Server-side scoping for school admins
Hiding menu items wouldn't stop a school admin from loading another school's data.
Every request is checked at the edge, and school accounts are limited to their allocated apartments, invoices and staff leave.

One web platform for a UAE landlord whose 290 apartments are split between schools housing teachers and private tenants.

360 Living manages a portfolio in which schools lease blocks of apartments for their teaching staff while other units go to individual tenants. We delivered the operator's portfolio console, a separate portal each school uses for its own units, and the leasing, billing, maintenance and community tools behind both.
The portfolio had two very different customers sharing the same buildings. Schools needed to manage the units and invoices that belong to them, and nothing else. The operator needed the opposite: every building, lease and payment at once. Spreadsheets couldn't answer simple questions like which units were empty or which invoices were late, and they offered no safe way to let schools log in.
We gave each audience its own portal but kept a single codebase and one Node.js, TypeScript and MongoDB API underneath, with access decided by the server rather than by which buttons are visible.
4 steps, from architecture to launch.
Next.js App Router middleware runs at the edge and rejects any route a role isn't allowed to open.
TanStack Query caches portfolio data and refreshes it in the background as leases and payments change.
Stripe Checkout confirms rent through an idempotent webhook, and staff can record bank transfers by hand when needed.
A single shared token refresh means parallel requests never compete, and backend blips aren't mistaken for expired logins.
Hiding menu items wouldn't stop a school admin from loading another school's data.
Every request is checked at the edge, and school accounts are limited to their allocated apartments, invoices and staff leave.
Once rent starts flowing, a wrongly converted enquiry is expensive to unwind.
Conversion shows the lease terms and the payment schedule they create, and nothing is saved until staff confirm.
Concurrent token refreshes and slow responses were logging people out mid-task.
Refresh runs once and is shared, and temporary server errors are handled separately from genuine session expiry.
Building-level apartment types with their own pricing and rules, individual units and photo uploads.
Allocations, lease terms, renewal dates, occupancy views and a guarded enquiry-to-lease conversion.
Tenants pay online with Stripe, staff can record offline payments, and every invoice has a shareable receipt.
Each school's admin sees and manages only its own apartments, invoices and staff requests.
Photo-backed maintenance tickets plus notices, events and blog posts for residents.
Dashboards, PDF exports, a GDPR-style data export and a read-only Zoho Books link.
Tell us what you are shipping.
Start a Project →