FriendChise

Make every location run like your best one.

Operations platform designed for teams across multiple locations, currently deployed in production at one location, Walker's Doughnuts. Tasks, scheduling, and procedures in one place.

Next.js · TypeScript · PostgreSQL · Prisma
Live GitHub Docs Figma

Production
Real-world pilot at Walker's Doughnuts
400+
Automated tests
OSS contributors
Multi tenant
Organisation scoped architecture

Overview

Background

At Walker's Doughnuts, the things that made a shift run well were rarely written down. A manager knew how to handle a rush, and a senior staff member knew the fastest way to prep for the morning, and none of it survived when that person wasn't rostered on. Around the same time, our store slid from one of the better performers in the franchise toward the bottom of the leaderboard, and staff turnover was high. I can't say the ranking drop was caused solely by knowledge loss, but I saw first hand how much operational knowledge disappeared every time someone left.

Problem

Operational knowledge, standards, training, and workflows fragment across locations and staff, and disappear when someone leaves.

Solution

A shared operations platform for tasks, scheduling, procedures, tools, and staff coordination, captured once, reused by every shift.

Why I built it

“The success of one location should strengthen every location.” I didn't set out to build a SaaS product. I set out to fix this at one store, and FriendChise is still running that store today.


Product

Product overview

Timetable, tasks, procedures, and tools are built as separate systems sharing one organisation scoped data layer, so screenshots below reflect what a real shift actually sees.

Run the week

Weekly and daily scheduling so staff know what they're doing without asking a manager. Overlapping shifts and roles are grouped into readable cards instead of a wall of stacked entries, which removes the constant "what am I doing today" interruptions that used to eat into a manager's time.

Standardise operational knowledge

Recurring tasks, prep procedures, and recipes that used to exist only on paper or in someone's head are written once and searchable by anyone on shift. Tags, comments, and recurrence rules turn a scrap of tribal knowledge into something the whole team can trust.

Train and support staff

Conversion tools, operational calculators, and item lists remove repetitive manual math from day-to-day work, the kind of thing that seems minor until you're the one doing it by hand every shift, and a big part of onboarding someone new quickly.

Coordinate across locations

Each location runs as its own organisation with its own staff, schedule, and data, while a parent organisation can connect multiple franchisees and share brand level resources, the structure the platform needs before it can grow past one store.


My Role

Founder & Full Stack Developer
Solo designed, built, and maintained, extended by open source contributors

Ownership and Responsibilities

I built and maintain FriendChise independently, owning the product direction, architecture, implementation, and ongoing development.

Open Source Maintenance

The project has grown to open source contributors. I review incoming contributions while continuing to lead the architecture, product direction, and production quality.


CHALLENGES AND LESSONS

Design Challenges

Transition Difficulties

Problem

A business may already have hundreds of paper documents, recipes and dense procedures. Manually converting all of that into structured digital data creates a major barrier to adopting the system.

Decision

I built an AI supported tool that can scan or upload existing documents and convert them into structured, presentable task data inside FriendChise.

Result

This reduced the amount of manual data entry required and showed me that simplifying the transition into the system was just as important as building the features inside it.

Reducing Access Friction

Problem

FriendChise was originally built as a web app, but frontline work happens in a fast paced environment where staff need information immediately. Even if the features worked well, opening a browser, finding the site, navigating back to the right place, or remembering where you left off added too much friction.

Decision

I realised the problem was not the functionality, but the form it was delivered in. A dedicated mobile app was better suited to everyday operational use because it gave staff direct access, preserved context, and separated work from their normal browser activity.

Result

This led to FriendChise Mobile, where common workflows are faster to reach and better suited to use during an active shift.


Engineering Challenges

Franchise hierarchy vs. tenant isolation

Problem

The platform needed to support both an independent single store and a franchise network, without one org ever seeing another's data by default.

Decision

A self referencing parentId relation on Organization lets a parent connect multiple franchisees and share brand level resources, while every query is still scoped by orgId rather than relying on the UI to hide things correctly.

Result

One data model supports both a single independent location and a franchise across multiple locations, with tenant boundaries that don't depend on the interface behaving correctly.

Role based access at org scale

Problem

Owners, managers, and staff need different tools from the same system, and permission logic scattered across screens is exactly where multi tenant bugs hide.

Decision

Permissions are modelled as organisation scoped Role → Permission → MemberRole join tables, checked centrally in a shared authz layer rather than per page.

Result

Each role only sees the tools relevant to its job, and permission checks are covered directly by the largest slice of the test suite (151 server-action tests) instead of being trusted to the UI.


What I Learnt

What I Would Do Differently

Problem

If I started FriendChise again, I would begin with the smallest high frequency workflow, such as task and procedure lookup, and validate daily usage before expanding into broader scheduling and operational tooling. The product was intended largely for frontline staff, yet I initially invested heavily in the web experience and too much time went into polishing features before I knew whether they would remain important.

Decision

I would build less initially and focus first on the workflows staff used most often. I would make the product mobile first much earlier, invest sooner in AI supported tools that turn photos and documents into structured operational data, and ship smaller versions sooner so real usage could guide the next round of work.

Result

The biggest lesson was that building more functionality was not always the same as making the product more useful. Reducing friction, capturing data more easily and validating real usage mattered more.


Architecture

Request Flow

Web and mobile requests enter through different transport mechanisms, but both authenticate, validate and normalise input before calling the same shared business logic.

