# LunchShift — Smart Meal Booking Platform

> Enterprise B2B SaaS for corporate food service management (ristorazione collettiva). 26 features, multi-tenant architecture, EU compliance, 7 payment gateways. Built by Marco Laudati.

---

## Platform Overview

LunchShift is a full-stack enterprise platform for the corporate catering industry (ristorazione collettiva). It manages the complete meal service workflow: nutritional ingredient databases, recipe building with automatic allergen calculation, multi-week menu planning, delegated meal booking, real-time order tracking, optimized delivery routes, and integrated payment processing.

The platform serves the Italian and European corporate food service market, addressing strict EU food safety regulations (EU 1169/2011 allergen disclosure), data protection requirements (GDPR, NIS2 directive), and enterprise security standards (WebAuthn, MFA, RLS).

### Key Numbers

| Metric | Value |
|--------|-------|
| Total features | 26 across 4 categories |
| INRAN ingredients database | 1,030+ with nutritional profiles |
| EU regulated allergens tracked | 14 (EU 1169/2011) |
| Payment methods supported | 7 (Stripe, Nexi, Satispay, Edenred, RFID, Wallet, Cash) |
| NIS2 compliance score | 95/100 |
| GDPR compliance score | 96/100 |
| Automated tests | 7,000+ (5,719 unit + 1,256 E2E + 6 load) |
| Tenant hierarchy levels | 4 (Platform → Kitchen → Customer → User) |
| RBAC security roles | 6 |
| Menu planning horizon | 12 weeks |
| Uptime target | 99.9% |
| Docker services | 8 |

---

## Feature Category 1: Operators & Manager (6 features)

Features for food service operators who manage clients, employees, and daily meal bookings.

### Delegated Booking {#delegated-booking}

**Batch meal ordering for operators managing corporate clients.**

Operators select a client company, target week, employee list, and available menu to create bulk meal bookings. The system processes hundreds of employee bookings in a single batch operation, reducing operator time by 32% compared to individual booking (internal benchmark).

- **Category**: Operators & Manager
- **Priority tier**: 1 (Hero feature)
- **Key metric**: -32% operator time
- **Tech stack**: React 19, Prisma ORM, Batch API
- **How it works**: Operator selects client → picks week → filters employees → assigns menu items → batch submit with validation → confirmation with summary

### Paper Booking (OMR) {#paper-booking}

**Optical Mark Recognition converts paper order forms to digital bookings.**

For clients who still use paper-based ordering, the OMR scanner reads filled-in paper forms and converts them to digital bookings in under 5 seconds. Each form includes a QR code for user identification and traceability. The system handles batch uploads of scanned forms.

- **Category**: Operators & Manager
- **Priority tier**: 2
- **Key metric**: <5 seconds per scan
- **Tech stack**: OMR (Optical Mark Recognition), QR Code, FastAPI Python microservice
- **How it works**: Print OMR forms with employee QR codes → employees fill bubbles → scan batch → FastAPI processes marks → validate and create bookings

### Employee Management {#employee-management}

**Bulk employee onboarding and role management.**

Import employee rosters via CSV, assign roles and groups for hundreds of employees simultaneously. Supports bulk operations, role-based access assignment, and group management. Eliminates manual data entry for large corporate clients.

- **Category**: Operators & Manager
- **Priority tier**: 3
- **Key metric**: 500+ employees per tenant
- **Tech stack**: Prisma ORM, CSV Parser, Zod validation
- **How it works**: Upload CSV → Zod validates schema → preview import → assign roles/groups → bulk create with conflict detection

### Delivery Groups {#delivery-groups}

**Intelligent delivery point management and label printing.**

Create delivery groups, assign delivery points (canteens, offices, floors), and print EU-compliant labels. Simplifies the logistics of distributing meals across multiple locations within a corporate campus.

- **Category**: Operators & Manager
- **Priority tier**: 3
- **Key metric**: 5 delivery points per group
- **Tech stack**: Prisma ORM, Google Maps integration, Label Print
- **How it works**: Create group → assign delivery points on map → configure schedules → generate labels → print batch

### Order Tracking {#order-tracking}

**Real-time order pipeline from kitchen to delivery.**

Every order is tracked through a status pipeline: Received → Preparing → Ready → In Transit → Delivered. Real-time updates via Socket.IO WebSocket connections. Automatic notifications to operators and delivery staff. 98% on-time delivery rate.

