JOO platform — bilingual service platform with verified payments

The challenge

Run a complete ordering and payment platform on standard shared hosting (PHP and PostgreSQL, no Node.js server), keep the existing database, and serve customers in Arabic and English.

Constraints

• Standard cPanel shared hosting: PHP and PostgreSQL only, no Node.js server.
• The existing database schema and data had to be kept during the move away from Next.js.
• Payment status must never be trusted from the browser — only from the payment provider.
• Arabic (right-to-left) and English had to be equal, including legal pages and emails.

What was delivered

• Migrated the original Next.js site to Laravel while keeping the existing PostgreSQL schema and data.
• Customer accounts are reviewed and approved before ordering; fixed-price services and quote requests share one checkout.
• Card payments run on SecurePayAPI’s hosted invoice page; orders are marked paid only from signed, verified provider notifications.
• Full Arabic (right-to-left) and English interface, legal pages and email receipts.
• Admin dashboard for customers, orders, quotes, payments, messages and an append-only audit log.
• An admin Overview with period comparisons, where revenue counts only provider-verified payments and small samples are labelled “insufficient data” instead of shown as rates.
• An AI Intelligence workspace that sends only aggregated, non-identifying statistics to an AI provider; it stays off until a provider key is configured.
• A website assistant that answers from published content only, never quotes unpublished prices and hands over to a person for anything else.
• An automated test suite covering accounts, pricing, payments, webhooks and both languages.

How quality is verified

• Automated feature tests for accounts, authorization, pricing, orders, payments, webhooks, receipts and both languages.
• Payment-provider notifications are verified with an HMAC signature and a timestamp window before they can change a payment.
• Administrative actions such as account approvals, quotes and payment reviews are written to an audit log that a database trigger keeps append-only.
• Automated accessibility checks (axe-core, WCAG 2.1 AA rules) on the public pages in both languages.
• Browser-driven responsive checks of the public site and every admin screen at ten widths from 320 to 1440 pixels, in both languages and in light and dark themes.
• The AI features are tested with simulated provider responses, including provider failures, rate limits and attempts to override the assistant’s instructions.