JS Globtech

Car rental platform · JS Globtech

AutoPal

A rental marketplace running across three surfaces — a mobile app, an operations panel and an API — taken from a vendor handoff to a hardened production deployment.

How it was builtWhat it does
SpecificationRev 1.0.4
Status
In production
Surfaces
App · Panel · API
API
Laravel 11 · PHP 8.2
Panel
Angular 15
App
Flutter · Dart 3.8
Data
MySQL 8
Runtime
Docker · nginx · FPM
Auth
OAuth2 bearer

3

Client surfaces

13

Payment gateways

192

Server dependencies

10

Modules vendored in

What it is

One platform, three audiences.

Renters browse and book from their phone. Car owners list vehicles, set availability and track earnings. Operators run the whole marketplace from a browser. All three talk to the same API.

Mobile app

Flutter · Dart 3.8 · v1.0.4

Where renting actually happens.

  • Search and filter cars by category
  • Book by date and time range
  • Pay by card or wallet balance
  • Rate and review past rentals
  • Saved addresses and documents

Operations panel

Angular 15 · compiled bundle

The day-to-day control room.

  • Booking, user and revenue analytics
  • Approve providers, manage listings
  • Reconcile wallets and transactions
  • Answer support tickets
  • Role-based staff permissions

API

Laravel 11 · PHP 8.2 · MySQL

The single source of truth.

  • OAuth2 bearer tokens per client
  • Queued jobs and scheduled tasks
  • Media library for vehicle photos
  • Translatable content per locale
  • Push via Firebase and OneSignal

Capabilities

What the platform does.

Marketplace

  • Provider accounts with their own fleets
  • Categorised listings with photo galleries
  • Search, filters and location scoping
  • Per-car add-ons and fees
  • Availability schedules

Booking

  • Reservations by date and time window
  • Multi-day rentals
  • Status flow from request to return
  • Pickup addresses with coordinates
  • Guest details on the booking

Money

  • In-app wallet with transaction history
  • Top-ups and payout requests
  • 13 payment gateways across regions
  • Card, wallet and hosted checkout
  • Transaction analytics for operators

Trust

  • Ratings and written reviews
  • Aggregate scores per vehicle
  • Favourites and saved cars
  • Support tickets with replies
  • Published FAQ

Reach

  • Per-request locale switching
  • Translatable catalogue content
  • Push notifications to both apps
  • Merchandising banners
  • Email over an HTTPS provider API

Operations

  • Booking and activity dashboards
  • User and provider management
  • Gateway configuration per market
  • Granular staff roles
  • Scheduled deletion with grace period

Runtime

How it runs.

The whole backend ships as a single container image. Four processes come up under one supervisor, and the container configures itself against whatever environment it lands in.

Processes in the image

  1. nginx — serves the panel and proxies PHP
  2. php-fpm — handles API requests
  3. queue worker — mail, push, media
  4. scheduler — recurring tasks

What happens on boot

  1. Write server config for the assigned port
  2. Wait for the database to accept connections
  3. Import schema if empty, then migrate
  4. Generate signing keys, cache config and routes
  5. Report healthy and start serving

The work

From handoff to production.

The platform arrived as a purchased codebase with a vendor's build process attached to it. Getting it to a state worth running in production took five pieces of work.

Containerised the whole stack

Replaced a hand-configured server with one reproducible image: web server, PHP runtime, queue worker and scheduler under a single supervisor, generating its own configuration at boot so the same image runs locally and in production.

Made the build self-contained

Ten modules holding most of the business logic were pulled from a private registry at build time using a credential that could expire or be revoked — a single point of failure outside our control. They now live in the repository and resolve from disk. Builds need no credentials and reach no third-party registry.

Audited and hardened inherited code

A review of the supplied dependencies found a hardcoded authentication bypass and a concealed privileged account. Both were removed, and a verification step now runs on every build that fails the deploy outright if either signature reappears — so the fix cannot be silently undone by a future update.

Fixed the delivery paths that mattered

Mail moved to an HTTPS provider API after the host blocked outbound SMTP. Wallets now credit correctly when a card payment succeeds, gallery ordering decides the photo renters see first, and account deletion became a reversible 90-day process instead of an instant wipe.

Moved it onto its own domain

Custom domain, verified ownership and automatic TLS, with the operations panel repointed at the new host and the previous address left working throughout — no downtime and no broken links for the apps in the field.

Building something like this?

JS Globtech builds and operates multi-platform products — mobile, web and the API underneath.

Schedule a technical consult