Work / TakafolSouq
TakafolSouq · سوق التكافل
Live at takafolsouq.comA bilingual local business directory for North Lebanon. Owners register a listing with photos, hours, location and self-declared conduct commitments; staff moderate before anything goes public; visitors search by category, values, or by real distance on a map. A jobs board rides the same moderation pipeline.
448
Translation keys, exact AR/EN parity
24
Business categories
166
Seeded cities, two governorates
41
Server actions, 11 rate-limit buckets
The problem
Small businesses in Akkar and North Lebanon are effectively invisible online: discovery happens by word of mouth and scattered social posts, and there is no consistent way to tell whether a business matches the conduct standards a values-conscious customer cares about. TakafolSouq gives owners a listing they control and visitors a way to filter for exactly that.
What it does
Moderated listings
Draft → pending → approved lifecycle with rejection reasons, suspension, Arabic transactional email, and an audit log on every staff action.
Search built for Arabic
Full-text search over both languages with typo-tolerant autocomplete, plus governorate, category and commitment filters.
Near Me, done properly
A GIST-indexed PostGIS geography column queried with ST_DWithin at 5 to 50 km. Visitor coordinates are never stored or logged.
Trust, stated honestly
Commitment badges and a transparency disclosure, self-declared by the owner, reviewed by staff, and labelled as exactly that in both languages. A declaration system, not a certification scheme.
Reviews & jobs board
Star reviews from users or guests, all staff-moderated; a separate job-posting board reusing the same approval pipeline.
Full admin console
Queues, category CRUD that never orphans a business, staff accounts with forced first-login password change, scheduled house-ad placements.
Engineering notes
Google Maps without the API
About 200 lines parse real coordinates out of whatever Maps link an owner pastes, preferring the place pin over the viewport centre, recovering shortened Plus Codes against a regional reference point. Real distance search at zero third-party cost, rendered on Leaflet + OpenStreetMap.
Signed, cacheable image URLs
Images serve through an HMAC-verified route with a deterministic expiry, so re-signing yields byte-identical URLs, which is what makes browser and CDN caching possible at all.
Login hardened against enumeration
Unknown emails are compared against a dummy bcrypt hash so response time matches a real wrong password; two independent rate-limit buckets; sessions carry a tokenVersion claim so a password change invalidates existing tokens.
RTL correctness, tested live
QA caught phone numbers rendering with digit groups visually reversed in Arabic; the fix, bidirectional isolation with <bdi>, was verified in production. Arabic pluralisation uses full ICU rules, not a one-vs-many split.
Stack
- Framework
- Next.js 16 App Router · React 19 · TypeScript strict
- Data
- PostgreSQL + PostGIS + pg_trgm · Prisma 7
- i18n
- next-intl · locale URL segments · Arabic default
- Images
- sharp pipeline → WebP + thumbnail + blur placeholder
Status: in production since July 2026, self-hosted since August. Verification is documented manual QA against production: no automated suite yet, and we say so.