Check 01A-01
Passed
Exactly-once payments
Signed webhooks, event de-duplication and a 15-minute reconcile mean no payment is lost or counted twice.
Drawing register
0104Dwg A-01 · Co-working, art & café · Full-stack
The Melons' Studio
The Melons' Studio is a third space in Lucknow: part co-working, part art studio, part café. We designed and built the whole platform. A Next.js site sells day passes, memberships, workshops and DIY kits, and a Laravel API with a Filament admin runs bookings, payments, GST invoices, loyalty points and a moderated community gallery. The studio team runs all of it without a developer.
- Drawing
- A-01
- Role
- Design & full-stack build
- Venue
- Co-working, art studio & café · Lucknow
- Surfaces
- Site · Member account · Admin · API
- Core stack
- Next.js 16 · Laravel 13 · PostgreSQL 18
- Issued
- 2026
- Marketing site
- Space booking
- Memberships & passes
- Workshops & shop
- Payments & invoices
- Staff admin
Plates · as built
0204Deep dive
Payments that can't go missing
Money is where a booking system earns trust. Razorpay webhooks can arrive twice, out of order or not at all, so the payment path confirms every payment exactly once, even when a delivery fails.
- Stage 01
Verify the signature
Each webhook is checked against its HMAC-SHA256 signature in constant time. A mismatch is rejected and logged by its shape, never its secret, so a failed confirmation is always diagnosable.
- Stage 02
Record the event once
Every delivery is stored by its Razorpay event ID. A replay of a settled event is acknowledged and ignored, so retries can't confirm a payment twice.
- Stage 03
Recover half-finished work
If a first delivery failed mid-transaction, the retry reprocesses its record instead of dropping it. Settling is idempotent, so running it again is safe.
- Stage 04
Lock the booking
Booking a desk locks the space row inside a transaction and checks overlaps, closures and running workshops, so two members can't take the last seat at once.
- Stage 05
Reconcile every 15 minutes
A scheduled job asks the Razorpay API about every payment still pending and settles it through the same path a webhook would, so a lost webhook heals itself.
General notes
The brief
A studio that sells desk hours, kiln time, pottery workshops, coffee and DIY kits is really five businesses under one roof. Off-the-shelf booking tools handle one of them and leave the rest to spreadsheets and WhatsApp.
The studio needed one system: a warm, photo-led site that sells every offer, member accounts that keep passes and points in one place, and a back office the team can run without calling anyone.
One account for every offer
Visitors pick a day pass or a monthly membership (Sprout, Bloom or Harvest), book desk hours on a slot picker, register for workshops and buy kits from the shop. Every purchase lands in the same member account, with order history, downloadable GST invoices and refunds.
Families come as families. A member can add dependents and book workshops for their kids from the same login. Sign-in works by password or by a one-time email code, with optional two-factor authentication.
- Day passes, 3 membership tiers, desk-hour slots
- Workshops, private bookings and a shop
- Dependents for family and kids' bookings
- Password, email code and two-factor sign-in
Loyalty that runs itself
Every rupee spent earns Melon Points, one point per ₹10, written to an append-only ledger so any balance can be traced to the purchase that earned it. Referral codes reward members who bring friends, and scheduled jobs expire stale memberships and referrals overnight and send renewal reminders each morning.
- Append-only points ledger
- Referrals with expiry
- Nightly expiry and morning renewal reminders
A gallery the community fills
Members upload photos of what they made. Uploads wait in a private S3 prefix until staff approve them, so nothing goes public unreviewed. Approved photos move to the public prefix and are served through CloudFront with Origin Access Control, so the bucket itself never opens to the internet.
- Moderation quarantine in a private prefix
- CloudFront with OAC, bucket fully private
- Short-lived presigned URLs for exports
A back office for staff
The studio team runs everything from a Filament admin: spaces and bookings, workshops and instructors, products, memberships, discount codes, orders, refunds and the gallery queue. Site content is editable too, and the frontend falls back to built-in copy if the API is ever unreachable, so visitors never see a broken page.
- 17 admin resources
- Editable home and about pages
- Graceful fallback when the API is down
0404Materials
What it'smade of.
Bill of materialsA-01 · The Melons' StudioPage 1 / 1
| Item | Part no. | Assembly | Components | Qty |
|---|---|---|---|---|
| 01 | FRO-05 | Frontend | Next.js 16 · React 19 · TypeScript · Tailwind CSS 4 · Motion | 5 |
| 02 | BAC-05 | Backend | Laravel 13 · PHP 8.4 · Sanctum · Filament 5 · DomPDF | 5 |
| 03 | DAT-04 | Data | PostgreSQL 18 · Redis · S3 · CloudFront | 4 |
| 04 | PAY-02 | Payments & email | Razorpay · Brevo | 2 |
| Total | 4 assemblies · A-01 | 16 |
Checked✓ GDTear along perforation
Drawn · GenDevChecked · GenDevApproved · Design & full-stack buildDwg A-01 · Rev D · 2026
Next drawing · A-02Private Kubernetes Foundation