KHYRON DEVS
All work
Self-initiated technical buildProduction Full-Stack

EazyShop

A production-grade e-commerce platform covering the full shopping lifecycle and administrative workflows.

high-concurrency transaction engine / EazyShop

One checkout.
Four cryptographic guarantees.

a single order scrubbed through session, lock, signature, ledger

Follow ₹4,999 through the EazyShop transaction pipeline. A guest cart hydrates from JWT claims and Redis, inventory serializes behind a row-level lock with a 120-second TTL, the Razorpay capture survives HMAC verification and the replay gate, and the order freezes into an append-only audit ledger.

pipeline telemetry

Order Lifecycle Trace

Django REST • PostgreSQL Row Locks • Razorpay Webhooks • Brevo Dispatch

  1. SESSION

    jwt + redis hydrate

  2. RESERVE

    for update · ttl 120s

  3. CAPTURE

    hmac verify ingress

  4. COMMIT

    ledger + brevo emit

01

01 // GUEST SESSION HYDRATION

JWT claims merge guest carts without race conditions.

A guest token carries a signed claim set while the live cart lives in Redis. On authentication, both hydrate into one PostgreSQL row inside a locked transaction — double submits collapse to a single merge.

guest token + redis streamhydrated persistent cart
  • idempotent merge on replayed auth
  • claim expiry checked before hydration
  • guest key burned after commit
TOKEN: HS256 · 3 claimsCACHE: redis GET cart:{t}MERGE: atomic block
EazyShop — JWT claims merge guest carts without race conditions.
Signed claim set + Redis cart stream merge
02

02 // SELECT ... FOR UPDATE

One row, one writer: zero overselling under load.

Checkout takes SELECT ... FOR UPDATE on the product row. Competing sessions queue behind the lock holder while a strict 120-second TTL guarantees unpaid reservations release themselves automatically.

concurrent reserve requestsserialized stock decrement
  • repeatable-read isolation level
  • stock >= qty guard clause
  • TTL sweeper releases expired locks
ISOLATION: REPEATABLE READLOCK MODE: ROW EXCLUSIVETTL: 120s countdown
EazyShop — One row, one writer: zero overselling under load.
Row-exclusive lock with 120s reservation TTL
03

03 // HMAC-SHA256 INGRESS

Every payment webhook is mathematically proven.

Razorpay posts the capture event; the edge recomputes the HMAC over the raw body and compares digests in constant time. Forged payloads fail verification; replays die at the nonce ledger before fulfillment fires.

raw payload + X-Razorpay-Signatureverified capture event
  • constant-time digest compare
  • event.id nonce replay ledger
  • fulfillment gated on VERIFY only
ALG: HMAC-SHA256COMPARE: constant timeNONCE: evt_1k... unique
EazyShop — Every payment webhook is mathematically proven.
HMAC-SHA256 verification + replay nonce gate
04

04 // IMMUTABLE AUDIT LEDGER

The order commits to an append-only ledger.

PAID advances the order through the state machine, each transition hashed into an immutable audit chain. Stock finalizes, the Brevo confirmation email dispatches, and full provenance is frozen forever.

captured payment eventcommitted order + receipt
  • append-only transition rows
  • sha256 hash-chained provenance
  • Brevo dispatch on commit
LEDGER: append-only WALCHAIN: sha256(prev‖row)EMAIL: brevo queued
EazyShop — The order commits to an append-only ledger.
State-machine emit + Brevo confirmation dispatch
PHASESESSION HYDRATION
STATESYNC_HYDRATED
ROW LOCKUNLOCKED
METRICRedis + JWT Claims
AMOUNT₹4,999.00
Explore Architecture, ACID State Machine & SQL Workbench
EazyShop • Commerce Architecture & Telemetry
Live Storefront
Production E-Commerce System

From cart to checkout.
Guaranteed transactional atomicity.

A database-backed Django REST + React commerce platform covering the full shopping lifecycle — authentication, catalogue, cart, wishlist, checkout, payments, and reviews.

ACID Concurrency Scorecard

PostgreSQL • Serialized Consistency
A / Atomicity

Two-Phase Rollbacks

Cart checkout wrapped in @transaction.atomic blocks. If payments fail, stock reservations release immediately.

C / Consistency

Relational Invariants

Database-level foreign key checks and positive inventory constraints guarantee no negative stock quantities occur.

I / Isolation

Row-Level Locks

SELECT FOR UPDATE prevents race conditions and overselling across parallel concurrent checkouts.

D / Durability

Immutable WAL Stream

PostgreSQL write-ahead logs and an append-only audit ledger record every status mutation for administrative compliance.

acid state machine

Order Lifecycle — Scroll to Advance the Packet

CREATEDcart snapshot frozenLOCKEDFOR UPDATE · ttl 120sPAIDhmac sig verifiedPROCESSEDledger appended · brevo sent
STATE:CREATED0% THROUGHPIPELINE
interactive concurrency workbench

Race Condition Flight Simulator

MODE: SELECT ... FOR UPDATE
SAFE — ROW LOCK
BEGIN;
SELECT stock FROM store_product WHERE id = 104
  FOR UPDATE;                 -- row lock: writers queue
UPDATE store_product
  SET stock = stock - 1
  WHERE id = 104 AND stock >= 1;
COMMIT;
NAIVE — NO LOCK
BEGIN;
SELECT stock FROM store_product WHERE id = 104;
IF stock >= 1 THEN             -- read-then-write: NOT atomic
  UPDATE store_product SET stock = stock - 1 WHERE id = 104;
END IF;
COMMIT;
TX TRACECOMMITTED 0 / 6 · FINAL STOCK 3

awaiting workload — fire 6 workers against 3 units

workload in flight…
sql explain workbench

Query Plans & Lock Traces

QUERY
SELECT id, stock, price
FROM store_product
WHERE id = 104
FOR UPDATE;
EXPLAIN ANALYZE PLAN
Lock Row Fetch  (cost=0.14..0.16 rows=1 width=42)
  Index Cond: (id = 104)
  -> Row Share Lock acquired on heap TID (0,17)
     Wait Time: 0 ms · Holder: tx_9841
pg_locks TRACE
store_product tid (0,17)  FOR UPDATE   HELD 120s TTL
transactions            RowShare      HELD
ACCESS EXCLUSIVE waits    5 queued → serialized

Serializes concurrent buyers on one hot row. Correctness over throughput — exactly where overselling would live.

