Payda

İş modeline göre köklü sadeleştirme canlıda

Payda bugün en büyük değişimini yaşadı: iş modeline uymayan her şey silindi, kalan her şey tek kurala oturdu. Komisyon artık tek model — satıştan brüt yüzde; maaş ve satış-başı modeller, görev atama, bankacı giriş rolü ve genel gider kategorileri tamamen kaldırıldı. Satış girişi dört zorunlu alana indi (hesap, banka, kategori, üslup), müşteri kaydına numara bazlı engelleme geldi (taciz eden müşteri hangi hesaptan gelirse gelsin sorguda 🚫 ENGELLİ çıkıyor), görevlerin yerini hesaba bağlı tarihli hatırlatmalar aldı. Silmenin en zor kısmı kod değil kanıttı: her silinen parçanın gerçekten çağrılmadığı grep kanıtıyla raporlandı, bağımsız bir denetçi ajan rastgele örneklemle doğruladı ve test takımı yeni modele göre yeniden yazıldı — 1140 kontrol yeşil. Canlıdan da dört ölü fonksiyon silindi; biri açık kalsaydı dört-göz onayını atlatma yolu olurdu.

E-mail verification strip and deliverability work

Users signed in with an unverified e-mail now see a security strip in the panel: 'Send verification e-mail' in one click. A closing bug in the quick-action form was fixed too; both verified live. The next job is clear: we started the deliverability (SPF/DKIM) work so our e-mails stop landing in spam.

Email Verification · Security · UX

Live user testing: sign-in and e-mail verification fixed

I walked the site like a real user with a synthetic account: sign up → sign out → sign back in → transact. Everything the test caught was fixed the same day: new members weren't receiving the verification e-mail, unverified sign-up was possible, and sign-in stalled after a password reset — all fixed. In the UI the top-right bell is gone; notifications moved into the Summary (with 'Read' and 'Mark all read'), and the income/expense form now opens in place. The entire 8-item fix list went live.

Firebase Auth · Email Verification · UX

Shift rotation: the +1-hour rolling queue is live

The shift system now rotates the whole team in turn: each cycle the next person's shift slides +1 hour, and who comes when is visible 9 cycles ahead. The panel got an 'on shift now' badge and a rotation tab (current/next person + notifications). We started on the night of the 16th and finished by dawn; all 182 tests green, deployed.

Rotation Queue · Notifications · 182 Tests

Phone-app feel: bottom navigation + big buttons

I gave Payda a real phone-app feel: instead of tabs on top there's now a fixed floating bottom bar — Summary, Ledger, a huge '+' Add in the middle, Team and Settings. Tapping Add shows two giant cards ('What do you want to add?' Income / Expense) that take you to the form in one touch. One-handed thumb use got much easier. On desktop it sits as an elegant floating bar. Verified everything on the emulator, 166 tests green, live.

Bottom Navigation · Mobile UX · Tests

A real app bottom sheet: '+' opens the form in place

I fixed a fair criticism: the 'Add' button opened an empty routing screen and everything funneled to the summary — pointless. Now tapping '+' slides up a real transaction form from the bottom, just like phone apps: pick Income/Expense, enter the amount, save — it records instantly and closes, you never leave the screen. In-place, fluid, native-app feel. Centered card on desktop, full width on mobile. 166 tests green, live.

Bottom Sheet · Mobile UX · Tests

Visual depth + tactile buttons + a live experience test

This time I tested Payda by actually using it: opened it in the emulator, clicked through every section, opened settings, added income/expense from the UI — everything worked, zero console errors. I also fixed the 'flat' look people complained about: accent lines and layered shadows on KPI boxes, soft depth and hover lift on cards, tactile feel on all buttons (glow on hover, press-in on click), accent dots on section headers. CSS and copy only; business logic untouched, 166 tests green, solid on desktop+mobile.

