ToliMaster — SaaS Management for Auto Garages
A multi-tenant SaaS platform for managing car garages and auto-body shops, purpose-built for the Moroccan market.
- 14
- Documented bugs fixed
- 41
- E2E steps passing (of 41)
- 59
- Database migrations
The challenge
Moroccan garages and auto-body shops juggle composite quotes mixing new parts, used parts, exchange parts, labor and subcontracted work, each with its own discount and VAT rules — a need generic invoicing tools simply don't cover. Saad had to build a system able to handle these real-world cases while meeting Moroccan legal requirements: ICE, RC, TP and IF identifiers on documents, amounts in MAD, and 20% VAT calculations. The project then had to grow from a single-tenant tool into a genuine multi-tenant SaaS platform, without losing any of that business flexibility.
The solution
Saad built ToliMaster with an Angular 20 standalone-component frontend, PrimeNG and Tailwind CSS, backed by a Node.js/Express 5 backend secured with JWT and a MySQL 8 database versioned across 59 sequential migrations. The platform covers:
- Client and vehicle records
- Flexible quotes with mixed line-item types (new parts, used parts, exchange parts, labor, subcontracted work), per-line and global discounts, and a configurable VAT engine (all-VAT, no-VAT, or mixed per line)
- A full quote workflow (draft → sent → accepted/refused → expired) with one-click convert-to-invoice
- Invoicing with real partial-payment tracking (cash, cheque, bank transfer, card) and automatic status transitions
- Immobilization certificates exportable to PDF/Word
- Catalogs for spare parts, labor services, and damage types
- A monthly/yearly stats dashboard
- A 5-role, 30-permission RBAC system
- A full tenant-management layer (registration, suspension, configuration, subscription plans)
The results
The multi-tenant transformation was completed as a 6-phase, 60-task plan — database cleanup, backend security hardening, business-logic flexibility, frontend standardization, then integration and polish — all 60 tasks finished. A dated internal audit found and fixed 14 documented bugs, including several serious cross-tenant data-leak risks (a query missing its tenant-ID filter, which could have exposed one garage's certificates to another) and a systemic naming-drift bug between the database schema and application models. The end-to-end flow — login, create client, build a mixed quote, convert to invoice, record a partial payment, export PDF — passes all 41 of 41 steps.
Methodology and project management
Development followed a strictly sequenced, phase-by-phase approach rather than a single rewrite: each phase of the 60-task plan had to be stabilized before moving to the next, from the database layer through to final integration. That discipline was paired with a dedicated security and consistency audit, specifically targeting cross-tenant data isolation and document-numbering reliability — replacing a Math.random()-based scheme, which risked duplicate invoice numbers, with a proper database-backed sequence, per tenant and per day, with retry-on-conflict logic. Validation relied on an end-to-end scenario covering the entire business cycle.
Technical architecture and performance
ToliMaster runs on a multi-tenant architecture where each garage operates within an isolated data boundary enforced at the query level and secured by a 5-role, 30-permission RBAC system. Document generation combines jsPDF, PDFKit and Puppeteer for PDFs, plus ExcelJS and docx for Excel/Word exports of quotes, invoices and certificates. The VAT and discount engine is driven by tenant configuration rather than hard-coded, letting each garage run in all-VAT, no-VAT, or mixed mode. The platform was designed and validated against a real quote generated for Tôle Master, a Casablanca auto-body shop, keeping the invoicing engine grounded in the industry's actual paperwork.