MasterBazi

Selling codes and accounts means selling secrets that can be leaked, double-sold or disputed. The business also needed card-to-card payments with receipts, wallets, debts and instalments, and in-person sales, all reconciled to the rial.

I built a modular monolith in which every channel (admin, storefront, API, Telegram and console) is a thin adapter over the same single-purpose actions. Status changes only go through state machines. Money is integer rial. Concurrency is handled with a global lock order, row locks, generated-column unique keys and an idempotency service.

Delivery secrets are encrypted with a dedicated key, and every reveal is logged. Every sensitive change is audited in the same transaction, and events fire only after commit.

The platform ships with a full back-office: inventory and reservations, the code and account pool, payment review and refunds, suppliers and expenses, reports with async export, trust and safety, roles, an audit log and backups. It is covered by 62 test files and documented in 15 design docs, including a shared-hosting runbook.