Project Overview
Business context, goals, and key capabilities
6
Development Phases
42
Planned Tasks
8
RFP Workflow Steps
24
API Endpoints
~26
Weeks Estimate
Business Goal
Build a consumer-facing (B2C) venue and hotel booking portal similar to Cvent that allows individuals and corporate event planners to search venues, submit RFPs, manage room blocks, arrange meals and catering, and track booking lifecycle — all powered by the official Cvent Developer API at developer.cvent.com.
Key Differentiators
Consumer-first UX with simplified RFP builder · Real-time venue availability via Cvent API · Integrated meal & catering package selection · Guest room block management · Transparent pricing comparison · Mobile-responsive design · Hosted on cvent.swapunits.online
System Requirements
Functional, non-functional, and compliance requirements
Functional — User Management
- SYS-001User self-registration with email verification Critical
- SYS-002OAuth2 social login (Google, LinkedIn) High
- SYS-003Role-based access: Guest, Planner, Venue Manager, Admin Critical
- SYS-004User profile with company details, billing address, preferences High
- SYS-005Password reset and account recovery flows Critical
Functional — Venue & Search
- SYS-006Venue search by location, capacity, amenities, date Critical
- SYS-007Interactive map view with venue pins High
- SYS-008Venue detail pages: photos, floor plans, room specs Critical
- SYS-009Availability calendar integration via Cvent API Critical
- SYS-010Save venue to shortlist / compare up to 5 venues Medium
Functional — RFP Builder
- SYS-011Multi-step RFP wizard: Event → Rooms → Meals → Contacts → Pricing Critical
- SYS-012Add multiple venues to a single RFP for competitive bidding Critical
- SYS-013Event Requirements: dates, duration, attendance, event type, setup style Critical
- SYS-014Guest Room Requirements: room types, check-in/out, block size, rate caps Critical
- SYS-015Meals & Catering: breakfast, lunch, dinner, breaks, dietary requirements Critical
- SYS-016Pricing Preferences: budget range, per-person cost, F&B minimum High
- SYS-017Custom Questions: configurable planner-defined question fields High
- SYS-018Other Information: AV needs, accessibility, parking, branding restrictions High
- SYS-019Contact Details: primary contact, billing contact, on-site coordinator Critical
- SYS-020Draft save, resume, and submit RFP with confirmation email Critical
Functional — Proposals & Booking
- SYS-021Receive and compare venue proposals side-by-side Critical
- SYS-022Contract review and e-signature integration High
- SYS-023Booking confirmation with unique booking reference Critical
- SYS-024Payment processing: deposit, installments, final payment High
- SYS-025Booking management dashboard: view, modify, cancel bookings Critical
- SYS-026Email/SMS notifications at each booking status change Critical
Non-Functional — Performance
- NFR-001Page load time < 2 seconds on 4G connection Critical
- NFR-002Support 1,000 concurrent users without degradation High
- NFR-003API response time < 500ms for venue searches High
- NFR-00499.5% uptime SLA with automated health monitoring Critical
- NFR-005Mobile-first responsive design (iOS, Android, tablet) Critical
Non-Functional — Security & Compliance
- SEC-001TLS 1.3 on all endpoints; HSTS headers enforced Critical
- SEC-002PCI-DSS compliance for payment card data handling Critical
- SEC-003GDPR-compliant data handling; cookie consent banner High
- SEC-004OWASP Top 10 mitigations: XSS, CSRF, SQLi, IDOR Critical
- SEC-005Rate limiting on auth and RFP submission endpoints High
- SEC-006Encrypted storage of PII (AES-256 at rest) Critical
Technical Requirements
Architecture, integration, infrastructure, and API specifications
Architecture Requirements
- TECH-001Microservices-ready modular monolith — Auth, Venues, RFP, Booking, Notification services
- TECH-002RESTful API backend with OpenAPI 3.0 documentation
- TECH-003React SPA frontend with server-side rendering (Next.js)
- TECH-004Redis caching for venue search results (TTL: 5 min)
- TECH-005Message queue (BullMQ) for async notifications
- TECH-006PostgreSQL primary database with read replica
Cvent API Integration Requirements
- TECH-007OAuth2 client credentials flow via developer.cvent.com
Scope: venue:read, rfp:write, booking:read, hotel:read - TECH-008Venue Search API: /venues with filter params
- TECH-009Venue Detail API: /venues/{id} including room inventory
- TECH-010RFP Submission API: POST /rfps with full JSON payload
- TECH-011Hotel Room Blocks API: /hotels/{id}/room-blocks
- TECH-012Proposal Retrieval API: GET /rfps/{id}/proposals
