Shift Staffing Platform

The problem

Hospitality venues staff shifts at a few hours' notice. A server calls out at four and someone qualified has to be behind the bar by six. The fallbacks — a group chat, a stack of CVs, cash at the end of the night — fail in four specific ways.

Nobody knows whether the worker is any good, because a CV says nothing about whether they can run a busy section. Shift operations are manual, so who confirmed, who arrived and who worked which hours lives on paper or nowhere. Paying people is slow and error-prone. And one account per business doesn't match reality: shift managers hire and approve hours, but must never hold the owner's payment credentials.

Vetting as infrastructure

Vetting isn't a signup form here. It's a skill test, a position-specific test, an orientation and a recorded audition — with its own API surface and its own standalone service. That's what makes it reasonable for a venue to trust a stranger behind their bar at 6pm.

Only people who have passed vetting for a role can apply to shifts for it.

Architecture

One Flutter codebase serves all three roles across iOS and Android — 94 screens, 52 BLoCs, 41 repositories, 67 models. Role separation lives in the state layer rather than in separate binaries, so identity, chat, notifications and vetting are shared infrastructure.

The API is NestJS with 18 controllers: accounts, auth handoff, payments, shifts, subscriptions, vetting, managers, notifications, maps, email, backups, legal and scheduling.

A Next.js 16 / React 19 console gives venues 43 routes of web access with Stripe Elements — where the whole operation is actually run. Separate marketing site, separate vetting service, and a Kotlin Android console for internal operations. Firebase for auth, data, storage, messaging and App Check.

The automation is the product

Twenty-eight scheduled jobs keep the marketplace running without anyone watching it.

When a shift goes short, backup sourcing escalates in waves — immediately to people who applied for that exact shift and missed out, at +20 minutes to qualified marketplace staff with venue regulars first, at +40 minutes fully public, with earlier invites still live so the fastest yes wins.

It also polices itself. Thirty minutes past start with no check-in is recorded as a no-show: first offence is a 30-day suspension, second is permanent. Reviews stay hidden until both sides have written one, so nobody rates defensively. Stale applications close, filled posts stop advertising, standby pools stay warm with a 48-hour replacement flow, and old notifications and expired audition videos are cleaned up.

The hardest problems

Cross-surface identity. Workers live in the mobile app, venues live in the web console, and both must share a session without a second sign-in. That needed its own auth-handoff subsystem on the API — invisible when it works, catastrophic when it doesn't.

Migrating a live payments-carrying backend. The original API was Python/Flask with a separate Python cron service, 112 commits between them. Both are retired; the current backend is NestJS with the scheduler folded in as a cron module, moved without interrupting an operating marketplace.

Wall-clock shift times. A 6pm shift is 6pm where the venue is, regardless of the device's timezone. Handled explicitly on both client and server, because storing shift times naively means workers arriving an hour late twice a year.

Result

In production across iOS, Android and web, under active development — 299 commits on the mobile app alone, the most recent within days.

Check-in is verified five ways: GPS, a one-time code, a selfie graded into three risk bands, a manager on site, or an admin override. Payments cover wages, subscriptions, tips, balance transfer and payouts.

Client work, so the source is private — happy to walk through the architecture or the backup-escalation design on a call.