreSQL through docker-compose. Set POSTGRES_PASSWORD in .env first. ``` cp .env.example .env # edit .env and set POSTGRES_PASSWORD docker compose up -d --build docker compose exec app npm run db:seed ```
Runs the app directly on a Linux server. Requires Node.js 20+ and a reachable PostgreSQL database. ``` npm ci cp .env.example .env.local # set DATABASE_URL and DATABASE_URL_UNPOOLED npm run db:migrate SEED_ADMIN_EMAIL=you@example.com SEED_ADMIN_PASSWORD='<strong-password>' npm run db:seed npm run build npm start ``` Place Nginx in front of port 3000 and keep the app running under PM2.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (3 minor)
No real credentials found; weak default passwords and db credentials ship in seed, env example and compose; reasonably structured next.js codebase; some oversized files and hard-coded demo values to extract; drizzle-parameterized access, but most db code and the schema files were not visible, so key checks could not be confirmed; lockfile present, but caret ranges, odd neon packages, and pinned-claim mismatch need attention; auth and password hashing look sound, but most routes and actions could not be verified for guards. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
