Ordering & Delivery Platform

A customer tracks an order while the kitchen advances it and the owner watches the queue. A stale status means food cooked twice, or not at all.

One orders table as the only source of truth, with Postgres change events pushed to every connected client. No client computes status locally, and none of them poll.

Three portals with sharply different permissions, built by one developer who cannot hand-audit every new endpoint before shipping it.

Row-level security across all 14 tables, so the policy travels with the data. A handler cannot leak a table by forgetting to guard it, because the guard is not in the handler.

The menu is read on nearly every request and edited a few times a week — but when the owner changes a price, the next customer has to see it, not the next cache window.

Redis in front of Postgres for menu reads, with the admin write path explicitly invalidating the cache rather than waiting for a TTL to lapse.

The business ran on cash on delivery and WhatsApp confirmation. No card processor was in scope, and the country runs on two currencies at a rate that moves.

Money stays out of the application. Orders carry totals in both currencies against a rate the owner controls, and confirmation hands off to the channel customers already used.