- **Category**: Operators & Manager
- **Priority tier**: 2
- **Key metric**: 98% on-time delivery
- **Tech stack**: Socket.IO, Redis, Real-time WebSocket
- **How it works**: Order created → kitchen marks preparing → ready notification → delivery pickup → GPS tracking → delivered confirmation

### Analytics & Reports {#analytics}

**Data-driven consumption dashboards with multi-format export.**

Advanced analytics dashboard with period filtering, Delta Mode for comparing time ranges, consumption trends, and cost analysis. Export reports in PDF (branded), Excel (detailed data), and CSV (raw data) formats.

- **Category**: Operators & Manager
- **Priority tier**: 2
- **Key metric**: 3 export formats (PDF, Excel, CSV)
- **Tech stack**: SVG Charts, ExcelJS, @react-pdf/renderer, Prisma
- **How it works**: Select date range → apply filters (client, group, menu type) → view interactive charts → toggle Delta Mode → export in chosen format

---

## Feature Category 2: Kitchen Operations (6 features)

Features for chefs and kitchen staff managing ingredients, recipes, menus, and food safety compliance.

### INRAN Ingredients Database {#inran-ingredients}

**1,030+ ingredients with official Italian nutritional values.**

Complete database sourced from INRAN (Istituto Nazionale di Ricerca per gli Alimenti e la Nutrizione), the Italian national food research institute. Each ingredient includes full macro and micronutrient profiles: calories, proteins, carbohydrates, fats, fiber, vitamins, and minerals.

- **Category**: Kitchen Operations
- **Priority tier**: 2
- **Key metric**: 1,030+ ingredients
- **Tech stack**: PostgreSQL full-text search, INRAN official database
- **How it works**: Search by name → filter by category → view nutritional breakdown → select for recipe building

### Recipe Builder {#recipe-builder}

**Automatic nutrient and allergen calculation from ingredients.**

Create recipes by adding ingredients with quantities. The system automatically calculates total nutritional values (from INRAN data), identifies all 14 EU-regulated allergens present, and estimates per-portion cost. Allergen detection follows EU 1169/2011 regulation with three risk levels.

- **Category**: Kitchen Operations
- **Priority tier**: 1 (Hero feature)
- **Key metric**: 14 EU allergens automatically detected
- **Tech stack**: React 19, Prisma ORM, INRAN nutritional database
- **How it works**: Add ingredients → set quantities → auto-calculate nutrients → auto-detect allergens (Contains/May Contain/Cross-Contact) → set portions → calculate cost per portion

### Menu Planner {#menu-planner}

**12-week multi-client drag-and-drop menu planning.**

Plan different menus for different clients up to 12 weeks ahead. Drag-and-drop interface for assigning recipes to days and meal slots. Supports holiday management, menu duplication across weeks, and per-client customization. Automatically inherits allergen information from recipes.

- **Category**: Kitchen Operations
- **Priority tier**: 2
- **Key metric**: 12 weeks planning horizon
- **Tech stack**: @dnd-kit (accessible drag-and-drop), Prisma ORM, Calendar
- **How it works**: Select client → choose week range → drag recipes to day/meal slots → mark holidays → duplicate weeks → publish menu

### Menu PDF Generator {#menu-pdf}

**Professional A4 PDF menus for print and distribution.**

Generate print-ready A4 PDF menus with EU 1169/2011 allergen icons, dietitian notes, and professional tenant branding. PDFs are server-rendered for consistent output across all devices.

- **Category**: Kitchen Operations
- **Priority tier**: 3
- **Key metric**: A4 PDF format
- **Tech stack**: @react-pdf/renderer, EU 1169/2011 allergen icons, A4 Print layout
- **How it works**: Select menu week → choose client → configure layout options → generate PDF with allergen icons → download or print

### Delivery Routes {#delivery-routes}

**Optimized routes with 300 DPI EU-compliant label printing.**

Plan delivery routes with ordered stops, print EU-compliant labels at 300 DPI for each delivery, and track delivery progress in real-time. Labels include allergen information, delivery point, and QR codes for confirmation.

- **Category**: Kitchen Operations
- **Priority tier**: 3
- **Key metric**: 300 DPI label resolution
- **Tech stack**: Google Maps API, 300 DPI thermal printer support, Batch Print
- **How it works**: View daily deliveries → optimize route order → print labels batch → start delivery → scan QR at each point → confirm delivery

### EU Allergen Compliance {#eu-allergens}

**Full EU 1169/2011 compliance for 14 regulated allergens.**

Complete implementation of EU Regulation 1169/2011 covering all 14 mandatory allergens: Gluten, Crustaceans, Eggs, Fish, Peanuts, Soybeans, Milk, Nuts, Celery, Mustard, Sesame, Sulphites, Lupin, Molluscs. Three risk levels: Contains (confirmed presence), May Contain (cross-contamination risk), Cross-Contact (production line risk). Automatic PDF label generation with standardized allergen icons.

