Book Seller · Three-tier synthesis

Book Seller Marketplace

Persist first, select one seller, hold inventory, authorize payment, confirm fulfillment, then capture. Every external call carries a stable idempotency key and every ambiguous result is reconciled.

InputISBN + max price
Scale10K QPS
External systemsSellers + payment
InvariantOne order, one charge

Tier 1 · Core

  1. Seller registration records endpoints, auth references, limits, and health.
  2. Order API persists the request and dispatch record atomically.
  3. A queue or durable workflow isolates seller latency.
  4. Candidate selection uses live quotes or a maintained offer catalog.
  5. Seller hold establishes current price and inventory for a short TTL.
  6. One atomic claim chooses the winner.
  7. Payment authorization precedes seller confirmation; capture completes the charge.
  8. Order state and provider webhooks reconcile retries and crashes.

Canonical state

PENDING → SEARCHING → COMMITTINGHOLD_PLACED → AUTHORIZEDSELLER_CONFIRMED → CAPTURED → COMPLETED

Tier 2 · Choices

PricesLive fan-out gives freshness; an offer catalog bounds external QPS.
Queue keyISBN preserves order; order ID spreads load; author ID creates unrelated contention.
InventoryOne local writer controls platform stock; seller holds control stock sold elsewhere.
WinnerDB compare-and-set or one workflow identity provides exclusivity.
PaymentPlatform-managed authorization and capture supports coordinated settlement; seller-managed settlement reduces platform payment ownership.
DispatchOutbox gives atomic intent; a pending-order scanner repairs DB-to-queue gaps.

Never rely on

  • Cached inventory as final availability
  • A Redis cache key as the only correctness lock
  • Queue delivery as exactly once
  • A payment webhook as proof of seller fulfillment
  • Retries without stable provider and seller keys

Tier 3 · Sharp edges

  • Stripe Elements or equivalent tokenizes card data in the client.
  • SCA and 3-D Secure complete before capture-ready fulfillment.
  • Seller OAuth secrets live in a vault; access tokens stay short lived.
  • Webhook signatures, timestamp checks, event IDs, and sequence numbers prevent replay and stale updates.
  • Per-seller token buckets, concurrency caps, backoff, and circuits enforce politeness.
  • Hot ISBN partitions force a fairness versus throughput decision.
  • Late listings turn one-shot orders into standing requests when rematching is supported.

Recall test

  1. What is the inventory source of truth?
  2. What makes the winning seller unique?
  3. What happens when seller confirmation fails after authorization?
  4. Which payment step moves money?
  5. Why can order-ID partitioning be safer for scale?