Senior Full-Stack Engineer – Next.js 16 / TypeScript / MongoDB / Meta WhatsApp Cloud API

Overview & Project Context We are seeking an experienced Senior Full-Stack Engineer to take ownership of ongoing engineering, integrations, scaling, and operational reliability for Koh Vitals, a high-performance, direct-to-consumer e-commerce and wellness platform built on modern web and cloud architecture. This is not a standard template site or basic CRUD application. Koh Vitals is a production-grade, event-driven web application featuring: 1: A strictly decoupled service-oriented backend with asynchronous job queuing and outbox patterns 2: Meta WhatsApp Business Cloud API and transactional email workflows with interactive URL button tokenization 3: A multi-tier checkout and discount calculation engine supporting granular product/category restrictions, spending thresholds, and discount caps 4: Sequential atomic order numbering, token-secured passwordless customer tracking/confirmation portals, and automated cron-based order lifecycle management 5: Real-time automated content moderation using aggregation pipelines and rule-based keyword filters 6: A protected administrative operations portal with secure session management and Cloudinary media pipeline integrations We are looking for a disciplined engineer who writes clean, type-safe code, understands distributed asynchronous architectures, and cares deeply about data integrity, security, and edge-case resilience. Detailed Technical Scope & Responsibilities 1. Frontend Engineering Maintain and enhance responsive, highly dynamic user interfaces using React 19, Next.js (App Router), TypeScript, and Tailwind CSS. Optimize client state management across shopping carts, wishlists, and multi-tier checkout summaries with live coupon re-validation. Maintain micro-animations, accessible UI primitives (Radix UI), custom forms with React Hook Form and Zod validation, and rich-text integrations (Tiptap). Maintain tokenized, state-driven customer interfaces including real-time order confirmation, order cancellation dialogs, and visual milestone shipment timelines. 2. Backend Architecture & Domain Services Maintain and extend decoupled domain services (OrderService, CouponValidationService, MessageJobService, WhatsAppService, EmailService). Build clean, RESTful API Route Handlers and Next.js Server Actions with strict input parsing, duplicate key handling, and standardized API error/response formatting. Enforce state machines across the order lifecycle (PENDING ➔ CONFIRMED ➔ PROCESSING ➔ SHIPPED ➔ DELIVERED, with terminal CANCELLED and EXPIRED states). 3. Database Architecture & Data Integrity Work with MongoDB and Mongoose, writing structured schemas, compound indexes, subdocuments, lean queries, and aggregation pipelines. Ensure race-condition-free document sequencing (e.g., atomic counters via $inc and findOneAndUpdate for sequential human-readable order IDs). Maintain rating and review aggregation pipelines that calculate average ratings and review counts dynamically across approved catalog items. 4. Authentication, Security & Tokenization Maintain secure admin authentication utilizing bcrypt password hashing, jose JWT session tokens, and strict HttpOnly / SameSite cookie handling. Maintain route proxy and middleware guards for administrative workspaces. Enforce passwordless, cryptographically signed tokenization (HS256) for customer operations (order confirmation, order tracking, and post-checkout success views) without requiring intrusive user account friction. 5. Order Processing & Discount Engine Maintain atomic order creation: validating live stock status, calculating product variant pricing, applying tiered delivery rates, and calculating shipping threshold waivers. Support a multi-scenario discount coupon engine supporting percentage, fixed monetary, and free shipping discounts with constraints (start/expiry dates, global usage limits, per-order caps, minimum spend thresholds, and category/product whitelist scopes). 6. Notification Infrastructure & Outbox Queue Maintain an asynchronous Transactional Outbox Queue (MessageJobService) that offloads external communication from the HTTP request path. Utilize distributed message scheduling (Upstash QStash) to trigger decoupled worker endpoints with signed webhook authentication. Implement structured exponential backoff retries (8-step schedule ranging from immediate to 12 hours) with failure tracking and dead-letter classification (DEAD). 7. Third-Party Integrations & Webhooks Meta WhatsApp Cloud API: Maintain template dispatching (order_confirmation, order_confirmed, order_cancelled) with dynamic parameter injection and interactive URL button payloads; manage incoming webhook verification with HMAC SHA-256 signature verification (crypto.timingSafeEqual) and customer support redirection. Email System: Maintain transactional emails via Resend and React Email, rendering responsive, branded order receipts and status notifications. Payment Gateways: Maintain Cash on Delivery (COD) workflows and finalize/extend online payment gateway integrations (Safepay, Rapid Gateway) including payment verification and webhook signature validation. Media Pipelines: Manage Cloudinary asset uploads, transformations, and schema mapping. 8. Administrative Operations & Content Moderation Maintain the admin dashboard for catalog management (multi-size variant pricing matrices, rich-text FAQs, ingredients, and inventory controls). Maintain coupon management, order status transitions (e.g., mark as shipped), and review moderation. Maintain rule-based automated review moderation filtering out health/medical claims, adulteration buzzwords, and promotional spam prior to review approval. Reliability, Concurrency & Engineering Standards Idempotency & Concurrency: Prevent duplicate order transitions, duplicate sequence generation, and invalid state mutations. Cryptographic Security: Enforce constant-time HMAC signature verification across all incoming webhook requests to prevent timing attacks. Type Safety & Validation: Strict TypeScript compilation with zero type errors (tsc --noEmit), pairing schema validation on both client and server via Zod. Clean Code: Consistent architecture following separation of concerns (Controllers ➔ Services ➔ Data Models ➔ Mappers). Required Skills & Experience Senior-level full-stack experience (3+ years) building and maintaining production TypeScript and Node.js / Next.js applications. Deep proficiency in Next.js (App Router), React 19, Server Actions, Route Handlers, and Middleware. Strong MongoDB / Mongoose experience, including aggregation pipelines, atomic updates, and indexing strategies. Hands-on experience with Event-Driven Architecture & Message Queuing (Outbox patterns, job workers, background task retry mechanics, QStash/Redis/BullMQ). Proven track record with WhatsApp Business Cloud API / Meta Graph API and webhook integrations. Experience with Transactional Email systems (Resend, React Email, SendGrid). Solid grasp of Web Security: JWT (jose), CSRF/CORS, HttpOnly cookies, HMAC SHA-256 signatures, and constant-time string comparisons. High standards for software quality: Strict TypeScript adherence, Zod validation, and clean error handling. Application Instructions To be considered, please submit a proposal outlining: 1: Relevant Experience: Briefly describe 1–2 production projects where you built or maintained distributed asynchronous queues, WhatsApp/Meta Cloud API integrations, or high-volume checkout systems. 2: Technical Approach: How do you typically handle idempotency and failure recovery when integrating third-party messaging/payment webhooks? 3: Availability & Workflow: Your current weekly availability and timezone. (Please skip generic cover letters; we value specific technical insights over marketing summaries).