New city search on the homepage hero. Start typing and we suggest cities where Lala Pad has properties — pick one (or hit Enter) to jump straight to the matching listings on book.lalapad.online.
Same autocomplete is wired into the guest discovery page, with a chip that shows the active filter and a quick clear.
Password policy: new accounts and password resets now require 12 characters with upper, lower, a number, and a symbol (up from 8 + letters + a number). Existing passwords keep working until you reset.
Restore archived properties for up to 30 days
Accidentally archived a property? It's no longer gone for good. The Properties page now has a Recently archived section listing properties archived in the last 30 days, with a one-click Restore button.
Each entry shows how long ago you archived it and how many days remain before it drops off the recovery list.
Restoring brings the property back into your active listings, guest booking site, and dashboard. Bookings on the property were never touched.
The archive-property confirmation dialog now reminds you about the 30-day window before you commit.
Live-refreshing dashboard with per-property breakdown
The Your performance band on the dashboard now auto-refreshes every 20 seconds, plus on tab focus. Also added a Refresh button and an "Updated Ns ago" timestamp so you can tell how fresh the numbers are.
New Views by property table underneath the stats cards: shows total views and unique visitors per property over the last 7 days. Now you can see exactly which property someone hit.
End-to-end lag: PostHog usually ingests events within ~5–15 seconds. Combined with the 20s dashboard poll, expect a new visit to show within a minute.
Auto-link Google sign-in + fix guest analytics
Account linking: if you signed up with an email + password and later sign in with Google using the same email, the two are now automatically linked behind the scenes. You'll see the same dashboard, the same properties, regardless of how you sign in. Built on a Cognito PreSignUp trigger.
Fix: the guest booking site lost its analytics key in a prior build, so property visits weren't reaching PostHog. Re-baked the key — visits now register again. (Existing dashboards may have under-counted today — should be back to normal from this build forward.)
Cognito now also pulls email_verified from Google's claims so federated accounts are trusted instantly.
Sign in with Google now runs through auth.lalapad.online — our domain, not AWS's. The Google consent screen no longer shows a cognito subdomain.
New Settings page in the admin sidebar with a Change password form. We require your current password (built-in re-auth), then check the new one meets the policy.
Dashboard now shows a "Your performance" section: property views, unique visitors (last 7 days, from analytics), upcoming arrivals, this month's revenue and bookings, plus totals across all your properties.
Guest property views are now tracked in analytics so we can populate the visit counter per property.
Sign in with Google + forgot password + sticky nav
Continue with Google button on sign in and sign up. Authenticates via Cognito's federated Google provider, then routes you to /dashboard or /onboard as appropriate.
Forgot password link on the sign-in page. Single page with two steps: request a code, then enter the code + a new password. Cognito sends the code via our Zoho-backed email Lambda — same look as the verification emails.
Sign-up form now requires accepting Terms and Privacy, with inline links to those pages.
Admin sidebar is sticky on desktop — Sign out is always visible at the bottom without scrolling, even on long pages. The nav area scrolls internally if it ever needs to.
Small polish round
Password fields on Sign in and Sign up now have a show / hide eye toggle.
Admin background switched to a warmer off-white (matches the marketing palette).
Amenities are now grouped by category (Connectivity, Food & drink, Wellness, Transport, Services, Business, Outdoors, Comfort, Policies) — and each checkbox has a tooltip explaining what it means (e.g., hover "Airport shuttle" to read its description).
Property managers can now archive a property from the "Danger zone" at the bottom of the property page — it disappears from the admin and the public listings; historical bookings and reports stay intact.
Confirmed PostHog is live on the marketing site (analytics.js served from /, project 468566).
Daraja per-merchant credentials (M-Pesa)
New M-Pesa Payments section on each property in the admin. Operators paste their own Daraja consumer key, consumer secret, passkey, and shortcode (Paybill or Till) — sandbox or production. Money goes to their till, not Lala Pad's.
Secrets are encrypted with a dedicated AWS KMS key (alias/lalapad-merchant-secrets) before being stored. The API never returns them on read.
Test connection button hits Daraja's OAuth endpoint with the saved creds, updates a status badge (configured / test passing / test failing) and records the last test time + any error.
Per-property callback URL displayed for the operator to paste into the Daraja portal: https://api.lalapad.online/public/daraja/callback/<property-id>.
Coming next: the actual STK push flow on the guest booking page (Pay now → phone prompt → confirmation).
