01 / Overview
Overview
A premium interior-design and decoration platform for a Borg El Arab company serving all of Egypt — two businesses on one site: full design/decoration services plus a deep, browsable catalog of materials and furniture organized by type, color, value tier, and style. Three-app deploy: public React SPA, staff admin dashboard, and an Express + Prisma API with email-OTP 2FA, a bookings state machine, and a Gemini AI assistant proxy with PII redaction.
02 / The Problem
The Problem
An interior design company in Borg El Arab sells two very different things: bespoke design services, and a deep catalog of materials and furniture. One website had to serve both without confusing either.
03 / My Contribution
My Contribution
Architecture + Full-Stack Build
The available record identifies the role above. Team structure, pre-existing work, and individual task ownership are not stored, so no further attribution is claimed.
05 / Key Decisions
Key Decisions
Two audiences arrive in two mindsets
A client booking a full apartment design wants reassurance and a conversation. Someone hunting a specific marble wants filters and speed. Forcing both down one funnel would have failed both, so the front door splits early and deliberately.
The catalog needed real facets
Materials do not sort by category alone. I modelled them across type, color, value tier, and style, so a visitor can browse the way they actually think — "warm wood, mid tier, modern" — instead of clicking through a tree of folders.
Bookings became a state machine
Requested, confirmed, scheduled, completed, cancelled — with legal transitions enforced on the server. Staff always know the next action, and a booking can never sit in an ambiguous state that only the developer can explain.
The AI assistant never touches the browser
The Gemini assistant runs behind a server proxy: the API key stays server-side, requests are rate limited, and personal details are redacted before anything leaves the building. An AI feature is an exfiltration path if you build it lazily.
Staff access hardened from day one
Email-OTP two-factor on the admin dashboard, separated roles, and an API that assumes the client is hostile. Three apps ship together — public site, staff dashboard, Express + Prisma API — but only one of them is public.
08 / Result