Small clothing brands in the Philippines mostly sell through direct messages. Sizes, stock, shipping fees, and who has actually paid all live in a chat thread and somebody's memory, and the whole thing quietly falls apart the moment a drop does well. I built Antiguo a real storefront — and, more importantly, the back office behind it.
What I built
The storefront and the admin are one React application on Supabase. Customers register an account, browse collections, and check out; their delivery details are remembered between orders, and their full order history sits at /account. Requiring an account before checkout was a deliberate choice — it turns a repeat buyer into a record the brand can actually recognise, which is exactly what selling over DMs never gave them.
The back office
The admin is where the real work went. Orders move through pending, paid, shipped, and done, with cancellation as its own state. Customers are listed with their order count and total spent. Products support full editing with image upload, where the first photo is the card and the second is the hover, alongside sizes, compare-at pricing, and sold-out and visibility flags. Collections can be promoted to homepage sections, the hero slideshow is uploadable and reorderable, shipping rates by region drive the actual checkout fee, and each garment gets its own size chart. Nothing about the store is a code change.
Security in the database, not the UI
This is a storefront, so the frontend ships only the publishable key and every guarantee lives underneath it. Only accounts flagged as admin in the profiles table can reach the admin area or modify catalog data, and that is enforced by row-level security in Postgres — hiding the route would not have been protection, it would have been decoration. Customers can read the catalog and their own orders, and nothing else.
One honest limitation: there is no online payment gateway yet. Checkout records the method as GCash, bank transfer, or cash on delivery, and an admin marks the order paid once it clears. That was intentional — those are the rails the brand already collects on, and the problem worth solving first was the manual tracking around them, not the payment itself. Adding a gateway later is a change to one step, not to the system.