PX TopUp

Three roles with genuinely different powers — buyer, agent, admin — plus a web client and a mobile client, all touching the same money. Every extra API surface is another place an authorization rule can drift out of sync, and drifted authorization in a marketplace means someone gets paid twice or not at all.

One Next.js host for all three roles and both clients, with a fixed five-stage pipeline every request walks in the same order: rate limit, verify token, re-read the role from the database, validate the schema, then the handler. Stores split on durability versus liveness — MongoDB for anything auditable, Firestore for the chat thread. Money moves only along an order state machine, on an append-only ledger, in decimal.js BDT.

Authorization has exactly one answer per request, and a status code names the gate that rejected it without anyone reading a stack trace. Idempotency keys make a double-tap on a flaky connection harmless, and commission only splits once an order reaches confirmed, so no code path pays an agent for an order that was later disputed.