Case Study · Headless e-commerce

Treatsdom

A production headless storefront for a UK brand selling authentic Nigerian snacks to the diaspora — designed, built, deployed and operated end-to-end.

Live — real payments, UK-wideSolo buildtreatsdom.com
Treatsdom

Overview

Treatsdom is a live, mobile-first storefront on a headless commerce backend. It runs a real Stripe checkout with digital wallets and SCA, a safety-critical allergen system, WCAG 2.1 AA accessibility, structured-data SEO and GDPR compliance — and cleared a full pre-launch security, accessibility and performance review with disaster recovery verified.

Role
Full-stack engineer — solo, end-to-end
Scope
Architecture → frontend → commerce backend → payments → DevOps → security → launch & ops
Live
treatsdom.com · mobile-first · GBP · UK delivery

Stack

Frontend
Next.js 15 · App RouterTypeScript · strictReact Server ComponentsCSS Modules + tokensZustand
Backend
Medusa v2Node.jsPostgreSQLRedis
Payments
StripeApple / Google / Revolut / Amazon PaySCA · 3-D Securewebhook-as-authorityPCI SAQ-A
Platform
VercelHetzner + Coolify · DockerBackblaze B2pnpm + TurborepoGitHub Actions
Content & SEO
Resend · lifecycle emailschema.org JSON-LDGoogle Search Console

What it does

A full store, not a demo

Headless architecture

A provider-swappable commerce layer with unified types — components consume the abstraction, never Medusa directly.

Server-authoritative money

Cart, pricing, discounts and delivery are computed on the server. The client never calculates a total.

Real Stripe checkout

Cards and digital wallets, a dedicated SCA challenge state, and the webhook as the single source of truth for payment.

Allergen safety system

Structured contains / may-contain / free-from data drives the card badge, PDP block, "free-from" filter and account profile — gated by a required-before-publish guard.

Combos & size grid

Fixed bundle products with live "you save" pricing, and three portion sizes across the range.

Lifecycle email

Order, dispatch and refund emails via Resend, with idempotency keys so nothing double-sends.

Engineering

Problems worth the write-up

Payments

Digital-wallet checkout that actually completes

Apple & Google Pay never fill the on-page form, so the flow hung on "processing". Reworked the Stripe Express Checkout Element to consume the wallet's own address and reconcile it with server-side flat-rate delivery — then hardened it through security and resilience review (no double-charge, no paid-but-no-order).

Mobile · iOS 26

Surviving Safari's "liquid-glass" toolbar

The floating toolbar broke every full-screen overlay. Solved with viewport-fit: cover + safe-area insets + a ref-counted scroll-lock — after proving the obvious 100dvh fix was wrong and reverting it.

Security

Rate limiting that fits the topology

All storefront traffic reaches the backend from Vercel's IPs, so per-IP limits put every customer in one bucket — eight sign-ins a minute site-wide. Re-keyed limits per account, with a separate IP ceiling.

Correctness

A money-display bug inside the platform

Medusa's cart.subtotal quietly includes shipping, inflating the displayed subtotal and the free-delivery bar. Switched to an items-only basis so the cart, checkout and the promotion rule all agree.

Live ops

Two production outages, diagnosed from outside

Traced and resolved a registrar WHOIS-verification suspension and a carrier-specific IP-reachability block — DNS forensics, not guesswork.

Outcomes

Shipped & verified

Livereal payments, end-to-end
(order → webhook → capture → refund)
5payment methods
cards + 4 wallets
12 → 0pre-launch review
2 Critical + 10 High, all closed
WCAG 2.1 AAaccessibility
+ Core Web Vitals budget
Verifiedoff-site backups
+ passing restore drill
PCI SAQ-Acard data never touches
our servers

Skills demonstrated

Next.jsTypeScriptHeadless commerce · Medusa v2Stripe · paymentsPostgreSQLRedisAccessibility · WCAG 2.1 AAWeb performanceSecurity & GDPRDevOps · Docker · CoolifySEO · structured dataSystem design

See it running.

Built by BLACKINS Creative Tech · 2026