Book My Ticket
Auth layer and protected seat booking built on top of the ChaiCode starter — register/login, JWT middleware, transaction-safe duplicate prevention, and user-associated reservations.
Timeline
ChaiCode — Backend Ninja (Chai Aur SQL)
Role
Backend Developer
Team
Solo
Hackathon Rank
3rd Place
Status
CompletedKey Challenges
- Extending an existing production codebase without breaking legacy endpoints
- Adding JWT auth middleware and protecting booking routes
- Preventing duplicate seat bookings with SELECT FOR UPDATE under concurrency
- Associating reservations with authenticated users via FK
Key Learnings
- Integrating auth on top of an existing Express + PostgreSQL API
- Transaction-safe booking with row locking and unique constraints
- Production-style backend extension instead of greenfield builds
Overview
Book My Ticket was built for the ChaiCode Backend Ninja hackathon — a follow-up to Chai Aur SQL where the goal was to study the chaicodehq/book-my-ticket starter and extend it with authentication and a protected booking flow. The project secured 3rd place.
Rather than building from scratch, the focus was on reading existing code, adding register/login with tokens, protecting booking endpoints, preventing duplicate seat reservations, and tying bookings to logged-in users — while keeping all original PostgreSQL endpoints intact.
Key Features
- User registration and login with bcrypt + JWT authentication
- Auth middleware protecting the new booking endpoints (
POST /movies/:movieId/bookings,GET /me/bookings) - Per-movie seat inventory with transaction-safe booking (
BEGIN→SELECT FOR UPDATE→COMMIT) - Dual duplicate prevention: app-level
isbookedcheck (409) + DB unique constraint - Bookings associated with authenticated users via
user_idFK with cascade delete - Legacy routes preserved at original paths; schema extended via
ALTER TABLE
Evaluation Feedback
The judges ranked it 3rd place with a score of 38/60, calling it the best starter-code extension of the cohort — legacy routes were preserved at their original paths with matching behavior, and the schema was genuinely extended via ALTER TABLE rather than replaced.
Score Breakdown
- Authentication Implementation: 6/10
- Protected Route Handling: 6/10
- Booking Logic Correctness: 7/10
- Code Structure & Readability: 6/10
- Integration with Existing Codebase: 7/10
- Frontend Integration (Bonus): 6/10
Booking logic was the strongest dimension: correct BEGIN → SELECT FOR UPDATE → check → UPDATE/INSERT → COMMIT transaction pattern with per-movie seat inventory and dual duplicate prevention. Improvement areas: no refresh tokens or httpOnly cookies, open CORS, no global error handler with inconsistent error shapes, a missing movie_id FK at the DB level, and a frontend name-based "mine" detection bug.