Case 04 / 06 · Platform engineering · 2026
Multi-Tenant Commerce Platform
Solo, self-directed project · live for verified merchants
Order protection — a checkout add-on covering lost or damaged shipments — was tied to one storefront. Offering it to other merchants on a different ecommerce platform meant building real multi-tenancy, not another one-off integration.
Context / problem
One storefront’s feature, made a platform
Order protection was tied to a single storefront. Offering it to other merchants — on a different ecommerce platform entirely — meant real multi-tenancy: shared infrastructure, isolated data, and a merchant-facing surface for each store.
I designed and built the platform end to end — API, background worker, merchant dashboard and the storefront connectors — as a solo, self-directed project.
Architecture
API, worker, dashboard, connectors
A NestJS API and a BullMQ worker sit behind explicit, per-query tenant scoping, with a role and permission system enforced on every route. A React and Polaris merchant dashboard gives each store its own settings, orders and claims.
Tenant isolation
Explicit, not implicit
One codebase serves every merchant. Each store’s data, settings and claims are isolated by tenant at the query layer, not by convention — there is no code path that can accidentally see across stores.
Every database query is explicitly scoped to a tenant; there is no implicit global query to forget. A store with no access gets an empty result, never an error and never someone else’s data.
Engineering decisions
Never a global filter applied by middleware. Each query states its tenant, so forgetting is a compile-and-review problem rather than a silent data leak.
A store with no access to a record gets an empty result. Errors leak the existence of other tenants’ data; empties do not.
Shopify stores connect through an embedded app with HMAC-verified webhooks. Miva connects through a receipt-template push plus a scheduled reconciliation fallback, because it has no equivalent webhook guarantee.
Migrating an existing store’s order and protection history was verified by re-running the migration and diffing the result — zero differences, or it was not done.
Deployment
Deployed as Docker images — API, worker and web — behind Shopify’s embedded-app OAuth flow for Shopify merchants, and a receipt-template push plus scheduled reconciliation for Miva.
Result
Live in production for verified merchant storefronts today, with a zero-diff, checksummed migration of 13,000+ historical orders behind it.
ERP Workflow Automation
The lanes collapse back to one, and an ERP record becomes a work item.