01Signup with OTP confirmation, JWT access tokens (1h) and refresh tokens (1y)
02OTP rate limiting via Redis: max 3 attempts with 5-minute block
03Role-based access control with AuthenticationGuard and AuthorizationGuard via @SetMetadata
04Repository Pattern with generic BaseRepository<T> keeping services decoupled from the database
05Full product CRUD with main image and up to 5 sub-images on AWS S3 with automatic S3 rollback on failure
06Cart with real-time stock validation, per-item quantity controls, and automatic subTotal calculation
07Coupon system with per-user usage tracking, validity dates, and two discount types (percentage and fixed)
08Cash on Delivery and Stripe Checkout Session order flows
09Stripe webhook listener for checkout.session.completed with duplicate event protection via stripeSessionId
10Refund flow restoring stock, removing coupon usage, and unlocking cart
11Atomic stock deduction with $gte conditional update to prevent overselling
12Rate limiting: 100 requests per 60 seconds per IP via @nestjs/throttler