- TECH-013Webhook handling for real-time proposal status updates
- TECH-014Token refresh handling with exponential backoff retry
Infrastructure Requirements
- INF-001Nginx reverse proxy on cvent.swapunits.online (443/80)
- INF-002Let's Encrypt SSL with auto-renewal via Certbot
- INF-003PM2 process manager for Node.js in cluster mode
- INF-004PostgreSQL 16 with daily automated backups (30-day retention)
- INF-005Redis 7 for session store and job queue
- INF-006Nginx gzip compression + static file caching headers
- INF-007Loki + Grafana for log aggregation and dashboards
- INF-008Automated CI/CD pipeline (GitHub Actions)
Data Requirements
- DATA-001User PII encrypted at rest; separate encryption keys per tenant
- DATA-002RFP data model: Event + Rooms + Meals + Contacts + Pricing + Questions
- DATA-003Audit log for all RFP state transitions and booking actions
- DATA-004Media storage for venue images via S3-compatible object storage
- DATA-005Full-text search index on venue name, city, amenities (pg_trgm)
- DATA-006Data retention: RFP drafts 90 days; confirmed bookings 7 years
Software Requirements
Technology stack, dependencies, and tooling
Next.js 15
Frontend Framework (SSR/SPA)
Node.js 22 LTS
Backend Runtime
Express.js 5
REST API Server
PostgreSQL 16
Primary Database
Redis 7
Cache & Job Queue
Prisma ORM
Database Abstraction
Tailwind CSS 4
UI Styling
NextAuth.js
Auth & Session Mgmt
Resend / Nodemailer
Transactional Email
Stripe
Payment Processing
Mapbox GL JS
Interactive Maps
BullMQ
Background Jobs
Zod
Schema Validation
Recharts
Analytics Dashboard
Vitest + Playwright
Unit & E2E Testing
GitHub Actions
CI/CD Pipeline
Browser & Platform Support
- SW-001Chrome 120+, Firefox 120+, Safari 17+, Edge 120+ Critical
- SW-002iOS Safari 17+, Chrome on Android 120+ Critical
- SW-003Node.js 22 LTS server runtime (minimum v20 LTS) Critical
- SW-004Ubuntu 22.04 LTS production server OS High
- SW-005Nginx 1.24+ with HTTP/2 and Brotli compression modules High
RFP Workflow
8-step RFP builder modeled on Cvent RFP process
1
Add Venue to RFP
→
2
Event Requirements
→
3
Guest Room Requirements
→
4
Meals & Catering
→
5
Contact Details
→
6
Pricing Preferences
→
7
Other Information
→
8
Customer Questions & Submit
Step 2 — Event Requirements
- RFP-E1Event name, type (conference, wedding, corporate, gala)
- RFP-E2Preferred dates + alternate dates; multi-day event support
- RFP-E3Expected attendance count (minimum, maximum)
- RFP-E4Meeting room setup: Theatre, Classroom, Banquet, U-Shape, Reception
- RFP-E5Function rooms required per day with timing
- RFP-E6AV requirements: projector, PA, video conferencing, streaming
Step 3 — Guest Room Requirements
- RFP-R1Check-in / check-out dates; length of stay per guest
- RFP-R2Room type mix: single, double, suite, accessible
- RFP-R3Room block size per night with peak night designation
- RFP-R4Rate cap per room per night (budget ceiling)
- RFP-R5Complimentary room ratio request (1 comp per N rooms)
- RFP-R6Attrition policy preference and cancellation terms
Step 4 — Meals & Catering
- RFP-M1Meal functions per day: breakfast, AM break, lunch, PM break, dinner, reception
- RFP-M2Cover count per meal function
- RFP-M3Meal service style: buffet, plated, stations, cocktail
- RFP-M4Dietary requirements: halal, kosher, vegan, gluten-free
- RFP-M5Beverage packages: alcoholic, non-alcoholic, hosted bar
- RFP-M6Per-person F&B budget and minimum spend expectations
Steps 5-8 — Contacts, Pricing, Questions
- RFP-C1Primary planner: name, title, email, phone, company
- RFP-C2On-site coordinator details (may differ from planner)
- RFP-C3Billing / accounts payable contact
- RFP-P1Total event budget range; separate room vs F&B budget
- RFP-P2Preferred payment schedule: deposit %, milestones, final
- RFP-O1Accessibility needs, parking requirements, decor restrictions
- RFP-Q1Admin-defined custom questions with text/select/date field types
- RFP-Q2Planner-written notes / special requests free-text field
Cvent API Integration
Key endpoints from developer.cvent.com used in this platform
Development Phases & Tasks
6-phase agile delivery plan with detailed task breakdown
P1
Foundation & Infrastructure
Project scaffolding, server setup, CI/CD, auth, and Cvent API connectivity
-
1.1Initialize monorepo (Next.js 15 + Express.js API)Create /apps/web (Next.js) and /apps/api (Express) with TypeScript, ESLint, Prettier config and shared /packages/types
-
1.2PostgreSQL 16 + Prisma schema setupDefine User, Venue, RFP, RFPVenue, GuestRoomBlock, MealFunction, Booking, Contact models with all relations
-
