A UK-to-Nigeria parcel forwarding and personal shopper platform with customer dashboard, admin console, and unified API. Handles multi-stage parcel lifecycle, KYC, and dual-currency pricing.
- Client
- BuyUK247
- Role
- Lead Full-stack Engineer
- Scope
- Design, build, deploy, staff training
- Stack
- Next.js, React, TypeScript, Motion, Fastify 5, Node 20, Zod, Drizzle ORM, PostgreSQL 17, Docker, Tailwind CSS
- Category
- SaaS
- 8
- Parcel lifecycle stages
- 4
- Staff roles
- ~24
- Database migrations
- 40
- UK stores integrated
The project.
BuyUK247 gives Nigerian shoppers a London warehouse address so they can buy from UK retailers and have parcels forwarded by air or sea to a depot or their door. Staff can also purchase items on behalf of customers through a Shop-for-Me workflow. The platform serves two audiences: end customers who need a simple way to shop and track shipments, and an operations team that manages parcels, payments, KYC, and pricing. It is built as three applications sharing one API: a customer-facing Next.js site with a dashboard, an admin console for staff, and a Fastify backend with PostgreSQL. The system exists to replace manual spreadsheet-based operations with a structured, auditable workflow that enforces business rules at the database level.
What had to be solved.
The operation previously relied on manual tracking across multiple stages, making it easy to skip steps or lose parcels. Identity verification was ad-hoc, exposing the business to fraud and under-age users. Pricing required two currencies with per-city freight rates, storage fees that start after a configurable free period, and a staff-set exchange rate that drives every Naira figure. The team needed role-based access for four distinct staff roles with server-side enforcement, and non-technical staff had to edit marketing content, pricing, and site settings without code deployments.
How it was built.
I built a customer site with on-demand revalidation so staff can publish content changes instantly. The admin console surfaces work-in-progress badges for KYC reviews, payments, and shipments. The API enforces an eight-stage parcel lifecycle with a database trigger that only allows forward moves, and it stores a full status history. Readable IDs (UKN-10001, SHP-2301, BUK123456) come from sequences. Pricing logic handles air and sea freight, per-city per-kg rates, depot versus door delivery, and a configurable GBP-to-NGN rate. Storage fees activate after ten free days at £0.50/kg per started week. Shop-for-Me flows cover request, quote, payment, purchase, or decline with configurable fees and limits. Payments are verified by staff; invoices require bank details first. Shipments are assembled from parcels with tracking events; only admins can cancel before UK departure. Automated KYC reminders run at 1, 7, and 14 days; unverified accounts are deleted at 21 days with a claimed-email mechanism to prevent duplicate sends. Staff toggles control announcements, signups, KYC requirement, maintenance mode, and social links. Eight email templates are managed in the console with Excel export. Security uses random session tokens stored as SHA-256 hashes in HttpOnly SameSite cookies, separate tables for customers and staff, scrypt password hashing, and login errors that do not reveal email existence. Four roles (Admin, Operations, Support, Finance) are enforced from a single permissions map. KYC files are validated by magic bytes, limited to 5 MB, stored under random names, and served only to staff; ID numbers are AES-256-GCM encrypted and every staff view is logged. Under-18s are rejected. An audit log captures every staff change; staff cannot change their own role or deactivate themselves, and the last admin is protected. New staff receive one-time 48-hour setup links. Rate limits, origin checks, Helmet headers, and server-side Google token verification complete the hardening. Infrastructure runs on a self-hosted VPS with (Docker + Traefik, auto SSL), one container per app, internal-only Postgres, a persistent volume for uploads, Cloudflare DNS, and a server hardening script. Extras delivered include admin and staff video tutorial scripts, a VPS hosting comparison, a maintenance proposal, and a WhatsApp Business API application guide. Not yet implemented: payment gateway integration, automated KYC provider, S3 uploads, SMS/WhatsApp sending, and scheduled database backups. The platform is live. All core workflows, customer onboarding, parcel lifecycle, Shop-for-Me, staff operations, and content management, are functional and tested.