Sleipnir

End-to-end rental OS for car fleets. Designed in Figma, built in Next.js + TypeScript, owned from auth and RBAC to UI and email infra.

Overview

Sleipnir is a comprehensive resource-management and rental platform for car-rental businesses. End-to-end management of vehicle inventory, bookings, customer relationships, and operational workflows, with enterprise-grade security and access control.

Design

• Stakeholder interviews with rental owners, fleet managers, and service staff.
• Full requirements docs, user stories, and user-journey maps for admin/manager/staff/customer personas.
• Information architecture for modules, data relationships, and navigation.
• High-fidelity Figma prototypes covering dashboards, vehicle management, multi-step booking, customer portal, reporting, and authentication flows.
• Reusable component library + email-template designs for transactional comms.

Auth & RBAC (full implementation)

• Multi-step registration with email verification, optional phone 2FA, and welcome-email automation.
• Bcrypt (cost factor 12) password hashing, TOTP MFA, SMS 2FA fallback, remember-device, brute-force protection, and IP-based anomaly detection.
• JWT with refresh-token rotation, configurable session timeouts, concurrent-session tracking, secure logout.
• Admin-initiated invite system with secure tokens, expiration, pre-assigned roles, bulk invites, and reinvites.
• Role-based access control: Super Admin, Fleet Manager, Operations Staff, Maintenance Team, Customer.
• Granular permissions across resources, actions, fields, locations, and time windows. ABAC for complex rules.
• Permission middleware with caching, dynamic context evaluation, and role inheritance.

Email & security

• Full transactional email system: welcome, verification, reset, invite, security alerts, lockout warnings, MFA setup, session expiry.
• SMTP with retry + queue, responsive HTML + plain-text fallbacks, delivery tracking, bounce/complaint handling.
• CSRF, XSS, SQLi protections; HSTS, CSP, X-Frame-Options; rate limiting; encrypted-at-rest sensitive data.
• Comprehensive audit logging, GDPR-compliant data export and deletion, configurable retention.

Stack

• DESIGN: Figma
• FRAMEWORK: Next.js (App Router, Server Actions)
• LANGUAGE: TypeScript (strict, end-to-end)
• DATABASE: Postgres + Prisma
• RATE LIMIT: Upstash Redis
• TESTING: Jest, RTL, Playwright

Metrics

• 10,000+ daily logins handled.
• 99.9% email delivery success.
• 85% MFA adoption among admin users.
• Zero auth-related security breaches.
• 100% type coverage across the auth codebase.
• <100ms API response on permission checks.