EkaVio.

The problem

Shops, clinics, salons and service businesses need to coordinate customers, appointments, queues, inventory, dues and attendance. EkaVio brings these workflows together while keeping each organization’s people and records in the right context.

My role

I design and develop the React/Vite PWA, Express/TypeScript API, data model and delivery tooling as an independent full-stack project. The work spans usable frontend workflows, server-side access control and the migration to a single runtime data store.

Designed for organizations and branches

An organization can have multiple branches and members. Access is resolved through active membership and branch assignments. Selecting an organization or branch requests a context; the server decides whether that context is allowed.

Sessions that can be revoked

Refresh credentials travel in HttpOnly cookies. Access JWTs stay in browser memory, while server-side sessions make revocation possible. Protected HTTP requests and realtime connections validate the session and resolve membership before granting access.

• HttpOnly refresh cookies
• In-memory access JWTs
• Revocable server-side sessions
• Server-validated organization and branch context

Permissions and entitlements

RBAC answers what a member may do. Commercial entitlements answer which capabilities an organization has. Keeping these decisions separate lets protected operations check the member’s permission alongside the organization’s module access.

One runtime source of truth

PostgreSQL is the sole normal runtime data authority, covering identity, commercial entitlements and operational records. Transactional migrations, parity checks and cutover tooling support that transition. MongoDB remains only for explicit legacy migration, reconciliation, archive/recovery and compatibility tooling; normal server startup and readiness use PostgreSQL.

Account recovery and invitations

Email becomes login and recovery authority only after verification. Account recovery and password changes revoke sessions, while staff invitations let recipients choose their own passwords. These flows have local integration and browser acceptance coverage; hosted email delivery still depends on deployment configuration.

Realtime with tenant context

Socket.IO supports realtime communication. Context switching reconnects the transport after the server validates the selected organization and branch, so the realtime connection follows the active membership context.

A repeatable development foundation

Docker Compose and health/readiness checks support predictable startup. Repeatable lint, typecheck, test and build gates are paired with transactional migrations, parity checks, API integration tests and browser acceptance tests using disposable local data.

Where it stands

EkaVio is in active development with a public staging site. It is for disposable development data and is not approved for real customer data. Hosted recovery and final operational acceptance remain open; local engineering gates do not establish commercial production readiness.