A story for CTOs, leads, and the curious engineers who asked “how did you ship that without fires?”

‍

Oracle NetSuite’s sales reps were losing a chunk of every workday to a painfully slow gifting flow. Our brief was blunt: tighten the entire process until it feels instant, keep costs down, and don’t break security rules. We had six weeks.

Day one: choose the stack

We grabbed an open source UI library, bolted it onto React for the front end, Express for the back, and let Shopify carry the product catalogue. The open-source route spared us licence drama and kept the codebase familiar to any future engineer Oracle or Social Imprints might hire. Additionally, open‑source libraries evolve faster than enterprise stacks, which meant we could ship stable code without waiting for a quarterly patch cycle.

‍

Project tech stack we chose

• React (front-end) wired to an open source Tailwind-based UI kit
• Node.js + Express (back-end service layer)
• Shopify Storefront API
  
  • GraphQL for new endpoints
  • REST for legacy calls, both wrapped in one custom adapter
• Oracle SSO user import with optional password-less code login
• USPS address-validation API
• Self-healing webhook heartbeat (Node cron job)
• GitHub Actions CI/CD pipeline — auto-deploy to staging, single-click to prod
• AWS host trimmed post-launch to cut monthly spend (no vendor lock-in)

‍

But open source gave us a surprise. The UI kit offered gorgeous Tailwind markup yet zero ready‑made React components. We kept the markup, rewired the states, and moved on. The trade‑off bought speed without locking anyone into a vendor‑specific framework.

‍

Two problems big enough to derail the schedule

GraphQL meets REST. Shopify splits its data across two APIs. GraphQL covers the shiny new stuff, REST stubbornly clings to legacy endpoints. Neither side could give us every call we needed. We built a lightweight adapter that calls GraphQL when possible, REST when necessary. The switch sits behind a single flag, so future deprecations won’t hurt.

‍

High‑speed dashboards. Reps wanted live numbers on allocations and shipment status. Poor indexing or chatty queries would choke the page. We cached heavy reads, pushed deltas through webhooks, and kept average load times under 200 ms even on end‑of‑quarter spikes.

‍

Self‑healing webhooks: the quiet hero

Shopify loves to drop webhooks without warning. No email, no log, just a missing order update at 3 a.m. We added a heartbeat that pings every ten minutes. If a webhook is missing, the service re‑registers it and back‑fills any lost events. No pager duty, no angry client emails. That single script has run for a year without human help.

‍

Address checker that pays for itself

Invalid addresses used to cost Social Imprints about a $1000 a week in return fees. We integrated a USPS validator that blocks PO boxes for perishable items and auto‑suggests corrections. Returns fell to near zero, saving roughly six grand a year—more than the validator’s licence by a long shot.

‍

Authentication that doesn’t annoy people

Oracle never opened SSO to us, so we imported every authorised user into Shopify, hid the Shopify UI, and let reps reset passwords or use one‑time codes. When Oracle flips the SSO switch, we swap a middleware and the world keeps turning.

‍

CI/CD that just works

GitHub Actions deploy front‑end and back‑end independently on every push to main. No Jenkins, no manual steps. Staging gets an automatic URL; production deploys need a human click. The flow kept releases boring and let the team cut server size down a notch, saving Social Imprints about $500 a month.

‍

One year later: is it still healthy?

• Zero downtime outside planned releases.
• One mandatory Shopify API upgrade took a one‑week sprint.
• Server utilisation dropped enough to downsize, yet response times stayed under 250 ms.
• Order volume hit 120 000 without chaos.

‍

What we would build next

Cleaner filters, smarter defaults, AI‑driven product suggestions, and deeper CRM hooks once Oracle opens SSO. All of it fits the existing stack, no rebuilds required.

‍

Takeaways for teams with a four‑week deadline

1. Use the stable versions of open‑source tools your client’s engineers already know.
2. Loop in security and compliance during week one, not week four.
3. Document deprecation calendars (Shopify’s six‑month rhythm saved us panic).
4. Add self‑recovery to every third‑party integration—you will sleep better.

‍