Ū Skin Store

A cosmetics and dermo-pharmacy store for Ū Medicina Estética, where part of the catalogue can only be bought with a code the clinic hands out. Custom Liquid theme, a purpose-built gating app using Shopify Functions, and a catalogue loaded by scripts instead of by hand.

The problem

The clinic wanted to sell online the products it already recommended in consultation, but selective-distribution brands don't allow selling them to just anyone: if the product is one click away for everybody, the agreement with the brand is broken. The usual storefront trick — hiding the product in the theme — doesn't cut it: anyone with the direct link or the API still reaches the cart. And the catalogue was thousands of references in a spreadsheet, impossible to enter by hand.

The solution

The theme had been started by another developer on top of Prestige, but none of the Shopify configuration was in place and what little existed was wrong, so nine tenths of what is there now is mine. What is entirely mine is the gating, and that is where the real work is: three layers, with validation living outside the theme. The theme only hides and warns; the single layer that validates a code is an App Proxy endpoint that verifies Shopify's HMAC signature, and the grant is stored on the customer (a metafield) rather than the cart, so it can't be lost or forged. The last word belongs to a Validation Function running inside Shopify, which blocks checkout even if someone bypasses the whole front end. Codes are hashed with scrypt plus a pepper, with attempt limits per customer and per IP. Alongside that, Python scripts classify the catalogue, generate collections and Matrixify CSVs and split the files for upload: the supplier's spreadsheet goes in one end and the store comes out loaded at the other.

Stack