Database Engineering

Every domain is split by role: distributors and retailers get separate controllers, services, and notification tables over one shared schema of 24+ tables. Orders move through an explicit status-driven state machine, so an order can never skip a step or be acted on by the wrong side of the marketplace.

Row Level Security enforces per-user data access in the database itself, not just in application code. Background work runs as six secret-protected Vercel crons — recurring transactions, budget alerts, monthly email reports, savings updates, exchange-rate cleanup, and a daily full sync of every table to a Neon backup database.

Every endpoint returns one uniform envelope — { payload, message, code, error } — so the frontend unwraps all responses identically. Auth tokens are persisted server-side, which makes logout an actual revocation instead of just deleting a client token. And the storefront falls back to mock data whenever the API is empty or unreachable, so the UI is demoable out of the box.

Dependencies flow one way — common-api → security-api → todoapi — so the auth service can never depend on a business API. The schema belongs to Flyway: Hibernate only validates it, which turns silent schema drift into a startup failure. Auth state that must be revocable (refresh tokens, blacklisted JWTs, reset/verification/unlock tokens) lives in dedicated tables rather than in stateless token claims.

There's no single request path here — Dev Lab's 'architecture' is its repo layout, not a runtime flow. Each folder is a standalone project with its own build tool and wrapper, so any one of them opens and runs in IntelliJ without touching the others.