Hidden Leaves · 2026
Hotel and tour booking platform
Shipped
- Role
- Independent engineer
- Stack
- Next.js, TypeScript, Prisma, NextAuth
- Status
- Shipped
- Live
- hiddenleaves.scrocle.cloud
Problem
Operators needed a product for stays and tours — discovery, reservations, accounts, and reviews — not a brochure with a third-party widget glued on. Off-the-shelf booking tools would not carry guest, staff, and admin roles on the same surface, or keep price calculation off the client.
Constraint
The public demo has to prove the product without exposing customer contact details or administrative backdoors. Sanitized credentials live on the live page.
Architecture
- Browser
- Next.js
- NextAuth
- Prisma
- Guest
- Staff
- Admin
Decisions
Next.js as the product
One TypeScript application for the public catalog, the reservation flow, and the staff surfaces. Not a marketing site in front of a separate admin.
Pricing on the server
Amounts are calculated where the guest cannot edit them. The browser displays the quote; it does not author it.
Roles as enforcement
Guest, staff, and admin are checks on mutations, not labels in the UI. Review submission is not the same as review publication.
Prisma and NextAuth
Stays, tours, reservations, and accounts in one schema. Sessions through NextAuth so role checks sit next to the queries they protect.
This is the web product I can put in front of a buyer without a slide. You can create an account, look at stays and tours, and see that pricing and roles are not theatre.
The screenshot is the live UI, not a mock. If you need a private deployment, the same codebase is the starting point — not a rewrite behind a different brand.
Outcome
Shipped. The demo at hiddenleaves.scrocle.cloud is a complete booking surface. Demo credentials are on that page.
What was handed over
- Source and schema
- Role map and which mutations each role may call
- How to run locally and how the production host is started
- What is sanitized in the public demo versus a private deployment