013-step OTP password reset flow with Redis TTL expiry and brute-force protection
02AES-256-CBC encryption for phone numbers at rest, bcrypt with 12 rounds for passwords
03Address book with add, list, update, delete, and default address logic (max 10 per user)
04Product rating auto-recalculated as average after every add, update, or delete review
05Wishlist with duplicate prevention via unique DB index on (user + product)
06Cart with automatic totalPrice recalculation and quantity removal guard
07Coupon system supporting percentage and fixed-amount discounts with per-user usage tracking
08Cash on Delivery and Stripe Checkout Session order flows with webhook handler
09Duplicate webhook event protection via stripeSessionId
10Order cancellation at pending or confirmed status with automatic stock and coupon restoration
11Automated order lifecycle via node-cron: pending to confirmed after 6h, confirmed to shipped after 24h
12Rate limiting: 200 requests per 15 minutes per IP