uncannystranger/diiwaan.so

Print one QR code. Your customers scan, take a number, and go sit down — no app, no account, nothing to install. Multi-tenant queue management for Somali businesses, Soomaali first. **Print one QR code. Your customers scan, take a number, and go sit down.** No app. No account. Nothing to install. --- ## What it is ``` Browser (owner console + public customer page) │ HTTPS · id token in memory · session in an HttpOnly cookie ▼ Diiwaan API ── Firebase Auth (identity, sign-up, verification, resets) │ ── Web Push ("your turn", even with the tab closed) ▼ MongoDB (businesses, queues, tickets, services, members, branding art, analytics, audit) ``` Firebase owns credentials. MongoDB owns everything else, artwork included. **No authentication secret exists in this project — on either side.** In the browser, the refresh token is sealed with AES-256-GCM into an HttpOnly, SameSite cookie that JavaScript cannot read, and the tab holds only a short-lived id token in memory, renewed from that cookie on load and a minute before it expires. On the server there is no service account, no Admin SDK and no private key: Firebase id tokens are ordinary RS256 JWTs signed with keys Google publishes, so verifying one needs the project id and nothing else. The only thing that could be stolen from the server's Firebase code is knowledge of which project it trusts. There is no Firebase SDK in the browser either. `web/js/firebase-auth.js` speaks the Identity Toolkit REST API directly — a few endpoints instead of a megabyte of bundle, no build step, and a content-security policy that can stay at `script-src 'self'`. What is left in `localStorage` is a theme preference, the customer's own ticket token, and a read-through cache used while reconnecting. ## What it does | | | |---|---| | **Multi-tenant by construction** | Every read and write is scoped to a business the caller belongs to, resolved server-side from the session. One company cannot reach another's customers, queue, reports, logos or analytics — enforced in the API, never in the interface. | | **Bilingual, Somali first** | Soomaali is the default language and Engl …