DragonLair
Book rooms. Not headaches.
Full-stack hotel booking platform. Reservation engine, admin dashboard, and security hardening: built for hospitality businesses.
Booking
Booking experience
Guided reservation flow with real-time availability and activity add-ons.
Multi-Step Booking Wizard
Guided reservation flow: dates, room selection, activities, review & confirm. Real-time availability checks.
Room Management
Full CRUD with categories, pricing, capacity, amenities, image galleries. Slug-based detail pages.
Activity Booking
Safari, spa, dining, water sports, tied to reservations with participant tracking.
Dynamic Pricing
Per-night rates, seasonal adjustments, activity add-ons. Automatic total calculation with tax.
Real-Time Availability
Transactional availability checks prevent double-booking. Race condition protection with database-level locking.
Guest Communication
Contact system with message management. HTML email templates with booking confirmations.
Complete operations center
Everything your hotel staff needs in one place.
Analytics Dashboard
Revenue tracking, occupancy rates, booking trends, and guest demographics.
User Management
Role-based access. Guest accounts, staff roles, admin privileges. Account lockout protection.
Room Operations
Create, edit, toggle availability, manage images and amenities. Bulk operations.
Booking Management
View, confirm, cancel reservations. Status workflow with audit trail.
Message Center
Guest inquiries with read/unread status, reply tracking, and archive.
Audit Logging
Activity trail, who did what, when, from where. Useful for compliance and debugging.
Visual language
Custom design system with warm tones and elegant typography.
Security hardening
Thoroughly tested and hardened against common web vulnerabilities.
JWT + HttpOnly Cookies
No tokens in localStorage. Secure, SameSite=Strict cookies with session management.
3-Layer Rate Limiting
Per-IP, per-user, and global rate limits. Database-backed with configurable windows.
CSP + Security Headers
Content Security Policy, HSTS, X-Frame-Options DENY, X-Content-Type-Options. Zero unsafe-eval in production.
Input Sanitization
Zod v4 validation on every endpoint. XSS prevention with HTML escaping on all user data.
CSRF Protection
Origin validation on all state-changing requests. SameSite cookie policy.
Account Security
bcrypt (12 rounds), account lockout after 5 failures, 30-minute cooldown, IP-based tracking.
Built with
System overview
┌─────────────────────────────────────────────────┐ │ DRAGONLAIR: System Architecture │ ├─────────────────────────────────────────────────┤ │ │ │ ┌─── Frontend (Next.js 14 App Router) ───────┐ │ │ │ • Luxury Design System (Gold/Midnight) │ │ │ │ • 14 Static Pages (SSG) │ │ │ │ • Multi-step Booking Wizard │ │ │ │ • Masonry Gallery + Lightbox │ │ │ │ • Admin Dashboard (6 views) │ │ │ │ • Zustand Auth State │ │ │ └────────────────────────────────────────────┘ │ │ ↕ API │ │ ┌─── Backend (19 API Routes) ────────────────┐ │ │ │ • Auth: Register, Login, Logout, Me │ │ │ │ • Rooms: List, Detail, CRUD │ │ │ │ • Bookings: Create, Read, Update │ │ │ │ • Activities, Gallery, Reviews, Contact │ │ │ │ • Admin: Dashboard, Users, Audit │ │ │ └────────────────────────────────────────────┘ │ │ ↕ ORM │ │ ┌─── Data Layer (Prisma 5) ──────────────────┐ │ │ │ 15 Models: User, Room, Booking, Activity, │ │ │ │ Session, RateLimit, AuditLog, Review, │ │ │ │ ContactMessage, GalleryImage, Setting... │ │ │ └────────────────────────────────────────────┘ │ │ │ │ ┌─── Security Layer ─────────────────────────┐ │ │ │ Middleware: CSP, HSTS, CORS │ │ │ │ Auth: JWT + HttpOnly + Session Mgmt │ │ │ │ Defense: Rate Limit + Lockout + Audit │ │ │ │ Validation: Zod v4 + HTML Escape │ │ │ └────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────┘
Ask about DragonLair for your property
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours. Working hours are Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Request a demoAll services Book a 15-minute call Buying for a company? Procurement details