Custom Inventory MVP
Neha Arora
Case Study: StockPilot Inventory Management System
Overview
StockPilot is a full-stack inventory management application built from scratch as a live portfolio piece. It demonstrates a complete production-grade stack: a custom React frontend, a hardened Golang REST API, and a PostgreSQL database hosted on Supabase.
Every page, component, and endpoint was written from scratch. No templates, no starter kits, no copy-pasted dashboards.
StockPilot Dashboard
The Problem
Most MVPs in the $1,900 price range are built on top of templates and boilerplate. The result is a dashboard that looks like every other startup's, and a backend that breaks the moment it receives real traffic.
StockPilot was built to prove a different approach: a fully custom application, architected from the ground up, that handles secure multi-user data, large payloads, and production-grade deployment without cutting corners.
The Approach
Three principles guided the build:
1. Custom Code, No Templates
Every page, component, and API endpoint was written specifically for this project. No UI kits, no starter templates, no copy-pasted dashboards.
2. Data Isolation by Default
Every database query is scoped to the authenticated user at the query level. User A can never see User B's products, categories, or any other data.
3. Hardened from Day One
The API enforces strict request size limits, validates input on every write, and rejects malformed or oversized payloads before they reach the database.
Architecture
The application uses a three-tier decoupled architecture:
Frontend: React with Vite, Tailwind CSS, and Framer Motion
Backend: Golang with Gorilla Mux, GORM, and JWT authentication
Database: PostgreSQL hosted on Supabase
Each tier deploys independently:
Frontend on Vercel (global CDN, always awake)
Backend on Render (512MB free tier, kept alive via external cron pings)
Database on Supabase (direct connection on port 5432)
This separation means the frontend loads instantly worldwide, the backend can be scaled or swapped independently, and the database remains portable.
Features
Authentication
JWT-based authentication with bcrypt password hashing. Tokens are issued with a 24-hour expiry and validated on every protected request. The frontend includes a proactive expiry check that logs the user out automatically when the token expires.
Login Page
Multi-Tenant Data Isolation
Every product, category, and bulk operation is scoped to the authenticated user ID at the query level. Users are completely isolated from each other by design. A registration flood of 8,000+ automated accounts was correctly handled, with each account locked inside its own empty sandbox and zero data leakage between users.
Products Table
Product Management
Full CRUD for products with fields for name, description, quantity, price, and category. The table includes low-stock highlighting (critical below 5, warning below 10) and inline edit and delete actions.
Category Management
Users can create and delete categories, which are linked to products through a foreign key. The edit product page includes a category dropdown populated live from the API.
Categories Page
Bulk Operations
A dedicated page allows bulk creation, bulk update, and bulk deletion of products. When a user selects multiple products on the main page and clicks "Bulk Ops," the full dataset is pre-filled into the bulk editor for fast, spreadsheet-style editing.
Bulk Operations Page
Custom 404 Page
Any invalid route renders a themed 404 page that matches the app's dark UI and Framer Motion animations, keeping the experience consistent even when users navigate to non-existent URLs.
Technical Details
Backend Architecture
The Golang backend exposes 15 endpoints organized into public and protected routes:
Public: health check, register, login
Protected: products, categories, and bulk operations
Every protected endpoint runs through a JWT middleware that extracts the user ID and injects it into the request context. Handlers then scope all database queries using
WHERE user_id = ?.Request Size Limiting
A custom middleware enforces a 5MB limit on all request bodies. Requests with a Content-Length header exceeding the limit are rejected immediately with a
413 Request Entity Too Large response, before the body is read into memory. Requests without a Content-Length are capped by http.MaxBytesReader as a safety net, preventing payload-based denial-of-service attacks from ever reaching the handler.Database Connection Tuning
The app connects to Supabase on the direct PostgreSQL port (5432) rather than the transaction pooler port (6543). This avoids a prepared-statement collision (
SQLSTATE 42P05) caused by PgBouncer reusing connections across statements.Frontend Architecture
The React frontend is a single-page application built with Vite. All pages use Framer Motion for entrance animations and Tailwind CSS for styling. A custom Axios interceptor handles
401 Unauthorized responses by clearing the token and redirecting to login automatically.
Mobile View
Input Validation
Every write endpoint validates input before persisting to the database:
Negative quantities are rejected
Negative prices are rejected
Malformed JSON bodies are rejected with a
400Oversized payloads are rejected with a
413This prevents bad data from ever reaching the database and keeps the frontend reliable regardless of what is sent to the API.
Deployment
The full stack runs on free infrastructure:
Frontend hosted on Vercel
Backend hosted on Render (512MB free tier)
Database hosted on Supabase
Backend kept permanently awake by an external cron job pinging the health endpoint every 5 minutes
Total monthly cost: $0.
What This Demonstrates
StockPilot demonstrates the ability to:
Design and build a complete full-stack application from scratch
Architect secure, multi-tenant APIs with proper data isolation
Harden a backend against oversized payloads and malformed input
Deploy and manage a production-ready stack on free infrastructure
Write clean, maintainable code in React and Golang
It is a live, public demonstration of my abilities as a full-stack developer.
Like this project
Posted Aug 22, 2026
Full-stack inventory MVP for StockPilot: React frontend, Golang API with JWT multi-tenant isolation, and a 950-reload stress-tested backend on a 512MB box.
