The goal was not merely to complete a checkout. It was to preserve business invariants when two customers want the last item, a payment callback arrives twice, an external provider fails, or an operator needs to understand and recover the system.
I split the product by responsibility. Next.js owns presentation and interaction; Django owns commerce rules; PostgreSQL owns durable state; Supabase supplies identity; payment and image providers remain replaceable external dependencies. That boundary prevents client state from becoming business truth.
Decision 01 / Consistency
The API rebuilds every quote from current product and delivery data. During order creation it locks variants, checks availability again, creates the order snapshot, and decrements stock atomically.
Why it matters: browser prices cannot be forged, and concurrent checkouts cannot silently oversell the same variant.
Decision 02 / Payments
Checkout initiation reuses an existing pending transaction. Callbacks lock the payment record, verify successful transactions with the provider, tolerate duplicate delivery, and flag late payment after an order has expired.
Tradeoff: more domain state and tests, in exchange for traceable outcomes when networks retry or reorder events.
Decision 03 / Identity
Supabase owns sessions and identity. Django validates signed tokens and hydrates a local customer keyed by the stable subject claim, while retaining ownership of addresses, orders, permissions, and business history.
Why it matters: the identity provider can evolve without pushing commerce rules into authentication metadata.
Decision 04 / Operations
Owner and attendant roles have explicit permissions. The custom portal covers orders, manual payments, inventory, customers, staff, settings, and image review instead of making operators manipulate raw records.
Why it matters: operational usability and least privilege are part of system correctness.
01
Emails and receipts run after a successful database commit, so a notification failure cannot roll back a valid order or announce one that never persisted.
02
A scheduled command locks expired unpaid orders, cancels them, restores stock, and records the transition for operators.
03
Image jobs use explicit states, row-level claiming, bounded exponential backoff, quota-aware retry timing, human approval, and rollback of partially copied assets.
Senior engineering includes naming incomplete work. The deployment is real, but I do not describe it as fully launch-ready while Supabase token verification, owner-facing browser checks, and off-site recovery evidence remain tracked.
