https://phamkhanhminhman.com Backend engineering, e-commerce API integration, and applied AI research notes. en https://phamkhanhminhman.com/blog/postgresql-isolation-levels-measured https://phamkhanhminhman.com/blog/postgresql-isolation-levels-measured The isolation table everyone copies belongs to the SQL standard, not to PostgreSQL. Measured on PostgreSQL 16: READ UNCOMMITTED is accepted and quietly ignored, Repeatable Read blocks phantoms the standard says it should allow, a plain SELECT at Repeatable Read blocks a writer for 1ms against 4003ms for a real lock, and the one anomaly that separates Repeatable Read from Serializable costs you a 40001 you have to retry. PostgreSQL / Concurrency Thu, 27 Aug 2026 00:00:00 GMT https://phamkhanhminhman.com/blog/shopee-oauth-token-lifecycle-at-scale https://phamkhanhminhman.com/blog/shopee-oauth-token-lifecycle-at-scale The quick start is three functions long and works first try against your own test shop. What it leaves out: the auth endpoints sign differently from every other call, the refresh token is single-use so two workers will quietly kill each other's copy, and the thing that actually expires is the seller's authorization — which you cannot read from the token in your hand. OAuth / Distributed Systems Mon, 24 Aug 2026 00:00:00 GMT https://phamkhanhminhman.com/blog/optimistic-vs-pessimistic-locking https://phamkhanhminhman.com/blog/optimistic-vs-pessimistic-locking A flash sale with 100 shirts in stock took 200 orders — and the stock column still read 94. Measured on real PostgreSQL: the one-line fix nobody reaches for first, the lock that makes checkout 149× slower, the case where pessimistic locking cannot be used at all, and why a perfectly correct row lock still loses inventory once a queue is in the path. PostgreSQL / Concurrency Fri, 21 Aug 2026 00:00:00 GMT https://phamkhanhminhman.com/blog/double-counting-in-append-only-projections https://phamkhanhminhman.com/blog/double-counting-in-append-only-projections A polling sync detects changed records by updated_at and appends them to a history table. That works fine — until the upstream system is allowed to correct a record after the fact, and 'append' quietly becomes 'add it again'. Django / Idempotency Fri, 21 Aug 2026 00:00:00 GMT https://phamkhanhminhman.com/blog/silent-missing-await-run-in-executor https://phamkhanhminhman.com/blog/silent-missing-await-run-in-executor Forgetting await on a coroutine is loud. Forgetting it on run_in_executor is completely silent — and shared global state makes the bug heal itself after the first call, which is exactly why nobody catches it. Python / asyncio Fri, 21 Aug 2026 00:00:00 GMT https://phamkhanhminhman.com/blog/safe-webhook-handling https://phamkhanhminhman.com/blog/safe-webhook-handling HMAC signature verification fails for a reason that has nothing to do with the key or the algorithm: one JSON parse-and-reserialize step, done before signature check, is enough to change every byte. Security Wed, 15 Apr 2026 00:00:00 GMT