Custom-builtenrollment system.

The client's domain understanding was still evolving during the build. Pricing rules, enrollment constraints, and fee configuration all shifted within a compressed window. Every migration had to leave existing data valid.

Before checkout completes, every item in the cart runs through a multi-step pricing pipeline:

This isn't a Stripe integration. The payment processor is Elavon's EPG, a bank-grade gateway used by enterprise and institutional clients. No SDK. HTTP Basic auth with a merchant alias. HATEOASHypermedia as the Engine of Application StateA REST pattern where API responses include links to related resources. The client navigates by following those links rather than constructing URLs. Each step returns the href needed for the next.-style resource references.

The payment flow is four layers deep. Each layer has a security checkpoint.

// Node.js runtime enforced — edge lacks crypto.timingSafeEqual
export const runtime = "nodejs";

// Timing-safe auth comparison
const expectedBuf = Buffer.from(expected);
const actualBuf = Buffer.from(
  authHeader.padEnd(expected.length, "\0").slice(0, expected.length),
);
authValid =
  expectedBuf.length === Buffer.from(authHeader).length &&
  crypto.timingSafeEqual(expectedBuf, actualBuf);

// Never trust the notification body — always re-fetch
let transaction;
try {
  transaction = await fetchEpgTransaction(resource);
} catch (err) {
  return NextResponse.json(
    { error: "Failed to fetch transaction" },
    { status: 500 }
  );
}

// Terminal state replay protection
const terminalStates = [
  "authorized", "captured", "settled",
  "declined", "voided", "refunded"
];
if (terminalStates.includes(payment.state)) {
  return NextResponse.json({ ok: true });
}

Registration is a multi-step flow. A family shouldn't lose their spot while filling out a payment form. But you can't reserve spots indefinitely — abandoned carts would lock out real registrations. And two families can't both hold the last spot in a class.

Before a registration is written, every enrollment is validated against a configurable rule engine: