FOODVILLA
View Live Site ↗Finding a restaurant, reading a menu, and booking a table are usually three different products. FoodVilla is a booking platform, not a cart: guests need search, menus, reservations, and history in one place, while owners run the listing and admins approve what goes live. An AI assistant only belongs here if it can search, check availability, and actually place or cancel a booking — not if it answers with copy. The work was to make those three roles and the assistant share one system instead of three UIs glued together.
User, owner, and admin are different permission models on the same Mongo documents. The assistant has to call the same REST booking APIs as the React app, or it is a chatbot with no side effects. Auth is JWT with bcrypt-hashed passwords; uploads go through Multer to Cloudinary; owner analytics and admin commission need real aggregations, not mock charts. Socket.io is in the stack for live updates, and Razorpay sits next to rate-limiting and Helmet — payments and public AI routes cannot share an unauthenticated surface.
The frontend is React and Vite with React Router. Redux Toolkit holds session and UI state; React Query caches server reads so restaurant lists and booking history are not refetched on every mount. Forms use React Hook Form and Zod, dashboards use Recharts, Axios talks to Express with JWT. The API is Mongoose models for users, restaurants, menus, reservations, and plans; Groq and OpenAI tool those routes; Cloudinary stores media; Razorpay takes payment.
- React
- Vite
- React Router
- Redux Toolkit
- React Query
- React Hook Form
- Zod
- Tailwind CSS
- Axios
- Node.js
- Express
- MongoDB
- Mongoose
- JWT
- Groq
- Cloudinary
- Razorpay
- Socket.io
An assistant that does not share the booking API is a demo, regardless of how good the markdown looks. Redux and React Query coexist because session and server cache are different problems — stuffing both into one store made the refetch logic worse. Role dashboards are different trees: hiding an admin button on the guest layout is not access control. JWT on the cookie plus rate limits on the AI routes mattered more than which model generated the reply.