Problem & Context
Custom NBA 2K cyberface commissions (across 2K25–2K27) are usually coordinated through scattered social media DMs. The creator loses hours chasing missing reference photos, clarifying which game version a request is for, and answering repetitive “what is my order status?” messages.
I built JB2K Mods (jb2k.shop) as a solo client project to replace those chat threads with a dedicated, dark-court broadcast-style site where customers send a complete request in one go and follow its progress on their own.
Architecture & Key Engineering Decisions
Structured Commission Intake & Live Player Card Preview
- Request Form (
/commission): Customers enter the player, pick the game (2K25,2K26,2K27) and mod type (Modium or Non-Modium), and add a reference link, their Ko-fi username, and optional notes, while a live player-card preview fills in as they type. - Complete Requests by Default: Server-side validation requires a valid reference link and a Ko-fi contact on every submission, and submissions are rate-limited, so each request enters the queue ready to work on. The form states up front that JB2K makes player cyberfaces only.
- Persistent Cross-Page Audio Dock: Built with Inertia.js v3 and React 19 (
TypeScript), the site keeps a bottom-right YouTube soundtrack dock playing across client-side page visits, with playback controls and a song list and play order the admin manages.
Order Tracking & Hardened Admin Queue
- Self-Serve Tracking IDs (
/track): Every submission gets a uniqueJB2K-XXXXXXXXtracking ID. Customers check their order’s stage (Submitted, In review, In progress, Completed, or the reason if it was declined) without creating an account, and can have the ID emailed to them once through Resend. - 2FA & Passkey Admin Workspace: The admin area is limited to flagged admin accounts and protected by Laravel Fortify with two-factor authentication (TOTP) and WebAuthn passkeys. It has a review queue, approve or reject with a reason, order-status updates with a preview of what the customer will see, and status filters with sorting on every column.
- Account Safety: Changing an admin’s email keeps the old address working until the new one is confirmed and alerts the old address, and password changes must be confirmed by email, then sign out every other device.
- Lean Production Deployment: Runs on Laravel 13 and PHP 8.4 backed by SQLite on a persistent Railway volume, with email sent through Resend’s HTTPS API, keeping the infrastructure simple.
Quality & Verification Discipline
Every pull request runs through GitHub Actions: PHPStan / Larastan at Level 7, Laravel Pint formatting, vite-plus linting and formatting, TypeScript type checks, and a PHPUnit feature suite covering commission submission and validation, tracking ID lookup, admin-only access, approval and order-status changes, soundtrack management, and email-confirmed email and password changes.