1.3Authentication — NextAuth.js with email + OAuth2JWT sessions, email/password, Google and LinkedIn OAuth providers, email verification flow, RBAC middleware
-
1.4Cvent API OAuth2 client + token managerImplement developer.cvent.com OAuth2 client credentials flow, token refresh, retry with exponential backoff, env-based credential storage
-
1.5Nginx configuration for cvent.swapunits.onlineNginx reverse proxy (port 3000 Next.js, port 4000 API), Let's Encrypt SSL, gzip, HTTP/2, security headers (HSTS, X-Frame-Options)
-
1.6GitHub Actions CI/CD pipelineLint, type-check, test, build, and deploy on push to main branch via SSH to production server with PM2 reload
-
1.7Redis setup for sessions and BullMQ job queuesSession store, notification job queues (email, SMS), Cvent webhook processing queue with retry logic
-
1.8Design system — Tailwind config, base component libraryColor tokens, typography scale, Button, Input, Select, Modal, Card, Badge components — mobile-first
P2
Venue Discovery & Search
Venue search, detail pages, maps integration, and availability via Cvent API
-
2.1Venue search API — proxy Cvent /venues endpointLocation, date, capacity, amenity filters; Redis cache 5 min; paginated response with cursor
-
2.2Venue search results page with filter sidebarList view with venue cards, sort (price/rating/distance), filter panel, pagination, skeleton loading states
-
2.3Interactive map view — Mapbox GL JSClustered venue markers, click-to-preview popups, sync map with list, map/list toggle
-
2.4Venue detail page — photos, rooms, amenitiesPhoto gallery with lightbox, meeting room specs table, amenities grid, capacity chart, virtual tour embed
-
2.5Availability calendar widgetDate range picker pulling Cvent /venues/{id}/availability — highlight available/blocked/pending dates
-
2.6Shortlist and compare (up to 5 venues)Save venues to shortlist, side-by-side comparison table for capacity, pricing, and amenities
-
2.7Cvent webhook registration and handlerPOST /webhooks on Cvent API, handle venue availability and RFP status change events via BullMQ queue
P3
RFP Builder & Hotel Room Blocks
Full 8-step RFP wizard, meals configuration, and hotel room block management
- 3.1RFP data model and state machinePrisma schema for RFP with states: DRAFT → SUBMITTED → PROPOSAL_RECEIVED → NEGOTIATION → BOOKED → CANCELLED
- 3.2Step 1 — Add Venue to RFP flow"Add to RFP" button on venue pages; multi-venue selection basket; RFP creation from shortlist with venue pre-populated
- 3.3Step 2 — Event Requirements formEvent name/type, dates with multi-day support, attendance range, room setup style per day, AV requirements checklist
- 3.4Step 3 — Guest Room Requirements formRoom type mix builder per night, rate cap slider, block size, comp ratio, attrition and cancellation policy preferences
- 3.5Step 4 — Meals and Catering formMeal function builder (per-day, per-session), service style, cover count, dietary flags, F&B budget; pull caterer menus from Cvent API
- 3.6Step 5 — Contact Details formPrimary planner, on-site coordinator, billing contact fields; auto-populate from user profile; add multiple contacts
- 3.7Steps 6-8 — Pricing, Other Info, and Custom QuestionsBudget range sliders, payment schedule builder, AV/parking/accessibility checklist, admin-configurable custom question engine
- 3.8RFP draft auto-save and resumeDebounced auto-save every 30 seconds; resume from any step; step completion indicators; progress bar at top
- 3.9RFP submission — POST to Cvent /rfpsValidate and transform form data to Cvent RFP payload format, submit to API, store Cvent RFP ID, send confirmation email
- 3.10Hotel room block management pageCreate/view/modify room blocks via Cvent hotel API; room pickup tracker with visual gauge; link block to RFP
P4
Proposals, Bookings & Payments
Proposal comparison, contract management, booking lifecycle, and Stripe payments
- 4.1Proposals inbox — list and notificationPoll /rfps/{id}/proposals; push notification to user when new proposal arrives; email alert with deep link
- 4.2Proposal comparison viewSide-by-side table: room rate, F&B package, AV, total cost estimate, venue score; accept/decline action buttons
- 4.3Contract review and e-signature flowDisplay contract PDF from Cvent API; DocuSign embedded signing or checkbox accept for MVP phase
- 4.4Stripe payment integration — deposit and milestonesPayment intent for deposit percentage, saved card for future milestones, webhook for payment confirmation, receipts
- 4.5Booking confirmation page and dashboardBooking reference, venue details, dates, payment schedule summary; downloadable booking summary PDF
