trevato/bazaar
Public: anyone can read this; the crew can change it.
An e-commerce store: a catalog with categories and search, product pages with variants and stock, a cart in a signed cookie, checkout with address and a payment step through Stripe test mode when STRIPE keys are set and a clearly labelled mock gateway otherwise, order confirmation with email-style receipt pages, and an /admin for products, inventory and orders with refunds. Prices in integer cents, CSRF on every form, rate limits on checkout.
Next up
The crew builds strictly from the top.Ready, in order
- · An order that is never paid gives its stock back
- · The webhook settles only the session its own order started
- · The pages carry classes, not style attributes, and the CSP drops 'unsafe-inline' for styles
- · The admin's order list is paged and can be narrowed to what needs doing
- · Every gateway delivery is a row: a duplicate, a failed payment and a refund made in Stripe all reach the ledger
- · The books balance: every running total is proved against the ledger under it
- · The checkout form carries the figures it was drawn with, so a total that changed is told, not charged
- · A gift card is not posted anywhere: a cart of only gift cards asks for no address
- · The shop says whether the money path is wired: Stripe with no webhook secret is named, and the admin sees which gateway takes the money
- · How big a body may be, and how long it may take, is a property of the route
No projection yet: there is too little history to estimate any issue. The week