Back to work

Case Study · E-commerce Platform

KTXZ Shop

A multi-game trading-card marketplace that pairs a customer storefront — browse, search, cart, Stripe checkout, returns, reviews — with a full admin operations platform for catalog, pricing, inventory, and fulfillment. Eight card games, one system, built solo end-to-end.

StatusLive
RoleSolo — full-stack
FrameworkNext.js 16 · React 19
Scale8 games · 33 data models

Two products in one repo: a storefront customers love, and the operations platform that runs it.

Card data and market pricing span Pokémon, Magic: The Gathering, Disney Lorcana, One Piece, Gundam, and Riftbound — priced through the Scrydex, Scryfall, Pokémon-TCG, PriceCharting, and TCGplayer providers — plus UniVersus and Weiss Schwarz via dedicated import tooling.

The interesting engineering isn't the CRUD. It's the money-safe, race-safe, failure-tolerant machinery underneath: atomic inventory holds, idempotent webhooks, a queued email pipeline with a dead-letter path, and a pricing sync that respects a hard API budget.

Everything a buyer touches.

CatalogSearch that forgives

Multi-game catalog with brand/set, rarity, per-game element, and condition filters — powered by MongoDB Atlas Search with autocomplete, prefix matching, and typo tolerance.

CartGuest → account merge

Guest and authenticated carts, with the guest cart auto-merging into the account on login so nothing is lost between sessions.

CheckoutStripe Embedded Checkout

Automatic tax, address collection, and live or flat-rate shipping — with orders created only by a verified, idempotent webhook.

InventoryTOCTOU-safe reservation

Stock is held for the duration of checkout and swept by cron, so two buyers can’t race for the last copy of a single.

VaultTimed product drops

Scheduled drops with countdown timers and a global drop widget — plus preorder windows carried through checkout with expected-ship dates.

TrustReviews & returns

Product reviews with spam filtering and moderation, self-service return requests, and guest return lookup by order number + email.

CollectionBinders & portfolio

A customer collection tracker: catalog owned cards into custom binders, keep a wishlist, watch portfolio value over time and set completion, import/export by CSV, and mint public read-only share links. Entries key to a canonical printing, so they re-value from the current market and survive a listing selling out.

Everything the store runs on.

CatalogImport at scale

CSV bulk import, JSON set-manifests, and set-based import from Scryfall & Scrydex — every row reconciled (created / skipped / failed) so nothing is silently dropped.

PricingMulti-provider + budget guard

Look up market prices across providers, override per card, and run an hourly sync that stays inside the Scrydex monthly API budget via a built-in guard.

FulfillmentOrders end-to-end

Status updates, tracking, Shippo label purchase, printable packing slips, and full or partial refunds — with an audit log over sensitive actions.

MediaOne-click clean images

Bulk uploads with browser-side background removal and OpenCV auto-crop, stored on S3 + CloudFront.

PeopleRoles + step-up auth

Customer / vendor / admin roles with re-authentication required before the most sensitive actions.

InsightReports that matter

Sales and operational analytics (Recharts), operational-cost tracking, and vendor records.

Where an e-commerce build actually gets dangerous.

Idempotent paymentsThe Stripe webhook is the source of truth for orders, deduplicated with TTL-expired MongoDB event records — a retried webhook never creates a second order.
Email you can trustResend behind an Upstash QStash send queue with a dead-letter queue, delivery webhooks that suppress bounces/complaints, and a cron-driven retry worker.
Security at the edgePer-request CSP via edge middleware, HSTS and the hardening header set, NoSQL-injection protection, ObjectId validation, and server-action CSRF mitigation.
Graceful under failureRate limiting on auth and sensitive endpoints, circuit breakers around external dependencies, and in-memory fallbacks when Redis or Atlas Search aren’t available.
8Trading-card games, unified in one catalog
2,350+Automated tests across 190 files (+ integration, E2E & mutation suites)
33Mongoose data models behind the store
5+Market-pricing providers, budget-guarded

The stack, by layer.

FrameworkNext.js 16 App Router, React 19, TypeScript 5.9, pnpm 10App Router
DataMongoDB via Mongoose 9, with Atlas Search (regex fallback in dev)33 models
AuthNextAuth v5 — JWT sessions, RBAC, step-up re-authRBAC
PaymentsStripe Embedded Checkout — sessions, webhooks, refundsidempotent
CommsResend + Upstash QStash queue, DLQ, delivery webhooksat-least-once
MediaAWS S3 + CloudFront, imgly background removal, OpenCV cropauto-crop
OpsVercel Crons, GitHub Actions, Sentry + OpenTelemetryobserved
QualityVitest (190 files, 2,350+ tests) + Stripe integration, Playwright E2E, and Stryker mutation testingCI-gated

See it live.