House Rental Management System – A Full-Stack Solution for Renters, Owners, and Admins

Bari Vara is a web-based house rental platform built around one idea: in Dhaka, the hard part is not finding a listing, it is getting a reply.

Instead of functioning as another generic "call the owner" classifieds board, every listing on Bari Vara connects to a reachable owner backed by a dated visit request workflow that both parties can track in real time. The system supports three distinct roles—Tenant, Owner, and Admin—and is built across two production-deployed repositories:

Frontend: Next.js 16 (App Router) deployed on Vercel
Backend: Express 5 + MongoDB + Redis API

Key Features

1. User Roles and Functionalities

Visitors (No Account Needed)

Comprehensive Browsing: Explore every published flat with high-resolution photos, monthly rent, service charge, bedroom/bathroom/balcony counts, square footage, availability date, amenities, flat rating, and owner rating.
Advanced Search & Filtering: Filter by Dhaka area, category (family, bachelor, sublet, office), rent range, minimum bedrooms/bathrooms, specific amenities, "available before" date, and radius-based proximity search.
Sorting & Pagination: Sort results by newest, price, or rating with server-side pagination.
Full Detail View: Inspect the complete listing page—including photo gallery, amenity list, owner profile card, and tenant reviews—prior to registration. Creating an account is required only to book a visit.

Tenants

Flexible Authentication: Register with email and an OTP verification flow, or sign in via Google OAuth in one click (existing password-based accounts sharing the same email are linked automatically).
Visit Requests: Submit a visit request specifying a desired visit date, NID, and an optional message. Profiles require an address and phone number on file before requesting, ensuring owners always have reliable contact channels.
Dashboard Tracking: Monitor all visit requests from a personal dashboard, cancel pending requests, and view owner decisions alongside review notes.
Two-Way Ratings & Reviews: Rate and review both the flat and its owner (1–5 stars each) with qualitative feedback. Enforces one review per flat per person; resubmissions update the existing review rather than duplicating entries.

Owners

Role Elevation: Request owner access directly from a standard account, subject to admin review and approval.
Listing Management: Create listings with 1–10 photos uploaded to Cloudinary, complete address metadata (area, division, postal code) geocoded into map coordinates, amenity checklists, and detailed pricing.
Lifecycle Control: Update listing details post-publication, toggle listing status between Available and Booked, and delete listings cleanly—automatically purging associated photos, reviews, and bookings to prevent orphaned records.
Visit Request Queue: Manage incoming requests through a dedicated queue to approve or reject with optional feedback notes. Approving schedules the visit, keeping the action of marking the property as rented distinct and deliberate.

Admins

Unified Analytics Dashboard: Powered by a single aggregation query detailing:
- Total users, owners, listings, available listings, bookings, pending bookings, reviews, and average platform rent.
- Bookings segmented by status.
- Listings categorized by property type.
- Area-wise listing density across Dhaka with average rent metrics.
- A gap-filled 12-month trend graph tracking user signups, listing creations, and booking volumes.
User & Role Management: Search and filter users by role, promote or demote permissions, and approve or deny pending owner applications.
Content Moderation: Full administrative oversight to inspect and remove any listing across the entire platform.

2. Authentication and Session Security

Cookie-Based Security: Authentication relies entirely on secure, httpOnly cookies—eliminating client-side bearer tokens in local storage.
Dual-Token Rotation: Uses short-lived access tokens (15 minutes) alongside rotating refresh tokens (7 days). Any detected refresh token replay is treated as a security breach, instantly revoking the entire session family.
OTP & Password Reset Pipeline: OTPs are stored securely as hashes inside Redis with strict rate limits and expiration windows. Accounts cannot log in until email verification completes; password recovery runs through the same pipeline.
Edge Middleware Gatekeeping: Next.js proxy middleware enforces role-based route protection across /dashboard, /dashboard/owner, and /dashboard/admin, redirects authenticated users away from auth pages, and performs silent token refreshes at the edge layer capable of writing response cookies.

3. Engineering Approach & Architecture

Shared Schema Contract: Zod schemas act as a single source of truth across both repositories, standardizing request payloads, URL query parameters, and response DTOs.
Layered API Pattern: The backend enforces a strict routes → controller → service → serializer flow, ensuring internal Mongoose documents are never leaked to clients, and standardizing all responses into typed envelopes with defined error codes.
Redis Utility: Powers token storage, OTP management, rate limiting, and an intelligent browse-results cache invalidated on any write operation to listings.
Optimized MongoDB Indexing:
- 2dsphere index for geospatial radius and proximity queries.
- text index for full-text keyword searches.
- Compound indexes optimized for live browse, sort, and queue queries.
- Partial unique index enforcing exactly one active visit request per tenant per listing, while allowing tenants with previously rejected requests to reapply.
Quality Assurance & Tooling: Both codebases are end-to-end type-safe and tested via Vitest (using Supertest and an in-memory MongoDB runner on the API). A unified database seeder generates functional demo accounts for all roles out of the box.

Why This Project Stands Out

Most rental applications stop at basic CRUD operations over a flat database table. Bari Vara is engineered as an end-to-end product:

Robust RBAC Model: Three-tier permission architecture with a formal approval workflow for role upgrades.
Deterministic State Machine: Booking workflows enforce strict status transitions rather than raw string mutations.
Automated Rollups: Aggregate rating computations keep flat and owner scores updated synchronously as reviews are created or revised.
SEO & SSR Readiness: Complete metadata implementation including dynamic sitemaps, robots.txt, web manifests, Open Graph preview cards, and structured JSON-LD schemas.
Polished UX: Full light and dark mode support alongside explicit loading skeletons, zero-state displays, and error boundaries.

Bari Vara

About the project