- **Category**: Kitchen Operations
- **Priority tier**: 2
- **Key metric**: 14 EU allergens, 3 risk levels
- **Tech stack**: EU 1169/2011 regulation implementation, 14 allergen icon set, 3-level risk assessment
- **How it works**: Recipe ingredients → automatic allergen detection → classify risk level per allergen → generate compliant labels → attach to menus and orders

---

## Feature Category 3: Platform Admin (9 features)

Features for platform administrators managing security, compliance, multi-tenancy, and enterprise configuration.

### Multi-Tenant Architecture {#multi-tenant}

**4-level tenant hierarchy with PostgreSQL Row-Level Security.**

The platform uses a 4-level tenant isolation model: Platform (super-admin) → Kitchen (food service provider) → Customer (corporate client) → User (individual employee). Data isolation is enforced at the database level using PostgreSQL Row-Level Security (RLS) policies, ensuring tenants can never access each other's data. Six RBAC roles control access granularity.

- **Category**: Platform Admin
- **Priority tier**: 1 (Hero feature)
- **Key metric**: 4 tenant levels, 6 RBAC roles
- **Tech stack**: PostgreSQL RLS (Row-Level Security), Prisma ORM, Next.js middleware
- **Tenant levels**: Platform Admin → Kitchen Admin → Customer Manager → Customer Operator → Employee → Guest
- **How it works**: Each request includes tenant context → middleware validates tenant ownership → Prisma applies RLS policies → queries automatically filtered → cross-tenant access impossible

### NIS2/GDPR Compliance Suite {#nis2-gdpr}

**NIS2 directive score 95/100, GDPR score 96/100.**

Integrated compliance suite addressing both NIS2 (EU Network and Information Security Directive 2) and GDPR requirements. AES-256-GCM encryption for data at rest and in transit, right to erasure implementation, Art. 30 processing records, data breach notification workflows, and privacy impact assessments.

- **Category**: Platform Admin
- **Priority tier**: 2
- **Key metric**: NIS2 95/100, GDPR 96/100
- **Tech stack**: NIS2 directive implementation, GDPR regulation, AES-256-GCM encryption
- **Compliance details**: Incident response plan, supply chain security assessment, access control matrix, encryption key management, data processing records (Art. 30), data subject rights management, privacy by design, data protection impact assessments

### Audit Trail {#audit-trail}

**Complete GDPR Art. 30 event logging with severity scoring.**

Every user action is logged with timestamp, user identity, tenant context, action type, and severity score. Advanced filtering by date range, user, action type, and severity. Compliance-ready export for auditors. Minimum 365-day retention period.

- **Category**: Platform Admin
- **Priority tier**: 3
- **Key metric**: GDPR Art. 30 compliant
- **Tech stack**: Prisma ORM, GDPR Art. 30 implementation, Export (PDF/CSV)
- **Events tracked**: Login/logout, data access, data modification, data deletion, permission changes, security events, payment events, booking events

### Error Monitor {#error-monitor}

**Real-time error dashboard with 5-tier rate limiting.**

Centralized error monitoring dashboard showing real-time error rates, error categories, and affected users. 5-tier rate limiting system protects against abuse: Tier 1 (anonymous), Tier 2 (authenticated), Tier 3 (operator), Tier 4 (admin), Tier 5 (platform). Automatic alerting on error rate spikes.

- **Category**: Platform Admin
- **Priority tier**: 3
- **Key metric**: 5 rate limit tiers
- **Tech stack**: Sentry integration, Redis rate limiting, Real-time WebSocket alerts
- **How it works**: Error occurs → categorize severity → update dashboard → check rate limits → trigger alerts if thresholds exceeded

### Security Alerts {#security-alerts}

**Automated threat detection and blocking.**

Real-time monitoring for brute force attacks, anomalous login patterns (unusual location, time, device), and rate limit violations. Automatic blocking of suspicious IP addresses and user accounts. Multi-channel alerting: in-app notifications, email, and webhook integrations.

- **Category**: Platform Admin
- **Priority tier**: 2
- **Key metric**: 24/7 monitoring
- **Tech stack**: Real-time event processing, Auto-Block rules engine, Multi-Channel notification
- **Threats detected**: Brute force login attempts, credential stuffing, session hijacking attempts, privilege escalation attempts, unusual data access patterns, rate limit violations

### SSO + MFA Authentication {#sso-mfa}

**Enterprise passwordless authentication with FIDO2 AAL3.**

Four authentication methods: TOTP (Time-based One-Time Password), WebAuthn/Passkeys at FIDO2 AAL3 (Authenticator Assurance Level 3 — hardware-bound keys), Azure Active Directory SSO, and Google Workspace SSO. Supports passwordless login flows for maximum security and user convenience.

