Yemera — Enterprise B2B Wholesale Distribution Platform & CMS

Overview

Overview

Overview & Real-World Problem: Yemera is a high-volume cold-chain wholesale food producer in Ankara supplying hotels, bakeries, and retail chains. Previously reliant on manual phone calls, WhatsApp messages, and paper invoices, the business required a dedicated, fast, and multi-lingual digital platform with an administrative CMS to streamline wholesale buyer inquiries and product catalogs without recurring SaaS subscriptions. Architecture & System Design: Built following Clean Architecture to maintain complete separation of concerns and framework independence: - Domain Layer: Pure business entities, audit tracking (BaseAuditableEntity), and global soft-delete filtering. - Application Layer: Orchestrates business rules, interfaces, FluentValidation pipelines, and Mapster DTO mappings without direct ORM dependencies. - Infrastructure Layer: EF Core repository implementations with DbContext pooling, split-query translations, and MailKit SMTP. - Presentation Layer (Web API): RESTful endpoints hardened with ASP.NET Core Output Caching, rate limiting middleware, and dynamic SEO injectors. Key Engineering Decisions & Highlights: 1- Instant JWT Revocation without DB Bottlenecks: Implemented a hybrid SecurityStamp and in-memory cache validation pattern on OnTokenValidated. When admin credentials change, all active tokens across devices are revoked immediately without querying the database on every incoming request. 2- Sub-Millisecond Catalog Reads: Leveraged ASP.NET Core Output Caching with tag-based invalidation (EvictByTagAsync). Public catalog traffic bypasses database execution and controller allocations entirely, serving responses in under 1ms while remaining instantly fresh upon admin edits. 3- Social SEO & OpenGraph for React SPA (Zero Node.js SSR Cluster): Engineered an in-memory SPA fallback pipeline in ASP.NET Core that dynamically injects localized meta tags and platform-tailored OpenGraph image headers directly into index.html for crawlers (WhatsApp, LinkedIn, Twitter, Google). 4- Client & Server Media Defense Pipeline: Automated client-side image compression (under 500KB) and HEIC/iPhone conversion, backed by server-side Magic-Byte validation to eliminate MIME spoofing and stored XSS risks. 5- Multi-Tier Security & Rate Limiting: Configured 4-tier rate limiters (Global, Auth, Contact, and Strict) alongside strict HTTP security headers (CSP, X-Frame-Options: DENY, and server banner cloaking).