Listurad — Classified Ads & Social Marketplace

Overview

Listurad is a full-stack marketplace where people list what they want to sell, discover listings in a social feed, message each other in realtime, and pay to publish. Three clients — a Next.js web app, a Flutter mobile app, and an admin surface — are served by one FastAPI backend on a Supabase Postgres database, so business rules live in exactly one place.

Features

• AI ad posting — a user describes what they're selling and OpenAI drafts the structured listing: title, category, and description
• Automated content moderation, so listings are checked before they go live
• Automatic translation, making listings readable across languages
• An AI support assistant that answers user questions in-product
• Realtime buyer–seller chat over Supabase Realtime
• A social discovery feed for browsing listings
• Phone-OTP authentication via Firebase, with roles resolved server-side on every request
• Razorpay payments for India and PayPal for the rest of the world
• A coins wallet for publishing credits
• Scheduled ad lifecycle transitions owned by a single leader-gated scheduler

Architecture / how it works

• Browser requests go to same-origin Next.js API routes that act as a backend-for-frontend, forwarding to FastAPI with an httpOnly JWT — no token ever touches client JavaScript.
• The Flutter app talks to the same FastAPI endpoints directly, sharing every validation and pricing rule with the web client.
• The backend is a modular monolith: 14 independently-scoped service routers in one process sharing a common core, giving service boundaries without the operational cost of real microservices.
• A leader-gated APScheduler owns every ad lifecycle transition, so only one instance can move an ad between states no matter how many run.

Engineering details

• Money is server-authoritative: prices are re-derived on the backend and reconciled against the amount the gateway actually captured, so a tampered client cannot change what is charged.
• Personally identifiable fields are AES-256-GCM encrypted at rest, with decryption confined to a single helper.
• Revenue is stored per-currency instead of being flattened into one number at write time.
• Roughly 160 versioned SQL migrations keep the schema reproducible across environments.