- **Category**: Platform Admin
- **Priority tier**: 2
- **Key metric**: AAL3 (highest authenticator assurance level)
- **Tech stack**: WebAuthn/FIDO2, TOTP, OAuth 2.0, SAML
- **Authentication flow**: User initiates login → choose method (Passkey/TOTP/SSO) → cryptographic verification → session creation with tenant context → MFA challenge if required

### TV Display System {#tv-display}

**Branded menu display for canteen and cafeteria TVs.**

16:9 optimized display layout showing today's menu with automatic rotation between meal options. Branded with tenant colors and logo. Includes QR code for instant mobile booking. Supports multi-display setups with different content per screen.

- **Category**: Platform Admin
- **Priority tier**: 3
- **Key metric**: 16:9 display format
- **Tech stack**: 16:9 responsive display, Auto-Rotate animation, QR Code generation
- **How it works**: Configure display content → assign to physical TV → auto-rotate menu items → show QR for booking → update in real-time when menu changes

### White-Label Branding {#branding}

**Per-tenant UI customization.**

Each kitchen tenant can customize the platform appearance: primary/secondary colors, logo, favicon, email templates, PDF templates, and login page branding. Implemented via CSS custom properties for instant theme switching without page reload. Complete white-label capability.

- **Category**: Platform Admin
- **Priority tier**: 3
- **Key metric**: 6 brandable elements per tenant
- **Tech stack**: CSS Custom Properties (variables), Prisma ORM, Theme engine
- **Customizable elements**: Primary color, secondary color, logo, favicon, email template, PDF template

### Progressive Web App (PWA) {#pwa}

**Installable web app with offline support.**

Native-like Progressive Web App installable directly from the browser — no app store required. Offline cache ensures core features work without internet. Push notifications for order updates, booking confirmations, and security alerts. Home screen shortcuts for quick access to frequent actions.

- **Category**: Platform Admin
- **Priority tier**: 3
- **Key metric**: PWA with offline support
- **Tech stack**: Service Worker, Cache API, Push API, Web App Manifest
- **Capabilities**: Install to home screen, offline menu viewing, push notifications, background sync, shortcuts

---

## Feature Category 4: Tech Deep-Dive (5 features)

Technical architecture details for developers and technical evaluators.

### 7 Payment Methods {#payments}

**Unified payment processing across 7 methods.**

Single payment abstraction layer supporting: Stripe (credit/debit cards), Nexi (Italian payment processor), Satispay (QR code mobile payments), Edenred (meal voucher cards), RFID Badge (contactless employee badges), Digital Wallet (prepaid balance), and Cash (manual reconciliation). All electronic payments encrypted with AES-256-GCM. PCI DSS compliant transaction handling.

- **Category**: Tech Deep-Dive
- **Priority tier**: 1 (Hero feature)
- **Key metric**: 7 payment gateways
- **Tech stack**: Stripe API, AES-256-GCM encryption, PCI DSS compliance
- **Payment methods**: Stripe (international cards), Nexi (Italian cards), Satispay (QR mobile), Edenred (meal vouchers), RFID Badge (contactless), Wallet (prepaid), Cash (manual)
- **Security**: PCI DSS Level 1, AES-256-GCM encryption, tokenized card storage, 3D Secure 2.0

### Real-Time Chat {#chat}

**Socket.IO messaging with Redis Pub/Sub.**

Full-featured real-time messaging system supporting three channel types: Direct (1:1), Group (multi-user), and Channel (topic-based). Features include typing indicators, emoji reactions, read receipts, message threading, and file attachments. Redis Pub/Sub enables horizontal scaling across multiple server instances.

- **Category**: Tech Deep-Dive
- **Priority tier**: 2
- **Key metric**: 3 channel types (Direct, Group, Channel)
- **Tech stack**: Socket.IO WebSocket, Redis Pub/Sub, WebSocket
- **Features**: Typing indicators, emoji reactions, read receipts, message threading, file attachments, online presence, message search

### OpenTelemetry Distributed Tracing {#otel-tracing}

**End-to-end request tracing across 8 Docker services.**

OpenTelemetry instrumentation provides distributed tracing across the entire microservice architecture: Next.js frontend, API server, authentication service, payment processor, notification service, OMR microservice, Redis, and PostgreSQL. Jaeger visualization shows span trees, latency breakdowns, and service dependency maps.

