BookDirect docs v1 (stable)

Product: a property management system. Hotels, shortlets, and apartments are all properties.

Engineering: how-to-build playbooks. Frontend is Next.js (Frontend — Marketplace + Frontend — Extranet). Each step names one winner URL.

The frontend browse x-api-key / NEXT_PUBLIC_API_KEY is public. IDOR is Core Backend path settings and Middleware Backend.

Playbooks

1. Frontend — pick Frontend — Marketplace or Frontend — Extranet. Default view is Screens / Pages. Logic / Functions is the same story by capability.
2. Middleware Backend — folders: properties, rates-packages, bookings, availability, payments, reservations, file-manager. Default view is Logic / Functions.
3. Core Backend — users, JWT, generic entities. Do not add PSP, email, or Google Hotel logic. Marketplace list: Middleware → Core search indexes. Frontend amenities: local tick list.
4. Project Management — turn a feature on: activation matrix (status, winner URL, ENV names, Core metadata) and the ENV / Metadata Catalog index. Not a product-manager story. Dates: Roadmap.

Winner rule

1. If only Core Backend has the operation → frontend calls Core Backend (auth in v1).
2. If Middleware Backend exposes the same job → frontend switches to Middleware Backend. Core Backend becomes “called by Middleware Backend.”
3. Never list two “pick one” URLs.

Drift (2026-09-18): Middleware Backend already owns properties, rates-packages, bookings, availability, payments, reservations. The Next app still posts Core Backend smart-meta-manager for property/room/rate_plan/booking. Playbooks name Middleware Backend as winner. Frontend should switch.

v1 winners at a glance

Step	Winner	Full URL
Register	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register
Login	Core Backend	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login
List / create property	Middleware Backend	GET/POST https://middleware-dev.bookdirect.live/api/v1/nellalink/properties
Rates / packages	Middleware Backend	POST https://middleware-dev.bookdirect.live/api/v1/nellalink/rates-packages/property/{propertyId}
Check availability	Middleware Backend	POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/availability/check
Create booking	Middleware Backend	POST https://middleware-dev.bookdirect.live/api/v1/nellalink/bookings
Start payment	Middleware Backend	POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/payments/initialize
Host reservations	Middleware Backend	GET https://middleware-dev.bookdirect.live/api/v1/nellalink/reservations/property/{propertyId}
Upload photo	Middleware Backend	POST https://middleware-dev.bookdirect.live/api/v1/nellalink/file-manager/aws/upload-url

Refunds, emails, and Google ARI folders are not in config/routes.json yet. Contracts stay under limitations.