Leviro Toolbay

Leviro Toolbay is Leviro's beta web product for people who need browser utilities and credit-priced document, image, and writing tools. Visitors can use free tools without an account; account features run through the API.

The problem

Small utility tasks are often scattered across unrelated sites. A user may need to format JSON, edit an image, split a PDF, and then prepare a document. Toolbay puts those workflows under one bilingual interface while keeping paid operations accountable to a credit balance. The product is in beta.

Key features

• Free developer, text, image, document, media, and productivity tools are organized in a shared catalog.
• Premium workflows include invoices, CV assistance, PDF OCR, image editing, and site-to-Markdown conversion.
• English and Arabic routes use localized content, including right-to-left presentation for Arabic.
• Account access supports email credentials, Google sign-in, email verification, and password reset.
• Credit balances and feature costs are shown to signed-in users; administrators can manage payment records.
• Long-running work is submitted as a job with status and progress instead of holding a browser request open.
• An admin area covers users, payments, feedback, announcements, and monitoring.

Technical architecture

The Next.js App Router frontend reads the shared tool catalog and calls a NestJS API. MongoDB stores users, billing records, feature settings, and queued jobs. A worker claims queued jobs from MongoDB, and clients poll their status. The PDF splitter uses Socket.IO for live progress. Redis is available for caching, including world data. Some free tools execute in the browser, while server features use API modules and, where needed, Google Gemini. The shared package keeps tool definitions, translations, and metering rules aligned across the frontend and API.

Engineering highlights

• Feature access deducts credits before a metered handler runs. Failed operations have a refund path, including queued work.
• Queue claims use a MongoDB atomic update so workers do not claim the same pending job.
• URL fetching passes through an SSRF guard that rejects private and link-local targets.
• API endpoints use validation and throttling, with tighter limits for sensitive actions.
• Arabic upload filenames and localized legal content are handled alongside the English flow.