VulCode
Integrations & scripts

Lokal

The internal API through which the VulCode client panel puts a venue on the free, trial or pro plan, suspends and unsuspends it. The plan only changes from outside, the owner manages nothing but invoicing details, and when the period ends the venue falls back to the free plan on its own without losing data. Every call lands in the venue's activity log with the caller named in the X-Service-Actor header.

TypeInternal service-to-service API
BackendExpress, TypeScript, Prisma
AccessShared secret in a header
Called byVulCode client panel
Lokal

Overview

Lokal is a panel for restaurants, bars, clubs and cafes: the menu, reservations on a floor plan, orders, events, promotions, inventory, the schedule and reports. A venue pays for it in the VulCode client panel, so the plan and any suspension come from there, through the internal API.

Three plans

A venue runs on one of three plans: free, trial or pro. The limits and features of each are described in one place the whole backend reads from, so the screen and the API can never drift apart.

Lokal plans

freetrial and pro
Team accounts3unlimited
Menu items50unlimited
Inventory items25unlimited
Report history7 daysunlimited
Events, supplier orders and schedulingnoyes
Advanced promotions and reportsnoyes

A trial always has an end date, and pro may run without one. Once the date passes, the venue falls back to free, and the stored plan and all data stay.

A plan set only from outside

The venue owner manages invoicing details: the company name, tax ID, invoice email and address. They cannot change the plan. It is set by three internal API calls used by the VulCode client panel.

internal-api · bash
POST /api/internal/venues/:id/plan
POST /api/internal/venues/:id/suspend
POST /api/internal/venues/:id/unsuspend

A suspension that does not cut off help

A suspended venue stays readable, every change is answered with 403, and its data is left untouched. Support tickets and invoicing details stay open, so the venue can reach us and pay.

Channel security

The calls are guarded by a shared secret in the X-Service-Token header. With no secret configured the API answers 503 instead of running without authentication. The X-Service-Actor header names every call in the venue's activity log, so the owner sees who changed the plan or suspended the venue.

Questions about Lokal

More projects

More work from the same category - see how we tackle similar challenges.

vulp
vulp
Flaem
Flaem
Gyred
Gyred
Plazer
Plazer

Have a similar project?

Get in touch - a quote is free and comes back within an hour.