Odobase: fleet operations for car rental

Drivers are not office users

A driver can move from one company to another, and has no password or office account. Drivers needed a sign-in built on a phone number and a short PIN that does not log them out in the middle of a shift.

Money that must not drift

Prices quoted to a customer, VAT per line and credit notes all have to add up the same way on the screen, on the PDF and in the reports.

Customers in more than one language

Operators work in English, Arabic, Urdu and other languages, and Arabic invoices need proper right-to-left shaping in the PDF.

Paid APIs on every screen

Maps, places lookups, flight data and WhatsApp messages all cost money per call, so usage had to be designed in, not discovered on the bill.

Trips, dispatch and the roster

Trips are scheduled, assigned a vehicle and a driver, and tracked through their status from one screen.

• Recurring trips and a weekly roster
• Trips that can be paused and resumed
• Self-drive hire with vehicle availability

The driver app and its API

A versioned HTTP API that the Android and iOS driver app talks to, documented endpoint by endpoint.

• Sign-in with a phone number and a 4-digit PIN
• Two tokens on every call: one for the app build, one for the driver
• Trip assignment and cancellation pushed through Firebase Cloud Messaging
• GPS points recorded about every 30 seconds during a trip

Customer messages and the trip page

Customers hear about their trip at each step and can follow it on a live trip page linked from every message.

• WhatsApp Business messages on the WhatsApp Cloud API
• Email notifications
• A public trip link with the company’s own branding

Bookings, quotes and the customer portal

Public booking forms create leads, leads become quotes, and accepted quotes become trips, all priced on the server.

• Price lists and instant quotes
• Quote PDFs
• A portal for customers and company accounts with one-time-code sign-in

Invoicing and VAT

Invoices are raised from completed trips, with VAT calculated per line and snapshotted onto the invoice.

• Credit notes with their own gapless numbering
• Bilingual PDFs rendered with mPDF
• Accounting reports and CSV exports

Flight tracking

Airport pickups follow the flight, and a delayed flight moves the trip through one controlled write.

• Flight data behind a provider interface
• A daily call budget set by staff

AI copilot and receipt checks

AI features run on laravel/ai behind one recorder, so every call is logged and metered per company.

• Providers and models managed by staff
• A fallback model on failure
• AI switched off until a company turns it on

Privacy tools

A privacy module for customer data export and erasure, with consent history and retention.

• Data export as a ZIP
• Erasure that keeps issued invoices intact
• Two-factor sign-in for the dashboard

Single-database multi-tenancy

Every company’s rows share the same tables, separated by a company id and a global scope from spatie/laravel-multitenancy. Tests fail if a new company-owned model skips any of the steps that keep it isolated.

Six surfaces, six hosts

The marketing site, the dashboard, the driver API, the staff admin, the public booking pages and the customer portal each answer on their own hostname, and code asks which surface a request is on by host, never by path.

Controller, service, repository

Controllers never query the database. Services hold the business rules and repositories hold every query, which keeps each domain testable on its own.

Money as exact decimals

Amounts are stored as fixed decimals and calculated as strings with bcmath, with one per-line tax calculator. Integer minor units appear only at a payment gateway’s edge.

An outbox for side effects

Anything that must happen after a change, like a customer message or a flight subscription, is recorded as an event inside the same transaction and relayed after commit. Handlers are keyed on the event id, so a retry never sends twice.

Paid APIs kept in check

Every billable Google Maps product has a daily tally. Route plans are cached in a table for up to Google’s 30-day limit, and address autocomplete checks the company’s own recent places before calling Google.

Modules that fail closed

Optional features such as recurring trips, self-drive hire and customer messaging are modules switched on per company, and a module with no setting stays off.