RideStack
A production-grade, multi-role cab booking platform for India
RideStack is a production-ready, full-stack, multi-sided cab booking platform built for the Indian market. It connects cab drivers, fleet vendors, corporate companies, and retail passengers on a single unified ecosystem, powered by a microservices backend, two mobile apps, and a suite of real third-party integrations. The platform manages the entire cab business lifecycle, from driver KYC and fleet building to GST-compliant corporate bookings and on-demand retail rides.
Key Features
OTP Auth & RBAC
Passwordless OTP login with JWT, rotating refresh tokens, and role-based access for all four roles.
Driver KYC Onboarding
Multi-step KYC with Aadhaar / PAN / License / RC uploads via S3 presigned URLs.
Fleet Management
Vendors add vehicles, invite fleet drivers via OTP, and build custom rate-card packages.
Smart Fare Engine
Per-vehicle quotes with full GST breakup (CGST + SGST) and road-distance-based pricing.
4 Trip Types
Local, Outstation, One-Way, and Airport / Transfer bookings for corporate and retail.
Razorpay Payments
UPI, cards, wallets, and net banking with prepay, verified webhooks, and auto-refunds.
Real-time Notifications
Firebase FCM push across both apps and all roles, on Android and iOS.
Conflict Detection
Warns vendors of overlapping trips on the same vehicle without blocking the booking.
Challenges & Solutions
Four-role platform
One backend serving driver, vendor, corporate, and retail, each with distinct flows, without mixing data.
Microservice consistency
Three independent services had to share identical middleware, auth, and error handling.
Secure KYC at scale
Sensitive identity documents needed owner-scoped, authenticated, reliable storage.
Booking price race condition
A vendor editing a rate mid-booking could charge a price the user never agreed to.
Silent token refresh
Expiring 15-min JWTs across concurrent calls risked logging users out on single-use refresh tokens.
Retail payments & refunds
Prepaid flows needed verified webhooks, idempotency, and automatic refunds on rejection.
Role-gated single model
One users table with role + status columns and role-gated JWT dependencies with separate schemas per role.
Shared app factory
A shared create_app() auto-wires CORS, logging, rate limiting, and one unified error envelope across services.
Owner-scoped S3
Files stored under owner-scoped S3 paths, served via an authenticated proxy, with presigned direct uploads.
Server-side re-quote
Fare is recalculated at confirmation; a 409 PRICE_CHANGED forces re-confirmation if the total differs.
Queued token refresh
An Axios queue makes one refresh per expiry and replays queued requests, consuming the token exactly once.
Verified Razorpay flow
HMAC-verified webhooks, idempotency keys, and automatic Refund API calls on vendor rejection.