The problem
Build a full multi-vendor marketplace in under three months: separate roles for sellers, buyers, and delivery riders; realtime buyer/seller chat; cart-to-delivery order flow; and third-party integrations. TypeScript end to end, with production-minded security from the start.
What I built
Multi-vendor architecture
Schema and APIs for three roles with separate auth flows, capabilities, and data scopes. Sellers own catalogs and incoming orders. Riders only see assigned deliveries. Buyers see their cart and purchase history. No cross-role data leaks.
Order lifecycle
Full path: cart, checkout, payment, seller confirmation, rider assignment, delivery, review. State-machine transitions keep the flow auditable and block invalid jumps.
Realtime chat
Socket.io messaging between buyers and sellers, with MongoDB persistence and read receipts. Rooms scoped to order IDs so conversations stay isolated.
Role-based auth
JWT RBAC with route-level middleware. Each protected route declares allowed roles. Unauthorized requests stop at the edge before business logic runs.
Integrations
- Cloudinary: product images with resize, compress, and format conversion. Store references, never base64 blobs in MongoDB.
- Twilio: SMS OTP for phone registration and sensitive account actions.
- Geocode API: delivery zones and address validation.
- Google and Apple OAuth: social sign-in with optional later password linking.
Security
Per-route rate limits (stricter on auth), IP blocking for abuse, input sanitization, and Winston/Morgan for structured logs and audit trails.
Technical decisions
TypeScript everywhere
Types on models, request/response shapes, and services. With three roles and a tight deadline, compile-time checks caught mistakes early and kept the codebase readable for the next engineer.
Product snapshots on orders
Price and product details are copied into the order at checkout. Later price edits or deletions cannot rewrite history. Required for correct commerce records.
Refresh token rotation
Short-lived access tokens (15 minutes) plus rotating refresh tokens stored server-side. Users stay signed in; a stolen refresh token dies on next use.
Schema designed for listings
Upfront MongoDB modeling to avoid N+1 patterns on order lists. Embed summaries where needed; reference documents that can grow without bound.
Stack
Node.js · Express · TypeScript · MongoDB · Socket.io · JWT · Cloudinary · Twilio · Google OAuth · Geocode API