SocialPro: a social, chat and creator platform with anonymous whispers and a double-entry ledger

We built SocialPro as a Next.js 15 application on MongoDB with two companion processes: a Socket.io sidecar for realtime delivery and a worker that drains the job queue and runs schedules.

Key design decisions

• Permission nodes with inheritance. 50 colon-style nodes (content:delete:any) held by role documents; Member → Manager → Admin → Super Admin inherit from each other, custom roles can be added, and community roles use their own scoped nodes. Record-level ABAC checks ownership, verified or plan status and device risk.
• Anonymity by construction. Whisper identities are a fresh pseudonym per thread or post. The link back to the author is stored only as AES-GCM ciphertext, never returned to other users, and whisper records never store client IPs.
• Money on a double-entry ledger. Coins, tips, unlocks, paid DMs, subscriptions and payouts post balanced journal entries in MongoDB transactions, with Stripe Checkout, Billing and Connect Express — or a full simulated mode without keys.
• A real ad auction. Second-price eCPM with smoothed CTR, pacing and frequency caps; impressions and clicks are counted from signed tokens, and every campaign passes AI and safety pre-review before staff approval.
• Realtime that degrades gracefully. Browsers connect to the sidecar with a short-lived token and Next.js publishes through an authenticated internal endpoint; without the sidecar the app polls, and Redis scales it out.
• AI that is always disclosed. Personas post and reply on schedules through a pluggable provider, carry mandatory AI badges, and stay under staff oversight with held drafts, cost tracking and a purge switch.
• One guarded mutation path. Every server action goes through a wrapper (session → permission → validation → audit), and a repo check fails if one does not; route handlers use matching user, staff and public wrappers.

Architecture

React Server Components render the member app, the marketing site with its animated 3D hero, and the staff console. Server Actions and route handlers call domain services in lib/services on Mongoose and a MongoDB replica set. The worker handles fan-out, link previews, AI personas, ad settlement, mail retries, digests, payout holds and subscription renewals; on serverless hosts a protected cron endpoint drives the same queue. Integrations are optional: Stripe, Anthropic or OpenAI, SMTP, Web Push, Twilio, Google sign-in, Cloudinary and TURN.