Work / TakafolSouq

TakafolSouq · سوق التكافل

Live at takafolsouq.com

A bilingual local business directory for North Lebanon. Owners register a listing with photos, hours, location and self-declared conduct commitments; staff moderate before anything goes public; visitors search by category, values — or by real distance on a map. A jobs board rides the same moderation pipeline.

448

Translation keys, exact AR/EN parity

Business categories

166

Seeded cities, two governorates

Server actions, 11 rate-limit buckets

Arabic-default home — search over the seeded category tiles.

Near Me — choosing a point on Leaflet and OpenStreetMap, which the PostGIS radius query then ranks by distance.

The problem

Small businesses in Akkar and North Lebanon are effectively invisible online — discovery happens by word of mouth and scattered social posts, and there is no consistent way to tell whether a business matches the conduct standards a values-conscious customer cares about. TakafolSouq gives owners a listing they control and visitors a way to filter for exactly that.

What it does

Moderated listings

Draft → pending → approved lifecycle with rejection reasons, suspension, Arabic transactional email, and an audit log on every staff action.

Search built for Arabic

Full-text search over both languages with typo-tolerant autocomplete, plus governorate, category and commitment filters.

Near Me, done properly

A GIST-indexed PostGIS geography column queried with ST_DWithin at 5–50 km. Visitor coordinates are never stored or logged.

Trust, stated honestly

Commitment badges and a transparency disclosure — self-declared by the owner, reviewed by staff, and labelled as exactly that in both languages. A declaration system, not a certification scheme.

Reviews & jobs board

Star reviews from users or guests, all staff-moderated; a separate job-posting board reusing the same approval pipeline.

Full admin console

Queues, category CRUD that never orphans a business, staff accounts with forced first-login password change, scheduled house-ad placements.

Engineering notes

Google Maps without the API

~200 lines parse real coordinates out of whatever Maps link an owner pastes — preferring the place pin over the viewport centre, recovering shortened Plus Codes against a regional reference point. Real distance search at zero third-party cost, rendered on Leaflet + OpenStreetMap.

Signed, cacheable image URLs

Images serve through an HMAC-verified route with expiry rounded into one-hour buckets, so re-signing yields byte-identical URLs — which is what makes browser and CDN caching possible at all. Unapproved listings' images are simply never signed.

Login hardened against enumeration

Unknown emails are compared against a dummy bcrypt hash so response time matches a real wrong password; two independent rate-limit buckets; sessions carry a tokenVersion claim so a password change invalidates existing tokens.

RTL correctness, tested live

QA caught phone numbers rendering with digit groups visually reversed in Arabic; the fix — bidirectional isolation with <bdi> — was verified in production. Arabic pluralisation uses full ICU rules, not a one-vs-many split.

Stack

Framework: Next.js 16 App Router · React 19 · TypeScript strict
Data: PostgreSQL + PostGIS + pg_trgm · Prisma 7
i18n: next-intl · locale URL segments · Arabic default
Images: sharp pipeline → WebP + thumbnail + blur placeholder
Hosting: Self-hosted Docker VPS · Caddy · Redis rate limiting · nightly backups

Status: in production since July 2026, self-hosted since August. Verification is documented manual QA against production — no automated suite yet, and we say so.

Start a project →