Resa loves code

Turning ideas into clean websites 💻 | Building in public |

learning everyday

Gmail: [email protected]

[Resa loves code @SUcCeS188]

The build order, roughly:

Express+DB → Auth → Orders → Payments → Hardening (rate limits, validation, logging) → Menu customization (sizes/toppings with live pricing)

Every step tested end-to-end before moving to the next.

[Resa loves code @SUcCeS188]

Payments: Stripe PaymentIntents + signed webhooks.

Card data never touches my server — Stripe handles that directly. My backend only finds out a payment succeeded when Stripe sends a cryptographically signed webhook confirming it. No "trust the frontend" shortcuts.

[Resa loves code @SUcCeS188]

@dev_olayinka Your sever say make you calm down you nor wan hear 😹

[Resa loves code @SUcCeS188]

Payments: Stripe PaymentIntents + signed webhooks.

Card data never touches my server — Stripe handles that directly. My backend only finds out a payment succeeded when Stripe sends a cryptographically signed webhook confirming it. No "trust the frontend" shortcuts.

[Resa loves code @SUcCeS188]

Orders run inside real database transactions.
If one item in a multi-item order fails to insert, the entire order rolls back no half-created orders sitting in the database. Prices are always recalculated server-side too, never trusted from the client.

[Resa loves code @SUcCeS188]

Orders run inside real database transactions.
If one item in a multi-item order fails to insert, the entire order rolls back no half-created orders sitting in the database. Prices are always recalculated server-side too, never trusted from the client.

[Resa loves code @SUcCeS188]

The part that took the most care: BOLA protection (Broken Object-Level Authorization).
Every "get my order" / "delete my address" query is scoped by the authenticated user's ID server-side never trusted from the URL.
Tested it by literally trying to steal another account's data.

[Resa loves code @SUcCeS188]

The part that took the most care: BOLA protection (Broken Object-Level Authorization).
Every "get my order" / "delete my address" query is scoped by the authenticated user's ID server-side never trusted from the URL.
Tested it by literally trying to steal another account's data.

[Resa loves code @SUcCeS188]

Auth was the first real challenge:

• bcrypt password hashing (never plain text)

• short-lived JWT access tokens (15 min)

• long-lived refresh tokens, stored server-side so they can actually be revoked

• soft-delete accounts that instantly kill every active session

[Resa loves code @SUcCeS188]

Auth was the first real challenge:

• bcrypt password hashing (never plain text)

• short-lived JWT access tokens (15 min)

• long-lived refresh tokens, stored server-side so they can actually be revoked

• soft-delete accounts that instantly kill every active session

[Resa loves code @SUcCeS188]

Here's the actual request flow. Every request passes through Helmet, CORS, rate limiting, JWT verification, and ownership checks before it ever touches the database.

Nothing gets trusted by default not the client, not the price, not the user ID in the URL.

[Resa loves code @SUcCeS188]

Here's the actual request flow. Every request passes through Helmet, CORS, rate limiting, JWT verification, and ownership checks before it ever touches the database.

Nothing gets trusted by default not the client, not the price, not the user ID in the URL.

[Resa loves code @SUcCeS188]

Started with the absolute basics: npm init, a single Express route, app.listen().

Then layered in PostgreSQL, proper folder structure (routes/controllers/models), and never looked back.

By the end: 8 database tables, 25+ endpoints.

[Resa loves code @SUcCeS188]

Started with the absolute basics: npm init, a single Express route, app.listen().

Then layered in PostgreSQL, proper folder structure (routes/controllers/models), and never looked back.

By the end: 8 database tables, 25+ endpoints.

[Resa loves code @SUcCeS188]

I built a full pizza ordering backend from scratch.
Node.js + Express + PostgreSQL + Stripe.

A #thread on what's actually in it

[Resa loves code @SUcCeS188]

I built a full pizza ordering backend from scratch.
Node.js + Express + PostgreSQL + Stripe.

A #thread on what's actually in it

[Resa loves code @SUcCeS188]

@ltamhn Happy to connect

[Resa loves code @SUcCeS188]

@ashuuu_soft Hi happy to connect

[GitHub @github]

Today is for the programmers 🍻

[Resa loves code @SUcCeS188]

Also learned the hard way

if you change a value in .env, you MUST restart the server. Node doesn't hot-reload env vars. Chased the same "secret mismatch" bug three separate times because I kept forgetting this.

[Resa loves code @SUcCeS188]

Building something, proving it works, then cutting it anyway because the tradeoff isn't right that's #engineering too, not just shipping features

[Resa loves code @SUcCeS188]

Building something, proving it works, then cutting it anyway because the tradeoff isn't right that's #engineering too, not just shipping features

[Resa loves code @SUcCeS188]

Got the whole pipeline working end-to-end on a live call. Then I killed it.

The voice sounded too generic once I actually heard it in a real conversation not worth the extra latency it added to every sentence. Reverted to a standard, faster voice instead.

[Resa loves code @SUcCeS188]

Got the whole pipeline working end-to-end on a live call. Then I killed it.

The voice sounded too generic once I actually heard it in a real conversation not worth the extra latency it added to every sentence. Reverted to a standard, faster voice instead.

[Resa loves code @SUcCeS188]

Real bug I hit: ffmpeg reading from a pipe (not a file) can't auto-detect the input format from a file extension — it has to guess. It guessed wrong. Output was garbled gibberish.

Fix: one flag. -f mp3 before the input, telling ffmpeg explicitly what it's receiving.

[Resa loves code @SUcCeS188]

Real bug I hit: ffmpeg reading from a pipe (not a file) can't auto-detect the input format from a file extension — it has to guess. It guessed wrong. Output was garbled gibberish.

Fix: one flag. -f mp3 before the input, telling ffmpeg explicitly what it's receiving.

[Resa loves code @SUcCeS188]

Real bug I hit: ffmpeg reading from a pipe (not a file) can't auto-detect the input format from a file extension — it has to guess. It guessed wrong. Output was garbled gibberish.

Fix: one flag. -f mp3 before the input, telling ffmpeg explicitly what it's receiving.

[Resa loves code @SUcCeS188]

The hardest part: custom Nigerian-accent voice.
Vapi's custom voice API wants raw 16-bit PCM audio, no headers, exact sample rate. My TTS provider (YarnGPT) returns mp3.

So I built a Node service: text → YarnGPT → mp3 → ffmpeg conversion → exact PCM Vapi needs streamed live.

[Resa loves code @SUcCeS188]

The hardest part: custom Nigerian-accent voice.
Vapi's custom voice API wants raw 16-bit PCM audio, no headers, exact sample rate. My TTS provider (YarnGPT) returns mp3.

So I built a Node service: text → YarnGPT → mp3 → ffmpeg conversion → exact PCM Vapi needs streamed live.

[Resa loves code @SUcCeS188]

Then I went adversarial on my own system before calling it done deliberately tried to break it with misheard speech, interruptions, unavailable items, incomplete payloads.

Found a real gap (allergen enforcement was prompt-only) and fixed it before moving forward.

[Resa loves code @SUcCeS188]

@bas_karo_anaya Hello let's connect

[Resa loves code @SUcCeS188]

Then I went adversarial on my own system before calling it done deliberately tried to break it with misheard speech, interruptions, unavailable items, incomplete payloads.

Found a real gap (allergen enforcement was prompt-only) and fixed it before moving forward.

[Resa loves code @SUcCeS188]

Allergy safety was the part I cared about most. It's not enough to tell the model "warn about allergies" in a prompt models can slip.

So I made the backend itself reject adding a conflicting item unless the model explicitly passes an acknowledgment flag after warning the user.