How we built the DEV3 Kilnfront: tenant isolation that fails closed for a store builder

DEV3 Kilnfront is a store-builder platform you host: merchants build a store from sections and one of five themes and sell on a subdomain or a verified custom domain.

Stack: a single Next.js 16 app with React 19, TypeScript, Tailwind 4 and MongoDB, on a vendored DEV3 Next core.

Decisions that mattered

• A Mongoose plugin adds an immutable orgId to every merchant model and throws TenantScopeError on any query without one. Cross-tenant code is confined to lib/platform/ and scripts/, and a unit test fails the build otherwise.
• Host routing lives in one proxy.ts that strips inbound x-kf-* headers, rewrites slug.base-domain to /store/slug and routes other hosts to a custom-domain route, without touching the database.
• Custom domains need a TXT token and a CNAME or A record. A pending claim never blocks the real owner, and the Caddy tls-ask endpoint answers for verified hosts.
• Checkout is a saga: server-side prices, sorted per-line stock reservation with a conditional $inc, a claimed discount and an idempotent checkout key. Failures undo earlier steps.

Limits: no public live demo; the 12 demo stores are fictional.

Trade-off we chose: the DNS driver can be simulated, which is how tests and the demo run.

Questions welcome.