A subscription learning platform for financial literacy (built multi-channel billing, idempotent payments, and agent commissions in a Next.js 16 monorepo)

[Deterministic resolution of multi-channel pricing] Six input streams — bank-transfer ID, monthly/annual payment cohort, student list, Alpha, old Pro late, and NFT benefits (12 tiers) — are folded into one pure function resolvePricingClassification with a fixed priority order, deterministically mapping to a payment flow (Stripe Checkout / external migration / bank-transfer skip), a price bucket (K01/K02/K13), and the purchasable plans. Structurally eliminates scattered pricing logic and missed branches.

[Stable resolution of NFT benefits] Implemented selectPrimaryNft to pick "the benefit with the longest free period" when holding multiple, deterministically tie-breaking by free period → purchase date → tier. Old Pro is refined into EARLY/LATE at the purchase-date boundary, and the bridge until external-NFT holding judgment returns purchasedAt is isolated in an explicit interim-override table.

[Idempotent, order-resilient Stripe webhooks] Re-sends are eliminated by an event-ID unique constraint, and event.created is compared against lastProcessedEventCreatedAt to skip late-arriving old events (preventing subscription-state rollback). The raw payload has PII keys (card/email/ip, etc.) recursively redacted to <redacted> before storage, retaining no PII.

[Bank-transfer subscription state machine] Days elapsed since the payment deadline are folded into a pure function computeNextStatus (ACTIVE → GRACE_PERIOD (7 days) → SUSPENDED (30 days) → CANCELED), with another pure function selecting T-30/14/7/0 5-stage dunning. Dunning is made idempotent by a containment check against a "sent set," so a daily Cron can re-run safely.

[Append-only agent-commission ledger] Rewards are recorded in an append-only ledger keyed idempotently by ${scope}:${period}:${currency}:r${revision}, and monthly recalculation increments the revision to re-run safely. Amounts avoid floats and use BigInt basis-point arithmetic (10000 = 100%) to eliminate rounding error, carrying amounts below the minimum payout to the next month.

[Atomic audit logs] Admin-operation use cases take a Prisma.TransactionClient as the first argument, executing the business write and the record to AdminAuditLogs atomically in the same transaction. The server action owns the transaction boundary, revalidatePath, and authorization via requireAdmin(), separating concerns.

[Robust auth details] Sign-in always runs a dummy-hash bcrypt comparison even for unknown users to make it constant-time, and password-reset link requests use a response-time floor to suppress account enumeration. tokenVersion is carried in the JWT to bulk-revoke all sessions on a password change. OTP is stored as HMAC-SHA256 and locks out after 5 attempts.

[Type-safety discipline and tests] Banning as/any/enum/non-null and enforcing switch exhaustiveness at compile time with NeverError. Ran 433 Vitest tests in CI centered on pure logic — pricing resolution, the state machine, commission calculation, CSV consistency, etc. (a gate that spins up Postgres per PR and passes typecheck → build → test → lint → format).