Rynco Orchids — E-commerce store

Rynco Orchids grow Phalaenopsis, Dendrobium, Vanda, Mokara and rarer varieties in their own greenhouses, and sell retail, wholesale, for export and as corporate gifts. Those are four different buyers with four different expectations, and the store had to serve all of them: catalogue and collections, product pages, wishlist, addresses, accounts, per-genus landing pages, care guides, and an administrative panel where the nursery manages its own products, categories, imagery and featured selections.

Payments run through Paytm in production alongside cash on delivery. Order confirmations reach customers on WhatsApp, and the way that was built is worth a sentence: the database itself triggers the message. A row is written, a database trigger fires a network call, and a server-side function sends it. The application tier is not in the path, so a confirmation cannot be lost because a browser closed or a request timed out.

Search was a repair job rather than an addition. The site was not being indexed properly, so pages are now rendered to static HTML at build time and the build fails outright if the sitemap generator finds missing data — a gate rather than a warning, because a warning in a build log is a thing nobody reads.

The most useful thing to come out of this project was an outage. For ten days the database's REST layer returned errors on every call, and it was almost invisible: because most pages are pre-rendered, they kept serving perfectly healthy HTML. Only sign-in and account pages were affected. The write-up afterwards is public inside the repository, and its conclusion is the part worth repeating — to check whether an API is alive, perform an authenticated read of a real table. A preflight request and an unauthenticated request both appear to succeed while the system underneath is completely stuck, and they give a confident all-clear that costs real time. The report also records, plainly, that alerting still needs to be finished.

The recovery work produced a lasting fix. A single failed profile fetch had been enough to leave the application permanently unbootstrapped, locking people out behind a blank screen. It was rebuilt so that the startup flag always resolves, with a timeout, a race and a watchdog. The principle it follows: fail open on availability, closed on privilege. If the role cannot be read, the fallback is always the ordinary customer role and never the administrator.

Two security reviews were carried out during the build and shipped as migrations, with the items deliberately deferred written down rather than quietly dropped.