We built DEV3 AI Auctions as a WooCommerce plugin in PHP with a React admin and a small storefront script for the live bid panel. Bidding is split into a pure engine and a service that owns concurrency.
Key design decisions
- A pure bid engine.
Bid_Engine::compute() takes the auction state and one bid and returns the new state, the rows to store (including automatic proxy bids) and who was outbid. No database, no time, no globals, so every auction type is unit-tested directly.
- One MySQL named lock per auction.
GET_LOCK() serialises bids on the same auction while different auctions bid in parallel. Under the lock the service drops the cached state, re-reads it, runs the engine, stores the rows, saves the state and applies soft close, then releases the lock in a finally block.
- Idempotent retries. The storefront sends a random request id with each bid. A second request with the same id, even one that arrives while the first holds the lock, finds the stored bid and returns "This bid was already received" instead of bidding again.
- The closer uses the same lock. Ending an auction, choosing the winner and relisting happen under the auction's lock, so a bid can't slip in while the auction closes.
- Fraud signals, not black boxes. A risk score is built from named signals (same network as the seller, new account, answering other bids within a minute), with IPs stored only as keyed hashes. The admin decides; an AI second opinion receives anonymous signals only.
Architecture
Auctions are a WooCommerce product type with reserve, buy now, fixed or tiered increments, bidding deposits, scheduled start and end, anti-sniping and relisting rules. Bids live in their own table; the visible price is mirrored to WooCommerce's price meta so sorting, filters and feeds work. The bid panel polls faster near the end, keeps a fresh nonce on cached pages, and masks bidder names. Winners pay through the normal checkout, including the block checkout, from the win email or My Account. Dokan and WCFM vendors can list auctions from their dashboards. With the Google Gemini API connected, DEV3 AI drafts listings from product photos, suggests start, reserve and buy-now prices from past auctions, suggests an end time, writes outbid and win emails and gives a second opinion on fraud flags; every result is a draft. The API client, encrypted key storage and usage logs come from a shared core used across DEV3's plugins.