The Bakery Co.

Tech Stack

Technical Decisions

Key Features

Product Thinking

Features that came from thinking about how the business owner actually uses this — not just what was technically interesting to build.

• Scheduled pickup time slots with slot disabling — past times are disabled, same-day slots within 2 hours are removed, and orders placed after 6pm roll to next-morning slots. A customer placing an order at 8pm shouldn't be able to pick up at 9pm.
• Minimum order enforcement before Stripe is called — the checkout button stays disabled until the cart meets the minimum. No partial charge attempts, no error messages from Stripe — the constraint is enforced in the UI before the payment flow starts.
• Thermal receipt formatting (80mm) — the admin's print receipt is formatted for a standard 80mm thermal receipt printer, not a browser print dialog. That's the printer sitting next to every point-of-sale terminal. Getting this right meant the dashboard is actually usable in a real kitchen.
• Local timezone date filtering — an early version filtered orders by UTC date. A 10pm order in Detroit showed up under the wrong day because UTC midnight had already passed. Fixed by converting all date comparisons to the server's local timezone so the admin's "today" matches their actual day.
• Refund button with graceful error handling — if the Stripe refund API call fails, the owner sees a human-readable message telling them to go to the Stripe dashboard directly. Not a raw error. Not a spinner that hangs. A clear next step they can actually follow.
• Gift card full-coverage Stripe skip — if a gift card covers the entire order total, Stripe is never called. The check is amountAfterGiftCard < 0.01. Trying to create a $0 Stripe PaymentIntent throws an error; this catches it before it ever gets there.
• Birthday coupon deduplication — the cron records birthday_coupon_year on the customer profile after sending. The next morning's run checks that field before generating a new code, so customers get exactly one birthday coupon per year regardless of how many times the job runs.
• Session token proactive refresh — at checkout initialization, if the Supabase session expires within 60 seconds, refreshSession() is called before the user ever hits an auth error. On a 401 from /api/points, the frontend retries with a refreshed token, then signs out if the refresh also fails — no stuck states.
• Bidirectional paired items — when an admin edits a menu item's paired_items array, the server diffs old vs. new pairs and writes the reverse relationship on all affected items. Removing a pair also cleans up the reverse link. The recommendation graph stays consistent without the admin having to manually maintain both directions.

Challenges

app.post('/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
    const sig = req.headers['stripe-signature'];
    let event;

    try {
        event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
    } catch (err) {
        return res.status(400).send(`Webhook Error: ${err.message}`);
    }

    if (event.type === 'payment_intent.succeeded') {
        const paymentIntent = event.data.object;
        const orderId = paymentIntent.metadata.order_id;

        await supabase
            .from('orders')
            .update({ status: 'paid', stripe_payment_id: paymentIntent.id })
            .eq('id', orderId);

        await sendOrderConfirmationEmail(orderId);
    }

    res.json({ received: true });
});

const requireAuth = async (req, res, next) => {
    const authHeader = req.headers.authorization;
    if (!authHeader?.startsWith('Bearer ')) {
        return res.status(401).json({ error: 'No token provided' });
    }

    const token = authHeader.split(' ')[1];
    const { data: { user }, error } = await supabase.auth.getUser(token);

    if (error || !user) {
        return res.status(401).json({ error: 'Invalid or expired token' });
    }

    req.user = user;
    next();
};

// Applied to every admin route
app.use('/api/admin', requireAuth);

// Daily summary — 8pm every day
cron.schedule('0 20 * * *', sendDailySummary);

// Weekly report — Sunday 8pm
cron.schedule('0 20 * * 0', sendWeeklyReport);

// Unfulfilled order reminder — every 2 hours
cron.schedule('0 */2 * * *', sendUnfulfilledReminder);

// Birthday coupons — 8am every day
// Finds matching birthdays, generates unique BDAY-XXXXXXXX code (15% off),
// emails it, records birthday_coupon_year to prevent duplicates
cron.schedule('0 8 * * *', sendBirthdayCoupons);

Business Impact

• 0% commission per order — vs. 15–30% on DoorDash or Uber Eats. On a $50 order, that's $7–15 back in the owner's pocket, every time.
• Replaces $200–500/month in SaaS tools — Square Online, Toast, and similar platforms charge for what this project provides out of the box: online ordering, an admin dashboard, inventory management, and automated reporting.
• Forkable in hours — the architecture is built to be reskinned for any food business. Swap the menu items, colors, and business name and the full ordering + admin platform is ready to redeploy.
• 70ms interaction response time — measured via Google's PageSpeed Insights. Clicks and taps register in under a tenth of a second — the kind of responsiveness customers feel even if they can't name it.

Outcome

The Bakery Co. is the most technically complete project I've shipped as a web developer. It covers the full stack — frontend UX, backend API design, relational database, real payments, transactional messaging, and automated operations — and it's built around a real problem that real businesses have. Every feature required understanding how the pieces connect, not just how to write code in isolation. Coming from iOS, it gave me hands-on experience with the parts of web engineering that don't exist in the mobile world: server-side auth, webhook event handling, and scheduled background jobs.

What I Learned

• How Stripe's payment flow works end-to-end — PaymentIntents, webhooks, and why the webhook is the only reliable signal that payment succeeded
• JWT authentication on a Node.js/Express backend — issuing tokens, verifying them in middleware, and what 401 actually means
• Supabase as a Postgres backend — relational data modeling, row-level security, and Supabase Auth
• Transactional email with Resend — HTML email templates, deliverability basics, and when to use email vs. SMS
• Scheduled cron jobs — running background work on a server without user interaction
• Express API design — routing, middleware chains, rate limiting, and keeping secrets server-side
• Deploying a Node.js app to Render with environment variable configuration

Next Iteration

• Replace node-cron with BullMQ or an external cron service — scheduled jobs currently live inside the Express process and are silently lost on server restart
• Stripe webhook idempotency keys — the current webhook handler doesn't guard against duplicate deliveries on Stripe retries; adding an idempotency check before writing to Supabase would make it bulletproof
• Move the co-purchase pair tracking job off the request path — currently runs synchronously on every order save; at scale this should be a background job so it doesn't add latency to checkout confirmation
• Automated integration tests for the checkout flow — the payment-first architecture is correct but untested at the webhook layer; a test suite with Stripe CLI webhook forwarding would catch regressions