02 / 09 · Fintech · E-commerce
Game Verse Store
Serverless game top-up store with bKash / Nagad checkout, admin panel & Telegram ops bot
Overview
Game Verse Store is the official shop of the eFootball Help Arena community. Customers pick a game, choose a platform-aware package, enter their Player ID or login, pay with bKash or Nagad through a ZiniPay hosted invoice, and follow their order live until an operator delivers it. It is 100% serverless: one Next.js 16 app on Vercel backed by Supabase Postgres, with no VPS, Docker, Redis or queue. Every order status change runs through a single state-machine function, customer secrets are AES-256-GCM encrypted and purged 24 hours after a final state, and staff sign in with TOTP MFA.
- Next.js 16
- React 19
- TypeScript
- Supabase
- PostgreSQL
- Drizzle ORM
- ZiniPay API
- grammY
- TanStack Query
- Tailwind CSS v4
- Framer Motion
- Cloudflare R2
- Vitest
- Playwright
- Infrastructure
- 100% serverless
- Payments
- bKash + Nagad
- Delivery
- 5 - 30 min
- Languages
- Bangla + English
Engineering decisions
Order State Machine
One transitionOrder function guards every status change with a conditional update and actor audit, making order handling race-free across admin panel and Telegram.
Encrypted Customer Secrets
Game logins are AES-256-GCM encrypted before insert and automatically purged 24 hours after the order reaches a final state.
Serverless Background Jobs
pg_cron and pg_net drive scheduled cleanup and reconciliation, while Next.js after() delivers emails and bot alerts without a queue.
Tested End to End
Vitest unit and integration suites plus Playwright mobile journeys cover checkout, payment verification and admin delivery.
- 01
Single Next.js 16 App Router app on Vercel: storefront (RSC), MFA-protected admin panel, versioned /api/v1 route handlers, webhooks and cron endpoints.
- 02
Supabase Postgres in a private app schema accessed through Drizzle ORM and postgres.js via the Supavisor pooler.
- 03
ZiniPay hosted invoices for bKash and Nagad, verified server-side by API; the server is the only source of truth for prices and status.
- 04
Every order status change goes through one finite-state-machine function (transitionOrder) with a conditional update, so concurrent operators never double-deliver.
- 05
Supabase pg_cron + pg_net call /api/cron/* on schedule; Next.js after() flushes the notification outbox instantly. No Redis, no queue.
- 06
grammY Telegram bot in webhook mode lets operators see, claim and deliver orders from their phones.
Screens & Walkthrough
Production gallery(6 high-res captures)
Next project