BookHere

What it is

A shop gets its own booking page. A customer picks a service, a day, and a time on a live calendar, fills a short form, and books. The shop runs the day from a studio, builds new client pages in five minutes from an office, and the same product ships as native apps for iPhone, iPad, Mac, and Android. There are two ways in: a business asks and I build the page for them, or a solo owner signs themselves up and goes live instantly.

Four surfaces, one spine: the customer page, the studio, the office, and the apps. A request enters through one Cloudflare Worker, and every rule that matters lives in the database, not the page. That single decision is the reason the rest of this holds together.

Correctness under concurrency

Two people press the same 11:00

In the same instant, two customers try to book the same slot. A check-then-insert cannot hold that rule, because when each transaction looks, neither has committed, so both see the slot free and both write. The guarantee has to live in the database as a constraint, not in a function that looks first.

What is done: bh_no_double_booking is a GiST exclusion constraint over tstzrange(starts_at, ends_at, '[)'), which needs btree_gist because the artist id is a uuid. The database itself refuses the second overlapping write. bh_create_booking catches exactly that constraint name and re-raises anything else, so a clash that is not a booking clash is never dressed up as one.

The name of a service belongs to the booking

session_type_id was ON DELETE SET NULL, so deleting a service blanked the "what" on every booking ever made with it. It had already happened four times before it was caught.

What is done: a type_name column on the booking, a BEFORE DELETE trigger that back-fills it, and coalesce(t.name, b.type_name, 'Appointment') on every read. The argument is not technical: what was agreed is what was agreed, and deleting today's price list should not rewrite last month's history.

Security posture

The pages talk to Postgres directly from the browser with a publishable key printed in the source. That is normal for this stack, and it means the security cannot live in the page. It lives in the database.

• Row level security on all 27 tables, with no policy on any of them, plus revoke all on all tables in schema public from anon. A table with RLS on and no policy answers nobody, so the key in the page source reads nothing directly. The whole front door of the product is therefore the short list of security-definer functions granted to anon, short enough to read in one sitting. That was the point.
• Every function pins set search_path = public, so a definer function cannot be tricked into calling somebody else's crypt.
• Multi-tenancy is one visible line. aid := bh_session_artist(p_session) at the top of about thirty functions, deliberately not hidden inside a wrapper, because a wrapper you can forget to call is worse than a line you can see.
• Migration 090 revoked 19 functions that were granted to anon and called by nothing, including two seeds that would have let a stranger overwrite a shop's hours and services.
• Only sentences written on purpose reach the public. SQLSTATE P0001 maps to a 400 carrying the function's own words; everything else becomes "That did not go through." The reschedule route had been answering the internet with function names and argument names straight out of the schema cache, until it was closed.

Measurement, not assumption

This is the part I care about most. A protection you have not measured is a guess wearing a badge.

The rate limits that counted nothing

Every limiter lived in the Worker's own memory, which is per instance, so nothing ever accumulated. It was not argued about, it was measured: thirty wrong six-digit codes in a row at the office door came back thirty times as "Wrong code" and never once as "wait"; forty bookings in a burst got zero refusals. Every counter then moved into a database table, keyed per address so nobody else knocking can lock the owner out, and it was re-measured: ten bookings through, the eleventh refused.

And a refusal must not count itself. Every limiter had pushed the call into the window before deciding whether to allow it, so a refused call extended its own ban. Reload to check whether you are still blocked, and you have just made sure you are.

The clock that was losing its own evidence

52 of 78 reminder sweeps in six hours came back as timeouts on pg_net's five-second default. The work had finished each time, because the Worker runs to the end whether or not anybody is listening. What was lost was the proof the letters went out, and a sweep that had genuinely failed would have looked identical. Raised to 30 seconds, still inside the five-minute tick so a slow sweep cannot overlap the one behind it.

534 QR codes decoded, not looked at

The encoder was verified by decoding every code with an independently written reader, not by eye. It found three bugs, each of which produces a code that looks perfect and scans on nothing: the 15 format bits written least-significant-first, the second format copy starting one bit late, and missing alignment squares crossing the timing line, which breaks every version 7 and above. You cannot see any of these; you can only decode them.

Judgment calls

Hard problems, from first principles

A QR encoder written from the standard

No library and no third-party service, so no client's address is handed to somebody else's analytics: byte mode, versions 1 to 10, Reed–Solomon over 0x11D, all eight masks scored against the standard's four penalty rules, then verified by the independent decoder above.