Traffic stats on the platform dashboard
New Traffic & activity (7d) section on /platform — pageviews, unique visitors, sign-ins, signups started/completed, property edits, property views, bookings completed. Pulled live from PostHog via HogQL on the server.
Auto-refreshes every 60 seconds.
If PostHog isn't configured server-side, the section shows an amber banner instead of failing.
Mobile drawer nav + /platform crash fix + PostHog live
Admin sidebar is now a proper drawer on mobile — hamburger button in the top bar opens a slide-in menu with a backdrop. Closes on tap-outside or route change. The horizontal-scroll fallback is gone. Desktop layout unchanged.
Fixed a hooks-order bug in /platform that rendered a blank page after sign-in: the platform-admin guard was returning <Navigate /> before useQuery hooks, violating React's rules and crashing the component. All hooks now run unconditionally; queries skip via enabled: admin.
Shell now refreshes the platform-admin flag from /me on mount — sessions signed in before the flag existed get backfilled transparently.
Guarded report rendering against a null replies column (resolved a Cannot read properties of undefined (reading 'length') in the console).
PostHog is now live on all three sites (marketing + admin + guest) — pageviews, autocapture, and the custom event set (sign-in, signup, property saved, booking completed, etc.) are streaming into us.posthog.com.
Reply to bug reports from the platform dashboard
Each report card on /platform now expands inline — full message, "where" link, list of past replies you've sent.
Reply textarea: typing and clicking Send reply emails the reporter from support@lalapad.online via Zoho. The reply is stored alongside the report so the next admin to look at it sees the conversation.
Status controls per report: Mark in progress, Mark resolved, Mark spam, Re-open.
Status filter tabs at the top of the reports list: open / in progress / resolved / spam / all.
Replying automatically moves the report from open to in progress.
"Go to dashboard" on the homepage for signed-in users
When you're signed in to the admin, the marketing homepage detects it via a domain-scoped cookie and swaps the nav: "Sign in" + "Get started" become a single "Go to dashboard" button.
The hero CTA does the same — "Start free" → "Go to your dashboard".
No personal data in the cookie — just a flag. Cleared on sign-out and on idle timeout.
Guest ↔ property contact + analytics scaffolding
Admin booking detail now shows the guest's name, phone (tap to call), email, and a WhatsApp button with a pre-filled "this is regarding your booking" message.
Guest property page header now shows the property phone number as plain text + Call button + WhatsApp button (was WhatsApp-only).
Wired up PostHog (admin + guest + marketing) — auto pageviews + a small set of custom events (sign-in, signup, property saved, booking completed, property viewed). Disabled until VITE_POSTHOG_KEY is set.
Reply to bug reports from the platform dashboard
Each report card now expands inline — full message, "where" link, list of past replies you've sent.
Reply textarea: typing and clicking Send reply emails the reporter from support@lalapad.online via Zoho. The reply is stored alongside the report so the next admin to look at it sees the conversation.
Status controls per report: Mark in progress, Mark resolved, Mark spam, Re-open.
Status filter tabs at the top of the reports list: open / in progress / resolved / spam / all.
Replying automatically moves the report from open to in progress.
"Go to dashboard" on the homepage for signed-in users
When you're signed in to the admin, the marketing homepage detects it via a domain-scoped cookie and swaps the nav: "Sign in" + "Get started" become a single "Go to dashboard" button.
The hero CTA does the same — "Start free" → "Go to your dashboard".
No personal data in the cookie — just a flag. Cleared on sign-out and on idle timeout.
Property owners can now upload photos straight from their device (JPEG/PNG/WebP/GIF, max 10 MB each) — files go to photos.lalapad.online via S3-backed CloudFront.
URL paste is still available as a fallback.
Homepage hero now cycles between three property photos with a smooth crossfade.
Removed currency-specific copy from the homepage.
Rich property editor
New property edit page with sections for basics, contact, check-in/out times, payments, amenities, photos, and policies.
Canonical amenity list (17 options for properties, 12 for room types) shared across admin and guest views.
Cancellation, pets, smoking, and children-allowed policies surfaced on the guest page.
Properties list now links straight into the editor.
Per-property "share booking link" with one-click copy + preview in the admin.
Custom verification emails via Zoho
Signup and password-reset emails now send through Zoho SMTP from support@lalapad.online — instead of Cognito's default sender, which Outlook and Gmail tend to block.