Business-logic flaws in checkout flows, where a server trusts prices, totals or roles asserted by the client, remain a leading cause of financial loss in web commerce, and security studies continue to find them in widely deployed platforms. At the same time, mainstream storefronts treat shopping as a single-user activity and offer no synchronous way for several people to build one cart together.

This paper presents the design, implementation

and security evaluation of ARKA (अक´ ), a full-stack e-commerce web platform built with Next.js 16 (App Router), React 19, TypeScript, Prisma ORM and PostgreSQL. ARKA places four controls in sequence: (i) a

sliding-window rate limiter and (ii) JSON Web Token (JWT) verification with role-based access control (RBAC), both executed in Edge Middleware before any route handler; (iii) Zod schema validation of every request body; and (iv) a server-authoritative Canonical Pricing Engine that accepts only product identifiers and quantities from the client and recomputes the subtotal, promotional discount, shipping charge and 18% GST from database prices. A Real-Time Collaborative Shopping Room lets several authenticated users share one server-held cart over WebSocket. In a 14-day controlled evaluation, none of 50 price-tampering attempts altered a persisted order total, none of 75 authorization-bypass attempts reached a protected handler, all 85 requests above the login rate limit were rejected with HTTP 429, and 200 collaborative cart operations across three concurrent users produced no state divergence, with median update latencies of 31–34 ms.