Thor — a public storefront and a locked-down enterprise portal

Thor sells to the public at list price and to enterprise clients at negotiated rates. Those rates are confidential — one account must never see another's pricing. Doing that in the UI alone is a data breach waiting to happen.

Two surfaces, one catalog. Internal product tables hold cost and are never exposed; the public store and portals read from public views. Contracted prices live per account and are enforced in the security layer, so a wrong URL returns a 404, not someone else's price.

1. Price isolation enforced in RLS and the service layer — cross-account access 404s instead of leaking.
2. Enterprise reorder flow keyed to each account's installed models, so replacements are one click.
3. Public storefront and admin breadth on the same schema, cost data walled off behind views.