Ruankao E-Commerce Designer (Intermediate) cheat sheet

B2B, B2C, C2C, and B2B2C differ by who transacts with whom; O2O adds an offline fulfillment leg to an online transaction, while C2M reverses the flow so demand data drives production.

Revenue model taxonomy: direct product sales, subscription/membership, commission or take rate on GMV, advertising/listing fees, and value-added services such as logistics or financing.

GMV = sum of merchandise value transacted; it is not revenue. Net revenue for a marketplace ≈ GMV × take rate, minus discounts and refunds.

Unit economics: contribution margin per order = AOV − COGS − fulfillment − payment fee − customer acquisition cost allocated per order; a negative value means growth destroys cash.

Customer lifetime value LTV = ARPU × gross margin × average retention months; compare with CAC to get the LTV/CAC ratio, a common viability screen (≥3 is a frequent benchmark).

Long-tail and network effects: marketplace value grows with the number of buyers and sellers (two-sided network effect), so liquidity in a niche category is a defensible advantage.

AOV = revenue from orders ÷ number of orders; raising AOV via bundling or free-shipping thresholds changes the fulfillment cost curve, so evaluate both together.

Conversion funnel stages - impression, click-through, product page view, add-to-cart, checkout start, order paid - each has its own rate; diagnose the largest drop-off rather than the overall rate.

Feasibility analysis covers technical, economic (ROI, payback period, NPV), operational, and legal/schedule dimensions; economic feasibility compares total cost of ownership against quantified benefits.

Requirements are separated into functional (what the system does) and non-functional (performance, availability, security, usability); non-functional targets must be measurable, e.g. p95 page latency < 2 s.

Use cases describe actor–goal interactions; a use-case diagram shows actors, system boundary, and include/extend relationships, while a use-case specification lists preconditions, main flow, and alternate flows.

Data flow diagrams use processes, data stores, external entities, and data flows; they are leveled (context diagram → level 1 → level 2) and must be balanced so inputs and outputs match between levels.

Entity-relationship modeling identifies entities, attributes, and relationships with cardinality (1:1, 1:N, M:N); M:N relationships become associative tables in the relational schema.

MoSCoW prioritization (Must, Should, Could, Won't) or Kano analysis (basic, performance, delighter) is used to scope an MVP release and control scope creep.

Business process analysis uses AS-IS and TO-BE models; swimlane diagrams assign activities to roles and expose handoffs where delay and error concentrate.

Capacity planning starts from peak concurrency and peak orders per second, not daily averages; a common rule is to size for the peak-hour volume multiplied by a headroom factor.

Layered architecture: presentation, application/service, domain, and data layers; dependencies point downward, and cross-cutting concerns (logging, security, transactions) are handled by middleware or aspects.

Microservices vs monolith: microservices give independent deployment and scaling per service but add network latency, distributed transactions, and operational overhead; choose by team size and change rate.

CAP theorem: under a network partition a distributed store chooses consistency or availability; BASE (basically available, soft state, eventual consistency) is typical for catalog and cart, while payment ledgers favor stronger consistency.

Stateless application servers behind a load balancer enable horizontal scaling; session state moves to a shared store (Redis) or is encoded in a signed token.

Caching layers: browser, CDN, reverse proxy, application cache, and database cache; cache-aside with TTL and explicit invalidation on write is the common pattern for product data.

Message queues decouple order placement from inventory, notification, and settlement; they enable peak buffering and retries but require idempotent consumers to avoid duplicate processing.

Availability of serial components multiplies: 99.9% × 99.9% ≈ 99.8%; redundancy (active-active or active-passive) is required to raise the composite figure.

Idempotency keys on order and payment APIs prevent duplicate charges when clients retry after a timeout; the key is stored with the result and reused for repeats.

HTTP is stateless; state is carried by cookies, sessions, or tokens. GET is safe and idempotent, POST is neither, PUT and DELETE are idempotent - this determines retry behavior.

REST constraints: client-server, statelessness, cacheability, uniform interface, layered system; resource URIs are nouns and behavior is expressed by HTTP methods and status codes (200, 201, 400, 401, 403, 404, 409, 429, 500).

Responsive design uses fluid grids, flexible images, and media queries; mobile-first CSS sets base styles for small screens and adds breakpoints upward.

Progressive Web Apps add service workers (offline cache, push), a web app manifest, and HTTPS; they give installability without an app store.

Front-end performance: reduce critical rendering path (minify, defer scripts), compress and serve images in modern formats, use HTTP/2 multiplexing and CDN edge caching; measure with Core Web Vitals (LCP, INP, CLS).

Cross-site scripting is prevented by output encoding and a Content-Security-Policy; SQL injection by parameterized queries; CSRF by anti-CSRF tokens or SameSite cookies.

Mobile app choice: native for deep device access and performance, cross-platform frameworks for shared code; hybrid webviews suit content-heavy catalogs with limited device needs.

API versioning strategies (URI path /v1, header, or media type) and backward-compatible evolution: add fields, never repurpose or remove them without a deprecation window.

Normalization: 1NF removes repeating groups, 2NF removes partial dependencies on part of a composite key, 3NF removes transitive dependencies; BCNF handles remaining key anomalies. Denormalize deliberately for read performance.

ACID: Atomicity, Consistency, Isolation, Durability. Isolation levels - Read Uncommitted, Read Committed, Repeatable Read, Serializable - trade concurrency for protection against dirty, non-repeatable, and phantom reads.

