Royal Algae

The problem

A wellness brand needed a trustworthy storefront that could take orders from first-time visitors without forcing account creation, accept both COD and online payments reliably, and never lose an order if a customer dropped off mid-payment — all while staying secure against client-side price tampering.

My approach

I built a Laravel 12 API + React SPA where pricing is always computed server-side from the database (the client total is never trusted), guests check out via phone-OTP verification, and online orders are 'parked' until payment is confirmed — reconciled by Razorpay webhooks so a dropped browser never means a lost paid order.

Architecture

Laravel 12 exposes a token-authenticated (Sanctum) API with role-based access (Spatie) and ra_-prefixed tables. OrderService owns pricing, order creation, and reconciliation; RazorpayService wraps order/invoice creation and signature verification; pending checkouts are parked and confirmed via webhook with COD as a first-class path. Product images and DomPDF invoices live in S3; Msg91 sends OTP SMS. The React 19 + Vite + Tailwind front-end adds Framer Motion and a Three.js liquid hero, an education-first learn hub, and a full admin dashboard for products, categories, orders, and store settings.

Highlights

• Guest checkout via phone-OTP (Msg91) with one-time verification tokens.
• Server-side pricing — discounts, GST, and shipping computed from the DB, never the client.
• Razorpay online payments + COD, with parked checkouts reconciled by webhooks.
• DomPDF invoices and product media stored on AWS S3.
• Role-based admin dashboard for catalog, orders, and settings.
• Immutable order/address snapshots so history stays correct as profiles change.

Tech stack