System Interface Gallery

Multi-Tier Operational Telemetry

Storefront Homepage
GET /
React 19 View
Customer Journey • Screen 01 of 05

Storefront Homepage

Featured collections, hero product carousel, and category quick-filters.

Endpoint:GET /
Architecture:React 19 View
Category:Storefront & Catalog
Screens in Storefront & Catalog
Code & Boundary Inspector

Backend Concurrency Mechanics

01 of 04

Guest Session Hydration

JWT claims + Redis cache merge under a single atomic block.

A guest cart lives in Redis keyed by a signed JWT claim set. When the shopper authenticates mid-checkout, the merge runs inside SELECT ... FOR UPDATE on the destination cart row, so duplicate auth submissions serialize instead of double-inserting line items.

Session StoreSigned JWT + Redis TTL
Merge GuardRow lock on cart target
Replay PolicyGuest key burned post-commit
JWT SessionsRedis CacheIdempotent Merge
store/cart/session_service.py
# store/cart/session_service.py
def merge_guest_cart(guest_token: str, user_id: int):
    claims = decode_jwt(guest_token)          # exp + sig verified
    guest_items = cache.get(f"cart:{claims['sid']}") or []
    with transaction.atomic():
        cart, _ = Cart.objects.select_for_update().get_or_create(user_id=user_id)
        for item in guest_items:
            cart.add_item(product_id=item["id"], qty=item["qty"])
        cache.delete(f"cart:{claims['sid']}")  # burn guest key
    return cart
Django REST FrameworkProduction Grade
02 of 04

Row-Level Atomic Lock

SELECT ... FOR UPDATE serializes every unit of stock.

Reservation takes a row-exclusive lock on store_product at REPEATABLE READ isolation. Competing transactions block behind the holder, the decrement is guarded by stock >= qty, and a background sweeper releases unpaid reservations once the strict 120-second TTL expires.

TransactionACID Atomic Block
ConcurrencyRow-level lock (FOR UPDATE)
ExpiryTTL sweeper releases at 120s
SELECT FOR UPDATE120s TTLZero Overselling
store/checkout/atomic_locks.py
-- SQL: Row-Level Atomic Reservation
BEGIN TRANSACTION ISOLATION LEVEL REPEATABLE READ;
SELECT id, stock, price FROM store_product
WHERE id = 104 FOR UPDATE;

UPDATE store_product
SET stock = stock - 1
WHERE id = 104 AND stock >= 1;
COMMIT;
Django REST FrameworkProduction Grade
03 of 04

Cryptographic Webhook Ingress

HMAC-SHA256 verification gates all fulfillment.

The webhook endpoint recomputes HMAC-SHA256 over the raw request body and compares digests with hmac.compare_digest in constant time. A nonce ledger keyed on event.id rejects replays before any state mutation, and only payment.captured events advance the order.

GatewayRazorpay API / Checkout
SecurityConstant-time digest compare
FulfillmentEvent-gated state advance
HMAC-SHA256Replay NonceRazorpay Events
store/payments/gateway_webhook.py
# store/payments/gateway_webhook.py
def verify_payment_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, signature):
        raise SecurityException("Invalid webhook signature")
    return True

@csrf_exempt
def razorpay_webhook(request):
    event = json.loads(request.body)
    verify_payment_signature(request.body, request.headers["X-Razorpay-Signature"], SECRET)
    if NonceLedger.seen(event["id"]):           # replay gate
        return HttpResponse(status=200)
    fulfill_order_from_payload(event)
    return HttpResponse(status=200)
Django REST FrameworkProduction Grade
04 of 04

Order Emission & Audit Ledger

Append-only state machine with hash-chained provenance.

Every transition (CREATED → LOCKED → PAID → PROCESSED) appends an immutable row whose signature_hash chains the previous entry. Stock finalizes atomically, the Brevo confirmation email dispatches on commit, and administrators reconstruct full order provenance from the ledger alone.

AuditingAppend-only transition log
Provenancesha256(prev_hash ‖ row)
NotifyBrevo email on PAID commit
Append-OnlyHash ChainBrevo Dispatch
store/admin/audit_ledger.py
# store/admin/audit_ledger.py
class OrderAuditLedger(models.Model):
    order_id = models.UUIDField(db_index=True)
    previous_state = models.CharField(max_length=32)
    next_state = models.CharField(max_length=32)
    signature_hash = models.CharField(max_length=64, editable=False)
    timestamp = models.DateTimeField(auto_now_add=True)

    def save(self, *args, **kwargs):
        prev = OrderAuditLedger.objects.order_by("-id").first()
        self.signature_hash = hashlib.sha256(
            f"{prev.signature_hash if prev else 'GENESIS'}:{self.next_state}".encode()
        ).hexdigest()
        super().save(*args, **kwargs)   # append-only: never updated
Django REST FrameworkProduction Grade