REST API / Backend
eCommerce Platform
- Python
- Django REST Framework
- PostgreSQL
- JWT
- REST API
Overview
A Django REST Framework backend powering a headless ecommerce storefront: product catalog, cart/checkout, orders, payments, and CMS-driven content sections, consumed by a separate Next.js frontend.
Problem
A storefront needs a backend that can serve product data, handle cart/checkout state, and process orders and payments securely, independent of whichever frontend consumes it.
Solution
A Django REST Framework API with JWT authentication, a PostgreSQL database, and Cloudinary for media, exposing a documented set of REST endpoints consumed by a decoupled Next.js frontend.
Key Features
- Product catalog with search, category/price/stock filtering and sorting
- JWT-based authentication with token refresh
- Cart and checkout flow with order tracking
- Wishlist and product reviews
- CMS-driven content sections served through the API
- Payments integration
Technology Stack
- Python
- Django
- Django REST Framework
- PostgreSQL
- JWT
- Cloudinary
Architecture
Next.js frontend -> JWT-authenticated Django REST Framework API -> PostgreSQL, with a separate payments provider and CMS content sections served through the same API.
Database
PostgreSQL in production, falling back to local SQLite only for local development.
API / Backend
A Django REST Framework API exposing product, cart, order, payment and CMS endpoints, documented in the repo's docs/API.md.
Authentication & Authorization
JWT authentication (obtain/refresh) via a dedicated token endpoint, with a current-user endpoint for the authenticated session.
Security
Debug mode defaults to off unless explicitly enabled, and the app requires a real PostgreSQL connection string in production since the deployment filesystem is read-only outside temp storage.
Challenges
Keeping cart/checkout logic correct and testable while running the same codebase against a read-only production filesystem that can't fall back to SQLite.
What I Learned
Documented directly in the project's own README as concrete next steps identified while building it - see Future Improvements.
Future Improvements
Auto-generated OpenAPI docs (drf-spectacular) instead of a hand-maintained endpoint table, rate limiting on the auth token endpoint to guard against brute-force attempts, and moving cart/checkout logic into a dedicated service layer for easier testing - all noted directly in the project README.