A 4-tier RBAC inventory management system for a LATAM tire retailer — 5,000+ SKUs across 4 warehouses, built mobile-first, compliance-ready, and permanently hardened against data mutation.
The client ran a multi-location tire and rim enterprise with 5,000+ SKUs across four warehouses — and Excel spreadsheets were the database. Every SKU mutation was irreversible. There was no movement history, no approval chain, no compliance surface.
Three structural failures compounded each other. First, no audit trail: zero record of who changed what, when, or why — compliance review was impossible and disputes had no source of truth. Second, flat permissions: every user had the same access level, so catalog staff could overwrite master product identifiers that should have been immutable. Third, no machine auth: point-of-sale systems needed machine-to-machine access to inventory data without session-based auth, and no secure API key system existed.
The fix could not be a spreadsheet with better locking. It had to be a system where data integrity is enforced by the server — not by trust, training, or UI hiding.
The system is built around a single inviolable rule: the master SKU identifier — CODIGO_MACRO — is generated once and never modified. Every write flows through the same enforcement chain, and every layer in that chain exists to protect that constraint.
| Role | Product Edit | User Management | Audit Log | API Keys |
|---|---|---|---|---|
| SUPERADMIN | Full (incl. locked fields) | Create / revoke all | Full read | Issue / revoke |
| ADMIN | Whitelist fields only | Manage non-superadmin | Full read | View only |
| MANAGER | Whitelist fields only | No access | Filtered read | No access |
| CATALOG | Description fields only | No access | No access | No access |
The permission matrix is enforced at the API boundary, not in UI rendering. A catalog user who crafts a raw PATCH request against a locked field gets the same rejection as one who clicks a button that doesn't exist. The whitelist is the contract; the interface is just a courtesy.
Every architectural choice below is rooted in compliance, scale, or the operational reality of warehouse staff working from phones on a shop floor.
Browser users authenticate via Keycloak 26 JWT tokens (RS256). POS terminals and machine-to-machine integrations use Authorization: ApiKey sk_... headers — with only SHA-256 hashes stored in the database. Raw keys are shown once at issuance and never persisted, so a database leak yields no usable credentials.
Every product mutation writes an audit record with USER_SUB, action, entity type and ID, a payload diff, source IP, warehouse, and timestamp. The log is append-only by construction — no delete API exists. Compliance review went from impossible to a filtered query.
Product completeness (pct_avance) is computed server-side from 14 mandatory spec fields on every read and delivered as a derived field. It is never written to the database, so it can never go stale, drift, or be manually fudged.
The commercial description is assembled automatically on write from structured spec fields — size, brand, model, load index, speed rating, vehicle type, technology, sidewall, construction, ply. No free-text field means no free-text pollution, and downstream catalogs stay machine-parseable.
Breakpoints are enforced at 1024px, 768px, and 375px, with the sidebar switching to an overlay pattern via a class-toggled scrim. Warehouse staff operate the full system from phones in the field — the desktop layout is the adaptation, not the phone layout.
All product and inventory reads flow through TanStack Query v5 with stale-while-revalidate semantics, and mutations apply optimistic updates. On the slow mobile networks warehouse staff actually have, the UI stays responsive while the cache reconciles in the background.
Built in a single sprint from discovery to Phase 1 complete — architecture, backend, frontend, auth, and mobile. Every number below is enforced by the server, not by policy documents.
The PATCH whitelist strips the master SKU identifier from every write payload before it reaches the store. Zero mutations post-creation is not a policy — it is a property of the request pipeline. Catalog staff, admins, and even superadmins operating through the API face the same wall, which means downstream systems keyed on that identifier never break.
Every mutation is logged with actor, IP, payload diff, and warehouse. Disputes that previously had no source of truth now resolve with a single query against an append-only record.
The 4-tier hierarchy lives in server middleware, not component visibility. Hiding a button was never the security model — rejecting the request is.
Hashed API keys gave point-of-sale systems a clean machine-to-machine path into inventory data — issuable and revocable by superadmins, with no raw secrets at rest.
The 375px floor means the system works on the phones warehouse staff already carry — no tablets to procure, no desktop-only workflows bottlenecking the receiving dock.
I build systems where data integrity is a server-enforced property, not a training document.
Let's Work TogetherEnterprise inventory management running live — structured spec entry with auto-generated master IDs and per-country code lookups.
PRODUCT ENTRY — SPEC FIELDS + AUTO MASTER ID
COUNTRY CODES — REFERENCE LOOKUP