Website & Gift Cards
Flávia Guedes
A salon site that sells digital gift cards and prepaid credit with a bonus. The balance is always the credit minus what was used, so it cannot drift, and the owner deducts services and undoes mistakes from her own panel.
Some details omitted under NDA
The problem it solved
A high-end salon sells gift cards and prepaid packages. Done by hand, that means a WhatsApp message, a bank transfer and a note in a book, and nobody can say for certain how much credit a client still has.
The risk is not untidiness, it is credit charged twice, a service deducted from the wrong balance, and an argument at the counter with no way to prove who is right.
What the site delivers
Gift cards bought on the site
The client buys on the site, pays by card and receives a certificate image by email, ready to forward to whoever is being given the gift.
Beauty Bank, the prepaid credit
The client deposits an amount and receives more credit than they deposited. The bonus tiers have start and end dates and are edited in the panel.
A balance that cannot drift
The balance is never stored as a number: it is always the credit minus everything already used, so there is no such thing as a mismatched balance.
Deduct a service in the panel
The owner deducts the service from the client's balance inside the panel, and can undo a deduction made by mistake.
The three numbers that matter
How much was sold, how much is still outstanding in clients' hands and how much has been used.
Work gallery
A photo showcase of the salon's work.
Automatic emails
A confirmation for the buyer and an alert for the owner, sent independently of each other.
Two languages
The site in English and Portuguese, for the local clientele and the one from abroad.
Beauty Salon Landing Page
We built an elegant, working site for a high-end beauty salon.
It presents the services and a visual portfolio of finished work.
The real difference is the money side: digital gift cards and prepaid credit with a bonus, paid by card through Square, with the price re-checked on the server before any charge.
And an admin panel of her own, where the owner redeems a card, deducts a service from a client's credit, undoes a deduction made by mistake, and sees how much was sold, how much is still outstanding and how much has been used.
- Services presented section by section
- Visual portfolio of the work
- Digital gift card sales
- Prepaid credit with a bonus, as a real ledger
- Card payment through Square
- Admin panel with redemption and undo
How it turned out
- Prepaid credit became a real ledger, with deposits, deductions and reversals recorded, instead of a note in a book.
- Before the card is charged, the price is re-checked on the server, so an amount tampered with on screen does not become a wrong charge.
- A deduction made by mistake is undone from the panel, with nobody having to touch the database.
- The owner signs in with her own password and the session expires on its own after eight hours.
- One detail said plainly: the certificate is emailed to the buyer, for that person to forward to whoever is receiving the gift. There is no direct send to the recipient.
In numbers
2
languages
4
admin screens
3
control figures: sold, outstanding and used
For technical visitors
The rest of this page is written for whoever decides the purchase. This block is for whoever has to maintain the site.
- Payment through Square only. There is no Stripe integration in this project.
- Firestore with the gift card, Beauty Bank and bonus tier collections. The balance is always derived (credit minus the sum of transactions) and never stored.
- A service deduction runs inside a Firestore transaction, and there is an undo operation that reverses the entry.
- The price is re-validated on the server before the charge, so the amount arriving from the browser is not trusted.
- Admin authentication written by hand: credentials checked on the server with a timing-safe comparison, an httpOnly cookie signed with HMAC-SHA256 for 8 hours via Web Crypto, verified in middleware with a scoped matcher. It is not NextAuth.
- Resend emails to the buyer and the owner independently, falling back to HTML without the attachment if the certificate render fails, with the send status persisted.
- 10 pages, 11 API routes, 4 admin screens, 6 test files with 88 cases over the money logic, plus sitemap, robots and llms.txt.