Gian Barboza. Gian Barboza — Senior Backend Engineer & Software Architect

Built with TypeScript, React and Next.js, with a backend separated into domain, application and infrastructure layers. PostgreSQL persistence uses Drizzle ORM on Neon. Auth.js handles Google OAuth and email sign-in through Resend; ownership authorization controls property management, and access to publisher contacts is rate-limited.

The image pipeline uses signed Cloudflare R2 uploads with validation, Sharp-generated WebP derivatives and perceptual duplicate detection. Lifecycle emails, retry handling and scheduled cleanup cover background operations. Vitest unit and integration tests and Playwright browser tests include JavaScript-disabled flows, with GitHub Actions checks for types, coverage, builds and integration.

Every provider sits behind a single payment contract. Each integration adapts its own API — different auth, field names and error shapes — into normalized request and response objects, so the rest of the platform charges, refunds or voids without knowing which processor is on the other side.

Selection and behaviour are decoupled through design patterns: a Factory resolves which integration to build, Strategy lets each provider carry its own behaviour behind the shared contract, Adapters absorb the per-API differences, a Builder assembles the more complex provider requests, and a Repository keeps transaction persistence out of the payment logic. Routing is configuration, not code — active provider and priority chain per product — with automatic failover when the active one fails or rejects. Five processors integrated end to end (PayPal, Payeezy, DLocal, Stripe, Shift4) with 3DS, refunds, voids, Apple Pay, Google Pay and in-house card tokenization.

Separated the evaluator from the rules. A Factory builds each rule, every rule owns a single responsibility, self-registers, and receives an already-normalized context — so adding a pattern means adding a class, never editing the engine. Access fraud runs as its own layer on device fingerprinting, keeping session signals (multi-account abuse, account takeover) out of the transactional path.

Also prototyped LLM-based contextual evaluation, imitating how a support agent decides. It stayed in beta and never reached production.

Redesigned it as an 8-server distributed architecture on DigitalOcean, separating web, database and dev tiers so no workload could starve another. HAProxy for HTTP load balancing, MySQL master-slave replication for read capacity and standby, node-level failover, automated backups and recovery runbooks.

The trade-off: the legacy stack could not be provisioned automatically, so the topology was built by hand over Linux — slower to stand up, but it removed the single point of failure without rewriting the application first. Led a team of 4 through the migration.