The console a perfume house is run from.
Éclataur Atelier is the private console the house is run from: orders, customers, formulation and the ledger in a single application, deliberately separate from the shop it sits beside.
FIG. 01 · Console, desktop 1440×900
A back office is not a page on the shop.
The path of least resistance for a fragrance house is to run the business from the store’s own admin: same application, same database, same deploy, same credentials in the same browser tab. It works until it does not. A back-office change restarts the storefront, an admin key sits one devtools panel away from a customer session, and a query written for the office reaches straight into the data that serves the shop.
Éclataur needed the opposite arrangement. One place to run orders, customers, formulation and the ledger, built so that the console and the shop share a business but not a blast radius.
One console, four areas, one boundary.
Éclataur Atelier is a single application covering orders, customers, formulation and the ledger. Formulation is ÉCLAB, the perfumer’s workspace, now a module inside the console rather than a tool standing on its own beside it.
The boundary is the part worth naming. The console never talks to the commerce backend from the browser: its own backend calls that API server-side as a service account. It runs on its own database with its own role and no cross-grants to the shop’s data, and it deploys independently, so shipping the back office is never an outage risk for the store.
The rules the console is built on.
Four decisions shaped the build. Each one moves a class of mistake from something a person has to remember into something the system will not let happen.
Separate from the shop, on purpose.
The console runs on its own database under its own role, with no cross-grants to the store’s data, and deploys independently. A change to the back office never restarts the storefront.
Admin keys never reach a browser.
The console never calls the commerce backend from the client. Its own backend makes those calls server-side as a service account, so admin credentials stay on the server where they belong.
Zero Trust, passkey only.
Access is gated by Cloudflare Zero Trust with passkey authentication and a 24 hour session. There is no password to phish and no shared login to leak.
Money and time, decided once.
All money is stored as integer cents. Servers run UTC, converted to the house’s own day at the moment someone reads a date. The token system, the money rule and WCAG 2.2 AA are enforced by a pre-commit hook rather than left to memory.