Building LandlordOS: A Modern Property Management System with Next.js 16

Source: Dev.to

Introduction

I recently launched LandlordOS, a property management system designed for small‑to‑medium landlords (5–50 rental units). After speaking with several landlords, I identified a common pain point: they were stuck between two extremes:

• Enterprise software – $200+/month with features they’d never use.
• Google Sheets – unwieldy and error‑prone.

LandlordOS aims to sit in the middle: simple enough for daily use, yet robust enough to handle real business operations.

Technical Stack

• Next.js 16 with App Router (server‑side rendering)
• TypeScript for end‑to‑end type safety
• PostgreSQL (Neon) for reliable data storage
• Drizzle ORM for type‑safe database queries
• NextAuth.js v5 for authentication
• Vercel for deployment and Edge Runtime

Core Features

• Property Management
  • Track multiple properties with detailed information
  • Manage individual units within properties
  • Monitor occupancy status and availability
• Tenant Management
  • Store tenant contact details
  • Link tenants to specific units
• Lease Management
  • Track lease agreements with start/end dates
• Payments
  • Record payments (amount, date, method)
  • View payment history per tenant
  • Track outstanding balances
• Maintenance Requests
  • Submit and track issues
  • Priority levels: Low / Medium / High / Critical
  • Status tracking: Pending / In Progress / Completed / Cancelled

Security

Security was a top priority. Implemented measures include:

Double‑Submit Cookie CSRF Protection (Edge Runtime)

export function validateCsrfToken(token: string, cookieToken: string): boolean {
  // implementation...
}

Rate Limiting on Authentication Endpoints

await authLimiter.check(5, identifier); // 5 requests per 15 minutes

XSS and SQL Injection Prevention

// Example of parameterized query with Drizzle ORM
const result = await db
  .select()
  .from(payments)
  .where(eq(payments.id, sanitizedId));

Public Route Bypass

if (isPublicRoute) {
  // Skip authentication and DB calls in Edge Runtime
  return NextResponse.next();
}

Testing

Comprehensive testing ensured quality:

• 31 unit/integration tests covering:
  • User authentication (signup, login, password validation)
  • Property, tenant, and unit management
  • Payment recording
  • Maintenance requests
  • Security (XSS, SQL injection)
    Result: 100 % pass rate
• 8 end‑to‑end tests on the live site covering:
  • Page load verification
  • User signup flow
  • Login functionality
  • Navigation
  • Core feature testing
  • Stripe checkout integration
    Result: 100 % pass rate in production

Deployment Journey

Initially tried Cloudflare Pages and Netlify, but the Next.js App Router with Server Components isn’t compatible with static deployments. Vercel natively supports the required features, so the project was deployed there.

Environment Variables

Middleware Considerations

The middleware runs in the Edge Runtime, which lacks many Node.js APIs. Early on, the middleware called auth() for all routes, including public ones, causing crashes because database drivers can’t run in the Edge environment. The fix was to add an early return for public routes (see the “Public Route Bypass” snippet above).

TypeScript Benefits

• Caught numerous bugs during development.
• The upfront cost of typing everything paid off immediately.
• Enforced a 100 % test pass rate, forcing careful handling of edge cases.

Future Enhancements

• Document upload for leases/agreements
• Automated rent reminders via email
• Financial reporting and analytics
• Mobile app (React Native)
• Multi‑language support

Live Demo

Explore the application:

Call for Feedback

I’d love to hear from:

• Property managers using it in real scenarios
• Developers interested in the architecture
• Anyone building similar SaaS products

What would you add to a property management system?