I build the whole vertical slice

Built a society management platform where resident, security guard, society admin, maintenance staff and a platform super admin each get their own shell behind a single sign-in. The billing taught me the most: generating recurring rent and maintenance lazily on read, deduplicated against what exists, made the job idempotent — but only because deletion is soft, since a hard-deleted bill looks identical to a missing one to the generator.

Started the marketplace with the database rather than the endpoints. The initial Prisma migration landed on 13 June, followed within a week by a marketplace restructuring, featured promotions, menus and campaigns, flyer PDFs, geo-aware notifications, reviews and plans — each as its own incremental migration rather than a schema rewrite.

Built the backend as one module per domain — restaurants, promotions, coupons, loyalty, referrals, catering, staff, subscriptions, campaigns, devices, reviews, admin. A Firebase auth guard and a parameter decorator made identity a structural concern instead of something every controller re-derived.

Shipped the app carrying both the diner and owner experiences behind a role gate at the root — around thirty screens across two shells, plus device-level work: GPS proximity, maps, QR scanning for coupon redemption, and FCM push registration.

Built the admin surface as its own Next.js App Router application rather than another tab in the owner app — different auth posture, different risk, different device. Non-destructive moderation via a suspension flag, with privileged actions written to an audit log.

Added flyer scanning so an owner could photograph existing paper marketing instead of filling in a form. The interesting constraint was making the output trustworthy: a fixed JSON schema with an enum kept in sync with the app's categories, and an explicit failure when no API key is configured, so one unconfigured feature never breaks promotion creation.

Built i-Bank as a counterweight to DealPlate's federated identity — self-issued JWTs through a Passport strategy and a guard, with unit tests concentrated on the auth service and controller. Building both clarified the actual trade-off: control over token lifetime versus not owning credential storage.

AudioScript went the other way: a Flutter transcription client calling Groq's Whisper endpoint directly on the user's own API key. Removing the server removed the trust question with it — a reminder that architecture decisions are often product decisions wearing a technical hat.