Serverless E-commerce Web App Development

Here is the complete, compiled Phase 1 Project Brief for souk.com. You can copy and paste this directly into your Request for Proposal (RFP) or developer contract to ensure every technical standard, security measure, and localization rule is strictly enforced.
# Technical Requirements Brief: souk.com (Phase 1)
## 1. Core Architecture & Performance Standards
* **Infrastructure:** The backend must utilize a **Serverless architecture** (e.g., AWS Lambda, Google Cloud Functions) to scale automatically and minimize idle costs.
* **Database Schema & Indexing:** Use a standard relational (PostgreSQL) or NoSQL (MongoDB/DynamoDB) database. All product schemas must be strictly indexed from day one to allow seamless migration to a dedicated search engine (like Elasticsearch) in Phase 2.
* **Asset Delivery:** All media (product images, banners) must be served via a **Content Delivery Network (CDN)** utilizing automated WebP compression and dynamic resizing.
* **Frontend Smoothness (60 FPS):** The application must sustain a minimum of 60 Frames Per Second (FPS) on mid-range devices. All heavy processing (data sorting, JSON parsing) must execute on background threads.
* **Perceived Speed:** Developers must implement aggressive "Lazy Loading" for product lists, proper State Management to prevent full-page reloads, and Skeleton Loaders for all network requests to ensure a fluid UI.
## 2. Localization & Language Defaults
* **Arabic by Default (RTL):** The application must be configured with Arabic (ar) as the default primary locale. On the very first launch, the app must bypass the device’s system language and initialize immediately in Arabic with a fully rendered Right-to-Left (RTL) UI layout.
* **Dynamic UI Mirroring:** Developers must strictly use Directional/Logical Properties (e.g., paddingStart, AlignmentDirectional) instead of hardcoded left/right values. All directional icons must flip automatically based on the active language.
* **Language Toggle:** The app must include a toggle to switch to English (LTR). Toggling the language must save the preference locally and execute a soft restart of the app to ensure layout alignment renders flawlessly.
* **Localized Database Fields:** The backend catalog must support localized JSON fields for dynamic language fetching (e.g., "name": {"ar": "...", "en": "..."}).
## 3. Payment Gateway: SyriaCash Integration
* **Exchange Rate Engine:** The backend must include a centralized module for administrators to update the daily USD to SYP exchange rate.
* **Dynamic Conversion:** The server must calculate the final SYP cart total at checkout based on the USD listings before handing the user off to the payment gateway.
* **Webhooks & Deep Linking:** Payment verification must rely exclusively on secure **Server-to-Server Webhooks** from SyriaCash. The app must use deep linking to bounce the user seamlessly back to the "Order Confirmed" screen.
## 4. Milestone-Based Logistics & Tracking
To optimize infrastructure costs and battery life, souk.com will utilize milestone tracking rather than live GPS maps.
* **Status 1: Order Confirmed** (Triggered by SyriaCash webhook).
* **Status 2: Processing** (Triggered by warehouse packing).
* **Status 3: Out for Delivery** (Triggered by driver scanning the morning manifest. Triggers the Morning OTP).
* **Status 4: Delivered** (Triggered by driver validating the OTP at the doorstep).
## 5. Security: Conditional Proof-of-Delivery (OTP)
* **Threshold Trigger:** If the cart value is strictly **greater than $50 USD**, the server must require a Delivery OTP.
* **Morning Generation:** The 6-digit OTP must be generated server-side *only* when the status changes to "Out for Delivery".
* **Time-to-Live (TTL):** The OTP must remain valid for **14 hours**.
* **Offline Verification Mode:** The driver/logistics app must download a hashed version of the OTP in the morning. This ensures the driver can still verify the customer's code at the doorstep even if the driver loses 4G cellular connection.
* **Fraud Lockout:** The driver’s app must lock the "Complete Delivery" button. If a driver inputs an incorrect OTP 3 times, the app must lock the order and trigger an alert to souk.com dispatch.
## 6. Communications: WhatsApp & SMS
* **Primary Channel (WhatsApp API):** Developers must integrate an official Meta Business Solution Provider (BSP) linked to a UAE-registered entity and phone number. This API will send pre-approved, automated Arabic/English templates for order updates and OTPs to Syrian customers (+963).
* **Secondary Channel (Local SMS Fallback):** If the WhatsApp message fails to deliver within 60 seconds (or the user does not have WhatsApp), the backend must automatically fall back to routing the OTP via a local Syrian bulk SMS gateway.
* **Rate Limiting:** All user-triggered OTP requests must be strictly rate-limited (e.g., max 3 requests per 30 minutes) to prevent SMS toll fraud.
## 7. Deliverables & Quality Assurance (QA)
Before final sign-off and payment, the developers must provide:
1. **Performance Profiling Report:** Proof of 60 FPS performance on a mid-range Android benchmark device.
2. **Load Test Report:** Proof that the serverless functions and database can handle 1,000 concurrent simulated users browsing 50,000 mock listings without latency spiking above 300ms.
3. **Failure Path Demo:** Live demonstration of the app's behavior during a rejected SyriaCash transaction and an offline network drop during driver OTP verification.