- **Category**: Tech Deep-Dive
- **Priority tier**: 3
- **Key metric**: 8 Docker services traced
- **Tech stack**: OpenTelemetry SDK, Jaeger UI, Docker Compose
- **Services traced**: Next.js app, API gateway, Auth service, Payment service, Notification service, OMR (FastAPI), Redis, PostgreSQL
- **Capabilities**: Span visualization, latency histograms, service dependency graph, error rate correlation, performance bottleneck detection

### Testing Pyramid {#testing-pyramid}

**7,000+ automated tests across three testing levels.**

Comprehensive testing strategy: 5,719 Jest unit tests covering business logic, data transformations, and utility functions; 1,256 Playwright E2E tests covering critical user flows (booking, payment, authentication); 6 k6 load tests validating performance under concurrent user loads. CI/CD pipeline runs all tests on every pull request.

- **Category**: Tech Deep-Dive
- **Priority tier**: 3
- **Key metric**: 7,000+ total tests
- **Tech stack**: Playwright (E2E), Jest (unit), k6 (load/performance)
- **Test breakdown**: 5,719 Jest unit tests, 1,256 Playwright E2E tests, 6 k6 load test scenarios
- **Critical flows tested**: Booking creation, payment processing, authentication, multi-tenant isolation, allergen calculation, menu planning

### Health Monitoring {#health-monitoring}

**Real-time infrastructure health checks with proactive alerting.**

Continuous health monitoring of all infrastructure components: PostgreSQL database connectivity and query performance, Redis cache availability, Docker container status, API endpoint response times. Proactive alerting triggers before failures impact users. Target uptime: 99.9%.

- **Category**: Tech Deep-Dive
- **Priority tier**: 3
- **Key metric**: 99.9% uptime target
- **Tech stack**: Node.js health check endpoints, Docker health probes, Jaeger alerting
- **Components monitored**: PostgreSQL (connectivity, query time, connection pool), Redis (connectivity, memory, hit rate), Docker containers (CPU, memory, restart count), API endpoints (response time, error rate)

---

## Architecture Overview

### Technology Stack

| Layer | Technologies |
|-------|-------------|
| **Frontend** | Next.js 16 (App Router, Server Components), React 19, TypeScript (strict mode), Tailwind CSS 3, Framer Motion 12, @dnd-kit |
| **Backend** | PostgreSQL 16, Prisma 6 ORM, Redis 7 (caching + pub/sub), Socket.IO (real-time), FastAPI Python (OMR microservice) |
| **Authentication** | WebAuthn/FIDO2 (AAL3), TOTP, OAuth 2.0, SAML, Azure AD, Google Workspace |
| **Payments** | Stripe, Nexi, Satispay, Edenred, RFID Badge, Digital Wallet, Cash |
| **Infrastructure** | Docker Compose (8 services), OpenTelemetry, Jaeger, MinIO S3, Zod validation |
| **Export** | ExcelJS (spreadsheets), @react-pdf/renderer (PDFs), CSV |
| **Testing** | Playwright (1,256 E2E), Jest (5,719 unit), k6 (6 load tests) |

### Architecture Layers

1. **Client Layer**: Browser App, Mobile PWA, TV Display System
2. **Application Layer**: Next.js 16 App Router, React 19 Server Components, Framer Motion 12 animations
3. **Security Layer**: MFA/WebAuthn, SSO/SAML, RBAC + PostgreSQL RLS, 6 roles
4. **Data Layer**: PostgreSQL 16 (primary store), Prisma 6 ORM, Redis 7 (cache + pub/sub)
5. **External Services**: Stripe/Nexi/Satispay (payments), Socket.IO (real-time), MinIO S3 (storage), Docker (orchestration)

### Compliance & Certifications

| Standard | Status | Score |
|----------|--------|-------|
| NIS2 Directive | Compliant | 95/100 |
| GDPR | Compliant | 96/100 |
| Enterprise Security | Compliant | 98/100 |
| EU 1169/2011 (Allergens) | Fully implemented | 14/14 allergens |
| PCI DSS | Compliant | Payment processing |
| ISO 22000 | Ready | Food safety management |
| BRC | Certified | Global food safety |
| IFS | Certified | International food standard |

---

## About

**LunchShift** is designed and built by **Marco Laudati** as a full-stack enterprise showcase demonstrating modern B2B SaaS architecture for the corporate food service industry.

- **Author**: Marco Laudati
- **Email**: info@romagnainformatica.it
- **LinkedIn**: https://www.linkedin.com/in/marcolaudati/
- **Website**: https://lunchshift.app
- **Source**: Showcase site built with Next.js 16, React 19, TypeScript, Tailwind CSS, deployed on Vercel