WDI Marketplace

Small UAE sellers need a marketplace presence without running their own e-commerce stack. The operator needs seller onboarding with KYC, product moderation, order splitting across sellers, payouts and returns. Buyers expect one cart, one checkout and order tracking, however many stores they buy from, in English or Arabic.

One Odoo 18 backend owns catalog, orders, stock, invoicing and identity. Two clients sit on one API contract: a Next.js 15 storefront with English and Arabic (RTL) routes, and a Flutter app.

• Buyers: browse, search and wishlist; email OTP sign-up; one cart across many sellers; checkout with address, shipping, payment and review; order tracking, returns and ratings.
• Sellers: a four-step store wizard with KYC documents and payout method, product listing with moderation, fulfilment, earnings and payouts.
• Admin: KYC approval, product approval queue, payouts and returns oversight.
• AI store assistant: a storefront chat grounded in the live catalog, streamed over Server-Sent Events.

I worked with the Flutter and Odoo developers on scope, priorities and code review, ran audit and fix rounds on auth, checkout correctness and security, and handed over all three codebases with API docs and test suites.

1. Odoo as the domain core, with a thin REST layer. About 210 routes across 24 controllers. Orders, stock, invoicing and accounting already worked, so the effort went into the API contract and security.
2. Each store is its own company. Tenant isolation, per-store accounting and order splitting come from Odoo's multi-company model, backed by record rules and ownership checks in every controller.
3. One response envelope with discrete error codes. Both clients branch on codes such as TOKEN_EXPIRED, OUT_OF_STOCK and PRICES_CHANGED, which made token refresh and checkout recovery deterministic.
4. Rotating refresh tokens with reuse detection. A reused token is treated as theft and revokes every session, so "log out everywhere" and password changes take effect immediately.
5. A server-side, grounded AI assistant. The prompt is built from the live catalog, cached, and bounded in size. The provider key never reaches the browser.

Vitest and Playwright journeys on the web, Odoo tests and a live endpoint-security suite on the backend, 27 unit and widget tests plus 16 device runs on mobile, all in one GitHub Actions workflow.