App Screenshots
Ayurvedic cosmetics e-commerce with production-grade security
A D2C storefront that needed full e-commerce capability — product catalogue, cart, checkout, reviews, admin CMS — while defending against price tampering, inventory race conditions, and payment spoofing on a client-side SPA with a public Supabase instance.
Revoked direct INSERT privileges on orders and routed all mutations through SECURITY DEFINER PostgreSQL RPCs that recalculate totals server-side. Implemented SELECT ... FOR UPDATE row locking for atomic inventory control, HMAC-SHA256 payment verification via Supabase Edge Functions, and a dual-runtime model with offline-first demo state using shimmed auth and localStorage fallback.
- Anti-price-tampering RPC: all invoice totals recalculated server-side inside a SECURITY DEFINER stored procedure, not trusted from the client
- Concurrent checkout race conditions solved with transactional row locking (SELECT ... FOR UPDATE) on inventory
- Dual-runtime architecture: seamless bridge between live Supabase Postgres and a fully functional offline client-side demo with shimmed authentication
Live production storefront with zero price-tampering vectors, atomic inventory, cryptographic payment verification, and a one-click offline demo that runs the entire app without backend credentials.
About the Project
Arkmantra is a premium Panchgavya-based natural cosmetics brand. The storefront and admin control panel operates on a dual-runtime model, seamlessly bridging a live production Supabase Postgres cluster with a fully functional offline-first client-side demo state using shimmed authentication interfaces and localStorage caching.
To combat client-side state manipulation (specifically price and discount hijacking), all direct table INSERT privileges for anon and authenticated roles were revoked on orders and order_items. Replaced with transaction-safe, Row-Level-Security (RLS) bypassed PostgreSQL Stored Procedures (RPCs) executing as SECURITY DEFINER. The RPC retrieves base prices, valid coupon objects, taxes, and shipping rates directly from database records, recalculating the invoice totals server-side prior to insertion.
Concurrent checkout requests targeting the same limited inventory units are addressed with transactional row locking using SELECT ... FOR UPDATE on target product keys. Evaluates current inventory bounds against checked-out quantities inside the transaction, decrementing stock levels atomically (update products set stock = stock - quantity) and aborting the transaction if inventory is depleted.
Security is further hardened via client-side size checks and MIME-type restrictions (excluding SVG/HTML), and server-side Supabase Storage bucket security policies. Public contact forms and newsletter subscription endpoints are protected against automated DDoS, spam inserts, and resource exhaustion by removing direct insert policies and routing submissions through stored functions that limit requests to 5 inputs per hour per email address.
Payment confirmation bypasses client-supplied states entirely. Orders initialize as pending and are updated to paid only via a Supabase Edge Function webhook receiver that recalculates the payment token hash utilizing the HMAC-SHA256 algorithm with a server-side RAZORPAY_KEY_SECRET.
Key Highlights
Technical Breakdown
Feature areas & implementation details