Wano

A Kampala-focused discovery, booking and rewards app for travellers in Uganda — browse and book hotels, restaurants, tours/experiences, transport, spas, attractions and rentals from Wano-verified vendors, earn Passport stamps and points, and redeem rewards. Every listing type stays pay-at-venue today; a behind-a-flag paid-bookings pilot (Flutterwave, with Pesapal planned next) is layered on top without changing that default. AFCON 2027 content (club pages, match tickets, venue pages) lives behind its own flag and reuses the same booking/rewards machinery rather than a parallel system.

Stack

• Next.js 16 (App Router, Turbopack, TypeScript) — note the app uses src/proxy.ts (Next 16's renamed middleware.ts) for route protection.
• Drizzle ORM + Postgres (postgres.js driver), with Postgres Row-Level Security as a second, database-enforced layer under the app's own server-side authorization checks. See RLS and database migrations below — this is the part most likely to trip up a new environment.
• Auth: custom email/password with bcrypt + signed JWT session cookies (src/lib/session.ts, src/lib/auth.ts), email verification, WhatsApp/SMS phone verification, and self-service password reset — deliberately lightweight (no third-party auth provider) so it stays easy to reason about.
• Payments: Flutterwave, currently wired up for Wano XP paid match seats only (everything else stays pay-at-venue). A Pesapal integration for a broader paid-bookings pilot is planned as a separate workstream, behind the same PAID_BOOKINGS_ENABLED kill switch.
• Notifications: email via Resend (console-log stub when unconfigured, see below), WhatsApp via Wati's WhatsApp Business API (src/lib/whatsapp.ts) for phone verification and reminders.
• Mobile: Capacitor wraps the live Next.js site for Android and iOS (capacitor.config.ts) — this is a server-rendered app with server actions and live cookies, not a static export, so the native shell loads the deployed site at runtime rather than bundling a build.
• Tailwind CSS v4 with a custom forest-green / marigold / Nile-blue theme (src/app/globals.css).
• Vercel for hosting, Vercel Cron for the scheduled jobs under src/app/api/cron/*, Neon for managed Postgres in production.

Getting started

1. Start a Postgres database. Either run the bundled one:

   docker compose up -d
   

   or point DATABASE_URL at any managed Postgres (Neon, Supabase, RDS, etc).

2. Configure environment variables:

   cp .env.example .env.local
   # then edit .env.local — set DATABASE_URL and generate an AUTH_SECRET:
   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
   

3. Install dependencies (already done if you're continuing this session):

   npm install
   

4. Push the schema, apply RLS, and seed demo data:

   npm run db:push
   # then every file in drizzle/manual_*.sql, in the order described below —
   # db:push alone does not set up RLS or any other non-schema.ts SQL
   npm run db:seed
   npm run db:seed:wano
   

   (db:seed:birthday, db:seed:journal and db:seed:clubs add more optional demo content for those specific features — not required for a basic local setup.)

   The seed scripts create the 5 fixed journeys, demo challenges, a handful of demo accredited vendors (one pending accreditation), and demo accounts — all with password WanoLocalDev-9214! (local dev only; see src/db/seed.ts if you change it):

   • Traveller: [email protected] (already has 2 of 5 stamps)
   • Vendor: [email protected] (and several others — see src/db/seed.ts)
   • Admin: [email protected]

   These credentials are for a local database only — never rendered on any page, and never the credentials for the live/production deployment.

5. Run the dev server:

   npm run dev
   

   Open http://localhost:3000.

6. (Optional) Admin email notifications. The admin gets an email whenever someone signs up (traveller or vendor), a vendor submits an accreditation document, or someone submits/applies to start a club. This works out of the box in a sort of way — without any setup it just logs the email to the server console instead of sending it, so nothing breaks, but nothing actually arrives anywhere either. To get real emails:

   • Sign up at resend.com (free tier is plenty for this) and grab an API key from in the dashboard.

This is the beginning of the README. Read the rest at the original. Read the full README ↗