RealEstate CRM

The React SPA is served by Nginx, which also proxies /api/* to the Spring Boot container. The browser only ever talks to one origin.

Security is stateless JWT with access and refresh tokens, and endpoints are gated by role. Every authenticated user carries their organization id, which the services use to scope data to that tenant.

An admin submits the whole project at once: details, a MahaRERA number, wings with their floors and flats, approved banks, amenities, documents and the disbursement schedule. Project names and MahaRERA numbers are checked for uniqueness first.

It all runs in one @Transactional method, so the rows commit together or not at all.

The letterhead and project documents upload to a private bucket under {orgId}/{projectName}/LetterHead/ and /Documents/. Only the object key is stored in PostgreSQL, never bytes or a public URL.

Because the uploads happen mid-transaction and S3 can't roll back, a sub-step that reports failure triggers a compensating delete: list everything under the project's prefix, batch-delete it, then throw so the database rolls back too.

Viewing or sharing a document asks the API for a presigned GET URL for that one object, valid for ten minutes. Access control stays in the application; the bucket stays private.

Sales staff log enquiries against a project and track them through follow-ups. A booking ties three things together: the enquiry it came from, the specific flat, and the client buying it.

At 01:00 every day a scheduler generates the follow-up tasks due, so each employee starts the morning with a current queue instead of yesterday's leftovers.