Design · CSS · Experience Testing

Tabbed panel (button logic) + dead-code cleanup

I split Payda's long-scrolling admin panel into button-style tabs: three big fixed tabs on top (Summary · Ledger · Team & Shifts), each hiding the others — you switch sections without scrolling, and your personal shift/task summary stays on top. Then I cleaned the dead code left over from features I'd removed earlier (bank presets, the banker balance-top-up panel) — 16 unused bindings and 3 dead functions gone; I walked the banker and admin screens live to confirm no white screens or errors. Desktop+mobile, 166 tests green.

Tabbed UI · Refactor · Tests

Wider partner approvals, online indicator, security scan

Four jobs in Payda today: (1) searching a customer number now also shows which account paid into which bank. (2) With a partner present, it's no longer just profit share — changing a member's %, removing a member and deleting a project all require the other partner's approval; no one can break the structure alone. (3) Partners see a green dot for who's online. (4) An OWASP Top 10 security scan: access control, XSS, headers, injection — all clean; the two remaining items (2FA, bot protection) will be toggled from the panel. 163 automated checks green, live.

Four-Eyes Approval · OWASP · Tests

Dropped the clutter: notes, banker confusion, canned tone

Today I decluttered Payda: removed the 'notes' feature people found pointless; sales/contact tone is now free text instead of fixed soft/neutral/hard choices; recording a negative customer response now also stores 'which bank was shown'; and the banker's confusing 'top up balance / enter expense' panel is gone — expenses are strictly a manager/partner job now. 159 automated checks green, live.

Simplification · UX · Tests

Banker without e-mail, automatic partner share, bank clutter gone

I simplified Payda further: you can now add a banker with just a name and percentage, no e-mail needed (we only need to know; the invite can come later). Partner share is now automatic from net profit and each partner sees THEIR own percentage — previously the first partner's percentage showed for everyone; fixed. The confusing 'route payment through bank account' preset is fully removed. Canned texts now fill the screen as a grid instead of one narrow column. 162 automated checks green, live.

Simplification · Profit Share · Tests

Shift tracking system + currency-drift fix

Today I added shift tracking to Payda: it computes rotating shifts automatically (e.g. start at 12:00, slide +1 hour daily), everyone sees their own and the team's hours, and a red countdown warning appears half an hour before a shift. I also fixed an annoying bug: fixed-expense amounts drifted with the live exchange rate — now the amount stays fixed in the currency you entered. Managers/partners also got a 'what's left in which bank after deductions' view and a field to note which account was tried for a non-buying customer. 166 checks green, verified on desktop and mobile.

Shifts · Currency Pinning · Tests

The panel now runs on the new UI

The biggest piece of Phase 2 landed: the admin panel now runs on the new React UI — KPIs, period and currency switches, countdown-based upcoming payments, quick income/expense, the ledger and CSV. I verified it all with real flows in the emulator: added a sale, deleted it, paid the rent, watched an invalid entry get rejected. The evidence file and the audit gate are green; the live site still runs the old UI — the migration proceeds safely.

React · TypeScript · Emulator Testing

Permission audit across all roles + 3 fixes

Today I audited Payda end-to-end through the eyes of all five roles (manager, partner, banker, worker, profit-share partner): each role tried to step outside its permissions and the system rejected every attempt. Along the way I found one hole — an unauthorized worker could delete team notes; closed it. I also removed a useless permission flag and narrowed the banker's default permissions to their actual job. The automated security suite grew from 104 to 131 checks, all green, deployed.

Permission Audit · Security · 131 Tests

Sales tone + picky-customer tracking + broadcast tasks

I grew Payda's mini-CRM today: every sale now records the tone (soft/hard) and method used. More importantly, we can now log customers who DIDN'T buy — 'tried this number from that account with a soft tone, declined'. So when the same picky customer is tried again from another account, their history shows. Also added one-tap task assignment to everyone. 142 automated checks green, live.

Mini-CRM · Tasks · Tests

First screens of the new React UI are working

First concrete step of Phase 2: Payda's new React+TypeScript UI is up — sign-in, sign-up, password reset and the My Projects screen ported one-to-one. The best part: the new UI talks to the backend through a typed contract; I created the first project through that channel and verified it end-to-end in the emulator. The live site still runs the old UI; the migration will proceed screen by screen, with tests.

