Dastarkhwan
Commission-free ordering and operations for restaurants.
Dastarkhwan gives restaurants their own ordering link and QR table menus instead of paying delivery apps a commission, plus the tools to run service: kitchen display, POS, rider app, reports, inventory, loyalty and tax invoices.
The problem
Restaurants in Pakistan pay delivery platforms a large commission on every order, and still juggle separate tools for the kitchen, the till and deliveries.
The goal: one platform where a restaurant owns its customer relationship and ordering link, and runs the whole service, front of house to delivery to reporting, from the same system.
What I built
- Customer ordering through a restaurant's own link and QR table menus, with Urdu support, dish options and live order tracking.
- Operations: live orders, POS, table map, kitchen display by station, counter display and a rider app for deliveries.
- Business tools: sales reports, peak-hour heatmaps, menu engineering, inventory, loyalty tiers and FBR tax invoices.
- AI features using the Claude API, such as building a menu from a photo and an assistant for owners.
- Integrations for JazzCash, Easypaisa and card payments, WhatsApp, SMS, couriers and off-site backups, each sandboxed until configured.
Architecture
Key decisions
Node's built-in HTTP server and SQLite
Fewer dependencies means a smaller attack surface and easier deployment: the core runs on Node.js alone, with only the AI SDK and Zod as packages.
Server-Sent Events for live updates
Order status only flows from server to screens, so SSE gives real-time kitchen and tracking updates with less complexity than WebSockets.
Sandbox mode for every integration
Payments, WhatsApp and couriers run in a clearly labelled sandbox until keys are set, so the platform is fully usable in development without real credentials.
Signed callbacks and webhooks
Payment gateway callbacks and aggregator webhooks are verified with HMAC signatures before any order is trusted.
Security
- Passwords hashed with scrypt; sessions and tokens signed with HMAC
- Rate limiting on sign-in and ordering to stop brute force and order spam
- Input validation on API requests with Zod schemas
- Content Security Policy, X-Frame-Options and HttpOnly, SameSite cookies
- Optional Cloudflare Turnstile bot protection and Sentry error monitoring
Results
What I'd improve next
- Load testing and moving to PostgreSQL for larger chains
- Independent penetration test of the payment and staff flows
- Offline-first POS so service continues if the internet drops