BusYatra
Bus ticketing system
A cross-platform mobile app for digital bus ticketing: real-time seat selection, interactive route search, dynamic ticket generation, integrated payments and an AI assistant for support and route suggestions.
- Role
- Mobile & backend developer
- Year
- 2025
- Type
- Mobile App
- Status
- Live
Architecture
Seat state as the hard problem
The seat matrix is the contended resource: several passengers can be looking at the same seat at the same moment. Reservation is handled by the Express API against MongoDB rather than in the client, so concurrent requests for one seat are resolved in a single place.
Asynchronous payment settlement
Fares go through a digital payment gateway with transaction status tracked through asynchronous server communication, so the ticket is issued against a confirmed transaction rather than an optimistic client response.
Assistance layer
An AI chatbot module handles common support questions, and custom optimisation logic suggests routes — both sitting alongside the booking flow rather than inside it, so a failure there cannot block a sale.
Security architecture & OWASP mitigations
Race conditions — double booking
Two passengers confirming the same seat within the window between reading availability and writing the reservation.
Seat reservation is decided server-side in the API layer, so concurrent requests for a seat are serialised at the database rather than raced in two clients.
A04:2021 — Insecure Design (payment flow)
A client claiming a payment succeeded and receiving a ticket for a fare that never settled.
Ticket issuance follows the gateway's server-confirmed transaction status; the client's view of the payment is never the trigger.
A01:2021 — Broken Access Control
Reading or cancelling another passenger's booking by changing an identifier.
Booking lookups are scoped to the authenticated passenger in the API rather than filtered after the fact in the app.
Stack
- React Native
- Node.js
- Express.js
- MongoDB
- RESTful APIs
- Payment gateways