Screenshots
dispatch-iota-six.vercel.app
dispatch-iota-six.vercel.app
The problem
A delivery app has three kinds of users who must never see or change each other's data. It also has a price that a customer could edit in the browser if the server trusted it.
What I built
- Parcel booking with delivery prices calculated only on the server
- Online payment through SSLCommerz, with payment callbacks that are safe to receive twice
- A public tracking page for any parcel
- Rider applications with license uploads, reviewed and approved by admins
- Role checks on every API route for customers, riders and admins
- Search and filters for orders
The hardest part
Never trust the browser
Anything the browser sends can be edited, so the server recalculates the delivery price from the parcel details and checks the caller's role on every request. Payment callbacks are idempotent: if SSLCommerz sends the same confirmation twice, the parcel is only marked as paid once.