Trimsmith

Checking availability and then writing a row is a race, and races are won in production at the worst possible moment. The guarantee belongs in the database, not in application code that can be run twice at once.

A PostgreSQL exclusion constraint makes an overlapping booking for the same barber physically impossible to insert. Checkout runs as a hold, then a confirm, inside serializable transactions, and the constraint sits underneath as the backstop that cannot be bypassed by any code path, present or future.

"Average wait: 20 minutes" is a number that is wrong for everybody. The person who wants a beard trim and the person who wants colour are not waiting the same length of time.

Every clocked-in barber is modelled as a chair. Occupied chairs count down their remaining service; everyone waiting is dealt onto the earliest chair that frees up. The estimate a customer sees on the website is the same model the shop screen runs on.

This is also why attendance matters operationally rather than just for payroll: nobody clocked in means the model assumes one chair, and the floor looks slower than it is.

A store manager needs to see money, but only their own store’s money. Collapsing "what may you do" and "where may you do it" into a single role list is how a manager at one shop ends up reading another shop’s takings.

A role grants capabilities. A separate set of records pins a person to specific locations. Both are checked on every request, server-side. An out-of-scope request is refused outright rather than quietly returning an empty list, a silent empty result hides a bug until it is a breach.

Multi-tenancy retrofitted later is a rewrite. Every owned record has carried a tenant from the first migration, and every query is scoped on the server.

Branding, currency, timezone, booking policy and queue rules live in per-salon settings. Onboarding a whole new salon happens in one transaction from an admin screen, with no engineer involved. A second tenant runs in the same deployment today, which is how we know the path works.

No floating-point number touches a price. Every amount is an integer in minor units, converted only at the edge where it is displayed. Rounding errors in a deposit are not a rounding error to the customer.

Time is stored in UTC, but every location carries its own IANA timezone and all day-boundary maths runs through it. "Today’s takings" means today at that shop, never today on the server.

An owner signed in on the booking site is signed in on the dashboard. A customer who checks out as a guest is signed in from the moment they book, without a second form.

Sessions are minted by the API and set as a cookie by whichever app the browser is actually talking to, so the browser only ever speaks to one origin, and no cross-site cookie configuration exists to be got wrong. Passwords are stored as scrypt hashes; an email that already has a Google account cannot be claimed with a password.