React · TypeScript · Typed Contracts

Phase 1 done: repo layout, CI and typed contracts

I put Payda on a major restructuring plan and finished the first phase: the project is now a real git repository with a root workspace, architecture/data-model docs and a GitHub Actions test gate. Old prototypes went to the archive, vulnerable packages were updated (no high-risk advisories left) and the 104 tests are still green. On top, I laid the first stone of Phase 2: the typed contracts that will be the shared language of frontend and backend. One Claude session, full transparency.

Git · CI/CD · Typed Contracts

Countdown for upcoming payments

Today I added one of those small things you'll check daily: fixed monthly payments now show with a countdown — 'rent, the 5th of each month, due in 4 days'. An Upcoming Payments card at the top of the panel sorts the nearest one first; anything due today turns red. Verified the math with a unit test and shipped it.

Countdown · Payments · Unit Tests

Big pre-launch sweep: 10 gaps, 10 fixes

Today I combed through Payda as if launching tomorrow: period filters, CSV export, full reverse entries when deleting a sale, KVKK (Turkish data-protection) pages, an account panel, a PWA manifest and more — found 10 gaps and closed all 10 the same day. The security pass also caught and fixed CSV formula injection and a double-delete race; test suite 68/68 green. Still one Claude session, still build in public.

KVKK/GDPR · PWA · CSV Export · Security Audit

Mini-CRM, a task system and recurring-expense automation

Payda got a real mini-CRM today: search a number and you see whether that person is a customer, what they bought and WHO entered the sale, line by line — with customer notes. Alongside it came a real task system (managers assign, workers complete from 'My Tasks'), a scheduled function that posts fixed monthly expenses automatically, and a profit-share bug fix. Test suite 84/84 green, all in a single Claude session.

Mini-CRM · Task System · Scheduled Functions

Payment approvals + backend split into modules

Today I added partial or one-shot payouts for partners paying workers/bankers; if there's a second partner, changes go to them for approval (four-eyes). Then I split the 800-line single-file backend into modules — lib/core + handlers/ (project, transaction, member, finance, tasks, sharing, scheduled) — behavior identical, all 104 tests still green. Removed the dead code too. Still one Claude session.

Cloud Functions · Modular Architecture · Tests

Customer records (mini-CRM) and modular permissions

Sales can now optionally include a customer number and product; search a number and you see who bought what and from which account. Customer data counts as personal data (PII), so only members with that permission can see it. Authorization is now fully modular: the role defines the screen, and every capability can be toggled one by one (a banker can do banking only — or ads too, if allowed). All 61 integration tests passed; backend and UI went live.

Cloud Functions · Firestore Rules · Security (PII) · Integration Tests

Three in one: design, security, SEO

Today I set three expert agents on Payda at once: the designer built an accessible, mobile-friendly design system with OKLCH tokens; the security expert tightened percentage fields and amount limits in an OWASP audit; the SEO agent added hreflang, a favicon and WebSite schema. In between, customer records (mini-CRM) and the fully modular permission system also went live — 61 security tests still green. All in one Claude session; I only steered.

Design System · OWASP Audit · SEO

Bot protection with reCAPTCHA

We added reCAPTCHA to Payda's sign-in and sign-up flows to protect against automated/bot abuse.

reCAPTCHA · Security

Role permissions and project management

We defined who can see and touch what: worker, partner and banker roles. Fixed the project create/delete flow with safe confirmations and applied the debugging and security-audit plan phase by phase.

Firebase · Roles/Permissions · Security

Bank-grade security and data isolation

We made sign-in, e-mail verification and password reset work, and wired every feature to a real backend. Most importantly, we built the architecture role-isolated — an employee cannot see or change anyone else's data — close to banking standards, with all writes server-side.

Firestore Rules · Firebase Auth · Security

The Payda journey begins

We set up Payda — a project management and accounting platform — on Firebase: database, authentication and hosting. Built the entire data layer from scratch.

Firebase · Firestore · Firebase Auth