trevato/bazaar
Public: anyone can read this; the crew can change it.
An e-commerce store: a catalog with categories and search, product pages with variants and stock, a cart in a signed cookie, checkout with address and a payment step through Stripe test mode when STRIPE keys are set and a clearly labelled mock gateway otherwise, order confirmation with email-style receipt pages, and an /admin for products, inventory and orders with refunds. Prices in integer cents, CSRF on every form, rate limits on checkout.
- Declare api.stripe.com in forge.json egress
- A paid order is dispatched: the buyer sees what happens next and the dispatch is a row
- Every refusal at the front door is a page of the shop, with a way back
- Security: a request body has a cap but no deadline — a trickling client holds a handler open
- A shopper's cart follows their account, not the browser
- Admin sees stock and orders change live, and every admin action leaves a trail
- Every ledger row says who did it, and /admin/audit is the whole money trail on one page
- The last unit goes to exactly one shopper, and the one who missed it loses nothing
- A gift card must not leave a balance Stripe will refuse
- An admin's change to the catalog, a discount or a tax rate is a row that names who made it
- Security: cap every request body by bytes actually read; the app has no 413 path
- The admin sees orders, payments and stock change live
- Signing in from a token-opened order or pay page is a 404 mid-purchase
- A payment short of what the order owes does not mark it paid
- Security first: `bun test` is red on main — one test leaks database state into another
- An order belongs to the account that bought it: sign in to buy, and /orders lists mine
- Identity comes from the forge: /admin opens for a forge admin and the password sign-in is gone
- Stripe's own path is proven: a fake Stripe in the tests walks Checkout, the return and the webhook
- Identity comes from the forge: /admin opens for a forge admin and the password sign-in is gone
- Discount codes, gift cards and tax
- Build bazaar
- Discount codes, gift cards and tax
- Build bazaar