LetsCoInvest
Real estate is a top-performing asset class that most people can't actually buy into — direct ownership means large lump sums, illiquid capital, and landlord overhead. LetsCoInvest turns it into something you can buy a slice of: investors fund an in-app wallet, commit any amount toward a property's funding goal, and automatically receive a proportional ownership stake they track in a live portfolio as valuations move. CodingStack built the entire product end-to-end — a Node/Express + MongoDB API serving a React investor web app, a React Native (Expo) mobile app, and an admin back office — with layered auth (JWT, Google, email 2FA, RBAC), a bank-transfer wallet with admin reconciliation, KYC document verification, and admin-scheduled exit windows for liquidity, all self-hosted on a Dockerized VPS behind Nginx with automated TLS.
Role End-to-end build — full-stack web, mobile & API, deployment & DevOps
Problem
Real estate consistently outperforms but stays out of reach for ordinary investors: buying outright takes large capital, locks money up illiquidly, and saddles owners with management overhead. LetsCoInvest lets people pool capital to co-own vetted properties — taking a fractional share for a small commitment and earning proportional exposure to appreciation and rental yield. The hard part was building every rail that makes that trustworthy and usable: identity and KYC, a funded wallet with auditable money movement, fractional purchase mechanics, portfolio valuation, and liquidity windows — consistently across web, mobile, and an admin console.
Architecture
- H01
Wallet-backed fractional co-investment
The core money flow lives in order checkout: it verifies wallet balance, writes an internal 'completed' transaction and an order, then for each property computes the buyer's share (amount ÷ funding goal, capped at 100%), increments investor count and total raised, auto-marks the property 'funded' once the goal is hit, bulk-inserts Investment records, and atomically decrements the wallet with $inc. Because the stack runs single-node MongoDB (Mongoose 5, no multi-document transactions), these writes are fanned out with Promise.all and atomicity is handled deliberately at the application layer.
- H02
Manual bank-transfer rails with admin reconciliation
With no card processor in the loop, deposits are real bank transfers: the user uploads an invoice as proof, creating a pending transaction; an admin then approves, rejects, or reverts it, each path mutating the wallet balance and transaction status (credit/debit/internal). The deposit controller implements compensating rollback — if saving bank details fails after the transaction is created, it deletes the orphaned records — and the full ledger is exportable to CSV for off-platform accounting.
- H03
Layered auth and RBAC across three clients
Authentication is built on Passport with JWT access tokens plus DB-persisted refresh tokens that rotate on every refresh and are revoked on logout. Google sign-in runs two distinct paths — an OAuth redirect for web and google-auth-library ID-token verification for the native app — while email 2FA issues bcrypt-hashed, 10-minute codes. A role-rights map (user/admin/superAdmin) is enforced in middleware, and deactivated accounts are rejected at the JWT strategy itself so a stale token can't be reused.
- H04
One API, three front ends
A single Express/MongoDB backend serves a React 19 web app (marketing site + investor dashboard), a React Native (Expo SDK 54) mobile app, and a separate admin console — each with its own Redux Toolkit store and a shared axios layer that injects bearer tokens. Routes are auto-discovered: the router scans the routes directory at boot and mounts every folder's route.js, so adding a domain is a matter of dropping in a folder. Reusable Mongoose plugins handle JSON serialization (stripping private fields like passwords and 2FA codes) and pagination across every model.
- H05
Compliance-grade identity and account lifecycle
Onboarding is a step machine — a steps counter on the user gates the dashboard until employment/income profiling and ID-document upload (front+back, CNIC/passport) are done, with admin verification flags. The same rigor extends to offboarding: users can deactivate and silently reactivate on next login, or file a deletion request that schedules removal 30 days out and lands in an admin review queue — the kind of controls a regulated financial product needs.
- H06
Self-hosted, Dockerized deployment with automated TLS
The whole platform ships as one Docker Compose stack — web, admin, API, and MongoDB 6 containers behind an Nginx reverse proxy that terminates TLS for three subdomains (apex, admin., api.) with Let's Encrypt certificates auto-renewed by a Certbot sidecar. The Vite SPAs use multi-stage builds (build, then serve static from nginx:alpine); the API runs under PM2 as a non-root user with a persistent uploads volume; deploys run a build-then-swap script (build --no-cache while old containers serve, then down/up); and the mobile app ships updates over-the-air via expo-updates.
Key features
- 01Curated property marketplace with deep deal financials — funding goal and live funding progress, minimum investment, gross/net yield, projected return, dividend frequency, latest valuation, occupancy, asset class, and investment strategy.
- 02Fractional co-investment checkout: commit any amount toward a deal and receive an auto-calculated ownership share (capped at 100%), with the property flipping to 'funded' the moment its goal is met.
- 03In-app wallet funded by bank transfer with proof-of-payment (invoice) upload, backed by a full credit/debit/internal transaction ledger.
- 04Admin reconciliation console to approve, reject, or revert deposits — each adjusting wallet balances — plus one-click CSV export of the full transaction ledger for accounting.
- 05Live portfolio view that computes each holding's current value from the property's latest valuation, with appreciation shown per-property and overall in both value and percent.
- 06Multi-step KYC onboarding (employment, income source, annual spend) with government-ID upload (CNIC/passport, front and back) and admin document verification; a step counter gates dashboard access until it's complete.
- 07Saved bank accounts for deposits/payouts and a bookmark/watchlist for properties.
- 08Admin-configurable exit windows (live / coming-soon / closed) that signal to investors when they can liquidate.
- 09Layered authentication: email/password, Google sign-in on both web (OAuth redirect) and mobile (native ID-token verification), email-based two-factor codes, plus email verification and password reset.
- 10Role-based access control (user / admin / super-admin) enforced through a granular permission map, with super-admins able to add or remove other admins.
- 11Compliant account lifecycle: self-service deactivation/reactivation and deletion requests with a 30-day grace period and an admin review queue.
- 12Admin CMS for creating and editing properties with multi-image and document uploads, plus management of users/subscribers, banners, reviews, and feedback.
Stack
Frontend (Web)
Mobile
Backend
Data
Infra
Status
Live
An idea, an existing app, or something in between?
Tell us what you're trying to ship. We reply within one business day with a written take on scope and timeline, not a sales pitch.