- 4.6Booking modification and cancellation flowsPUT /bookings/{id} for amendments; cancellation with fee calculation display; status timeline view
- 4.7Email and SMS notification systemBullMQ job processors: RFP submitted, proposal received, booking confirmed, payment due, booking modified
- 4.8My Events dashboardCards for all bookings (upcoming, past, cancelled); RFP status pipeline view; quick actions per booking
P5
Admin Panel & Analytics
Admin dashboard, venue manager portal, custom questions engine, reporting
- 5.1Admin dashboard — users, RFPs, bookings overviewKPI cards (total RFPs, conversion rate, revenue), data tables with search/filter, user management actions
- 5.2Custom questions engine (admin-configurable)CRUD for question templates; field types: text, textarea, select, multiselect, date, number; required/optional flag per question
- 5.3Analytics and reporting — Recharts dashboardsBooking funnel, revenue by month, top venues, RFP response time metrics via Cvent /reports/bookings endpoint
- 5.4Content management — venue spotlights and bannersAdmin-managed homepage featured venues, promotional banners, destination guides with WYSIWYG editor
- 5.5Audit log viewer and data export (CSV/PDF)Filterable audit log for all RFP and booking actions; bulk CSV export for accounting; GDPR data download
P6
QA, Security Hardening & Launch
End-to-end testing, security audit, performance optimization, and production launch
- 6.1Playwright E2E test suite — full RFP booking flowAutomated: register → search → shortlist → build RFP → submit → receive proposal → accept → pay → confirm booking
- 6.2Security audit — OWASP Top 10 and penetration testXSS, CSRF, SQLi, IDOR checks; Stripe PCI-DSS verification; auth bypass testing; npm dependency vulnerability scan
- 6.3Performance optimization and Lighthouse auditTarget: LCP < 2s, CLS < 0.1, INP < 200ms; image optimization, code splitting, prefetch, CDN for static assets
- 6.4Production launch — DNS, SSL, monitoring go-liveDNS cutover to cvent.swapunits.online, Certbot SSL, Loki/Grafana dashboards live, Sentry error tracking, uptime monitoring
Delivery Timeline
26-week roadmap from kickoff to production launch
Weeks 1-4 · Phase 1
Foundation & Infrastructure
Monorepo setup, PostgreSQL + Prisma, auth, Cvent API OAuth2 client, Nginx config for cvent.swapunits.online, CI/CD pipeline
Weeks 5-8 · Phase 2
Venue Discovery & Search
Search pages, map view, venue detail pages, availability calendar, shortlist and compare feature
Weeks 9-14 · Phase 3
RFP Builder & Room Blocks
Full 8-step RFP wizard, meals and catering, hotel room blocks, draft auto-save, Cvent RFP submission
Weeks 15-19 · Phase 4
Proposals, Bookings & Payments
Proposal comparison, e-signature, Stripe payments, booking management, email and SMS notifications
Weeks 20-23 · Phase 5
Admin Panel & Analytics
Admin dashboard, custom questions engine, Recharts reporting, content management, audit logs
Weeks 24-26 · Phase 6
QA, Security & Launch
Playwright E2E tests, OWASP security audit, performance optimization — DNS cutover and cvent.swapunits.online goes live
Infrastructure & Hosting
Production setup on cvent.swapunits.online
Nginx Configuration — cvent.swapunits.online
server {
listen 80;
server_name cvent.swapunits.online;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name cvent.swapunits.online;
client_max_body_size 50M;
ssl_certificate /etc/letsencrypt/live/cvent.swapunits.online/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/cvent.swapunits.online/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
add_header Referrer-Policy no-referrer-when-downgrade;
gzip on;
gzip_types text/css application/javascript application/json;
# Next.js frontend (port 3000)
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Express.js API (port 4000)
location /api/ {
proxy_pass http://127.0.0.1:4000/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}
access_log /var/log/nginx/cvent.swapunits.online.access.log;
error_log /var/log/nginx/cvent.swapunits.online.error.log;
}
Port Allocation
- :3000Next.js frontend (PM2 cluster, 2 instances)
- :4000Express.js REST API (PM2 cluster, 2 instances)
- :5432PostgreSQL 16 (local only, no public access)
- :6379Redis 7 (local only, password-protected)
- :80/443Nginx (public — handles SSL termination)
Environment Variables Required
- ENVCVENT_CLIENT_ID / CVENT_CLIENT_SECRET
- ENVCVENT_API_BASE_URL (api-platform.cvent.com)
- ENVDATABASE_URL (PostgreSQL connection string)
- ENVREDIS_URL / REDIS_PASSWORD
- ENVNEXTAUTH_SECRET / NEXTAUTH_URL
- ENVSTRIPE_SECRET_KEY / STRIPE_WEBHOOK_SECRET
- ENVMAPBOX_TOKEN
- ENVRESEND_API_KEY (transactional email)