1. Protected API
Accepts authenticated requests, validates payloads, enforces request limits and resolves store membership before making a database call.
K2S implementation notes
An API-led commerce core with verifiable boundaries.
The repository includes an executable PostgreSQL migration and an architecture guide. The browser has no database connection and cannot bypass the policy layer.
2. Tenant-aware PostgreSQL
Tables carry store scope, foreign keys protect relationships, and row-level security blocks accidental cross-store reads.
3. Reusable clients
React web and future native clients share the same HTTP contracts; business decisions remain in API services.
Included data model
The migration creates all required core entities, keyed by UUID with indexes on tenant filters and high-volume lookup paths.
Identity & tenancy
users, stores, store_members, settings, audit_logs
Catalog & inventory
products, product_variants, categories, collections, inventory, inventory_movements
Customers & commerce
customers, orders, order_items, payments, refunds, coupons, discounts, abandoned_carts
Plans & controls
subscriptions, subscription_plans, invoices, commissions, feature_flags, feature_plan_access, ai_credits, ai_usage
Operations & growth
shipping_zones, shipping_rates, deliveries, suppliers, purchase_orders, expenses, marketing_campaigns, automation_rules
Experience & ecosystem
domains, themes, apps, notifications, support_tickets, blog_posts, analytics, customer_segments, affiliate_accounts, affiliate_conversions
Tenant transaction pattern
BEGIN;
SELECT set_config('app.user_id', :userId, true);
SELECT set_config('app.store_id', :storeId, true);
-- API query: RLS checks membership + store scope
COMMIT;The API must never accept a store ID as authority. It checks membership first, then the database enforces the same boundary independently.
Deployment security checklist
- 01Set DATABASE_URL, service credentials and provider secrets only in the function runtime.
- 02Run the migration with a privileged deployment account; application roles receive only intended grants.
- 03Use a managed PostgreSQL backup policy with point-in-time recovery where the provider supports it.
- 04Route object access through short-lived, tenant-scoped signed URLs generated by the API.