Indexes speed reads and slow writes; a composite index (a, b) serves filters on a and on (a, b) but not on b alone (leftmost-prefix rule).

Transactions for order placement must cover inventory deduction, order insert, and payment record; use optimistic locking (version column) or pessimistic locking to prevent overselling.

Sharding splits data by a shard key (e.g. user ID) for horizontal scale; it complicates cross-shard joins and distributed transactions, so prefer functional partitioning first.

Read/write splitting with replicas introduces replication lag; reads that must be current (e.g. just-placed order status) should be routed to the primary or use a consistency token.

Backup strategy: full + incremental backups with point-in-time recovery via transaction logs; restore drills, not backup jobs alone, prove recoverability. Define RPO and RTO targets.

Personal data handling requires minimization, purpose limitation, and deletion on request; audit logs for sensitive field access support compliance and incident investigation.

TLS secures transport with certificates issued by a CA; HTTPS = HTTP over TLS. Certificate validation checks chain of trust, hostname match, and validity period.

Firewall zones place the web tier in a DMZ and the database in a private subnet; a WAF filters application-layer attacks such as SQL injection and XSS patterns.

Authentication vs authorization: authentication proves identity (password + MFA, OAuth 2.0 / OIDC), authorization grants permissions (RBAC, ABAC).

Payment gateway flow: client submits order → gateway tokenizes card data → authorization → capture → settlement; the merchant should never store raw card numbers (PCI DSS scope reduction via tokenization).

Third-party payment integration relies on asynchronous callbacks (notify_url) plus active query; verify signatures, handle idempotency, and reconcile against settlement files daily.

Symmetric encryption (AES) is fast for bulk data; asymmetric (RSA/ECC) is used for key exchange and signatures. Digital signatures provide integrity, authenticity, and non-repudiation.

Common attack controls: rate limiting and CAPTCHA for credential stuffing, parameterized queries for injection, least privilege for insider risk, and log monitoring for anomaly detection.

Settlement reconciliation: match platform orders, gateway transaction records, and bank statements; differences fall into timing, duplicate, or amount mismatch categories and must be resolved within a defined window.

Key funnel metrics: traffic, CTR, conversion rate (orders ÷ visits), AOV, cart abandonment rate, repurchase rate; conversion = add-to-cart rate × checkout completion rate approximately.

Customer acquisition channels (search, feed ads, affiliate, social, content) are compared by CAC and payback period, not by click cost alone.

RFM segmentation scores recency, frequency, and monetary value to target retention campaigns; high-R low-F customers respond to reactivation offers.

Inventory metrics: turnover = COGS ÷ average inventory; days of supply = average inventory ÷ daily COGS; stockout rate and sell-through rate measure assortment health.

Logistics models: self-operated warehousing, third-party logistics (3PL), and dropshipping differ in control, cost structure, and delivery lead time; last-mile cost often dominates total fulfillment cost.

Order fulfillment states - paid, picked, packed, shipped, delivered, signed, returned - drive customer notifications and settlement timing; returns reverse both revenue and inventory.

Promotion mechanics (coupons, flash sales, tiered discounts, bundles) must be modeled against margin: effective price = list price − discount − platform subsidy, and the subsidy is a marketing expense.

After-sales service levels (response time, refund cycle, return rate) are operational KPIs that feed back into conversion and repurchase; a high return rate can erase unit margin.

Work breakdown structure decomposes deliverables into work packages; each package is estimated for effort and duration to build the schedule and cost baseline.

Critical path method: the longest path through the network determines minimum project duration; total float = LS − ES = LF − EF, and critical activities have zero float.

Earned value: PV, EV, AC; CV = EV − AC, SV = EV − PV, CPI = EV/AC, SPI = EV/PV. CPI < 1 means over budget; SPI < 1 means behind schedule.

Risk management cycle: identify, analyze (probability × impact), plan response (avoid, mitigate, transfer, accept), monitor; maintain a risk register with owners.

Change control: a change request is assessed for scope, schedule, and cost impact, approved by the change board, then baselined; uncontrolled changes cause scope creep.

Quality assurance vs quality control: QA is process-oriented and preventive; QC is product-oriented and inspects deliverables against acceptance criteria.

Standards and law relevant to e-commerce: electronic signature validity, consumer protection rules on return windows and disclosure, privacy rules on personal data, and platform record-keeping obligations.

Professional ethics: protect confidential data, avoid conflicts of interest, report accurately, and disclose limitations of estimates and test results to stakeholders.

Technical reading strategy: identify the topic sentence, then signal words (however, therefore, whereas, provided that) that mark contrast, causation, and conditions - these carry the answer in comprehension items.

Specification verbs carry obligation strength: shall = mandatory, should = recommended, may = optional; misreading them changes requirements interpretation.

Requirements document structure: purpose, scope, definitions, functional requirements, non-functional requirements, interfaces, constraints, acceptance criteria, and revision history.

API documentation essentials: endpoint, method, authentication, request parameters with types and constraints, response schema, error codes, and a worked example.

Test documentation: test plan (scope, approach, resources, schedule) vs test case (preconditions, steps, expected result) vs defect report (environment, steps to reproduce, severity, expected vs actual).

Reading quantitative text: distinguish absolute from relative change ("increased by 20%" vs "increased to 20%"), and check whether a percentage base is stated before using it.

Passive voice and nominalization are common in formal specs; convert to actor–action–object to verify who is responsible for each requirement.

Version and change logs record date, author, description, and approval; traceability matrices link requirements to design elements and test cases for audit.