Architecture Principle

Server Actions and API routes are transport layers, not separate implementations of the product logic. Both authenticate and validate requests before calling the same shared business logic, which then accesses organisation scoped data. This keeps web and mobile behaviour consistent, avoids duplicated rules, and makes security and performance constraints easier to enforce.

Web and mobile use different authentication mechanisms, but both resolve into the same application logic and organisation context. This allows the two clients to share the same behaviour and data rules while presenting the information differently for desktop and mobile layouts.

  • Entry Layer: protects the application boundary and converts different client requests into clean, trusted input.
  • Business Logic: focuses on correctness and efficiency, permissions, workflow rules, and returning the right amount of data rather than HTTP/API details.
  • Data Access: ensures database queries only access the correct organisation’s data, return a limited amount of data, and keep reads and writes controlled.

Frontend Architecture

Each page acts as the main coordinator for its feature. It loads the primary data needed for the initial render on the server, then passes only the relevant data into smaller components responsible for presentation and interaction. When a component needs additional data after the page has loaded, such as for pagination, infinite scroll or on-demand updates, it can request that data through an API route.

Page / Server Components
  • Load the main data needed for the initial render.
  • Structure the page.
  • Pass only the relevant data into feature components.
Feature / Client Components
  • Turn that data into interactive UI.
  • Handle local interaction and presentation.
  • Can request additional data when needed.
  • Examples: pagination, infinite scroll, refreshes, on-demand requests, auth-derived UI state such as isParent.
Shared UI Components
  • Reusable navigation, sidebars, dialogs, controls and repeated UI patterns.
  • Implemented once and reused across pages.
  • Keep behaviour and styling consistent.
  • Reduce duplicated code and make future changes easier.

Design Before Implementation

Major workflows are designed in Figma before implementation. This is used to define layout, interaction and responsive behaviour, but also to identify reusable patterns and component boundaries before code is written, so components aren't created ad hoc and duplicated later.

Runtime Controls

Authentication
Auth.js/session-based auth for web, bearer/JWT-style tokens for mobile
Access Control
RBAC and organisation scoping
Validation
Zod validation and input normalisation
Query Safety
Bounded reads with pagination/infinite-scroll support
Rate Limiting
Upstash Redis
Error Monitoring
Sentry
Application Logs
Server and deployment logs used for debugging
Product Analytics
User counts, customer/QR scans, feedback and demo usage
Data
Prisma, PostgreSQL, Supabase
File Storage
Supabase Storage
Delivery
GitHub Actions CI, Vercel

File Storage Controls

Uploads are validated before reaching Supabase Storage so the application only accepts file types and sizes that its workflows can process reliably.

Multi Tenant Model

Franchise hierarchy

Organizations connect directly with their parent/child Organizations, so a franchisee stays independent while a parent can connect and manage multiple locations.

Access control

Access flows from Membership to MemberRole to Role to Permission, all scoped to one Organization, so access never crosses tenant boundaries.

Organisation scoped resources

Tasks, timetables, rosters, tools, and menus each carry an orgId, so every query is scoped at the data layer, not the UI.

Data model

55 Prisma data models covering auth, organisations, tasks, scheduling, rostering, tools, menus, comments, and admin/audit data.


Testing and Reliability

200+Business logic & validation
150+Server actions
60+Integration tests with PostgreSQL

FriendChise uses automated testing and CI checks to protect critical workflows, access control, and production quality. Testing is concentrated on areas where failures could expose organisation data, bypass role permissions, or break important workflows.

Quality Gates

Every pull request runs automated checks through GitHub Actions, helping maintain the same quality standard for my own changes and external contributions.

Check
Purpose
TypeScript type checking
Catches invalid assumptions before runtime
Linting
Maintains consistent code quality
Vitest
Tests business logic, validation, helpers and server behaviour
Integration tests
Verify behaviour against a real PostgreSQL database
Playwright
Tests critical user workflows from start to finish
Access control tests
Verify protected routes, organisation boundaries and role specific permissions

Particular attention is given to role protected features, protected routes, organisation scoped data, and actions that should only be available to authorised users.


Real World Impact

Pilot Metrics

Real usage across staff workflows, customer interactions, and public product exploration. Beyond the usage numbers, FriendChise has made everyday operations easier to maintain, teach, and share across the team.

40+
Unique Users (pilot)
300+
Customer QR Scans (in a month)
100+
Public Demo Tries
30+
Paper Processes Replaced
Impact area
What changed day to day
Less paper to maintain
Tasks, procedures and recipes are stored digitally instead of relying on printed sheets that can be lost, damaged or become outdated.
Version history
Older versions of procedures and recipes can still be reviewed when needed, giving staff a reference point when processes change.
Easier onboarding
New staff can access procedures, recipes and task instructions directly instead of depending entirely on another staff member being available to explain them.
Shared questions and knowledge
Comments let staff ask questions against the relevant task or procedure, allowing useful answers to remain visible for other staff who may have the same question later.
Customer self-service
The QR menu gives customers a simple way to view menu items from their own device.
Safe product exploration
The public demo has improved over time so visitors can explore FriendChise workflows and understand the product without affecting production data.

Technologies Used

Technical Stack

Frontend

Next.js 16 · React 19 · TypeScript · Tailwind v4 · shadcn/ui

Data

PostgreSQL on Supabase · Prisma v7 · Supabase Storage

Platform

Auth.js v5 · Upstash Redis · Sentry · Vercel

Quality

Vitest · Playwright · GitHub Actions