# Toy Store: Full-Stack E-commerce

• -A complete purchase flow: browse, cart, wishlist, checkout, order history, cancellation requests.
• -Authentication that can actually log users out, despite JWTs being stateless.
• -Keep the external catalog fast, and keep the app usable when Redis is unavailable.
• -Admin tooling for orders, users, and cancellation approvals.

Built the Go API, the Next.js frontend, the database schema and migrations, and the Docker Compose deployment, and documented the architecture in the repository.

• -Shoppers browsing, buying, and tracking orders
• -Admins managing orders, users, and cancellation requests

• -Product catalog from an external API with Redis caching and filtering
• -Cart and wishlist persisted per user
• -Two-step Stripe PaymentIntent checkout; card data never touches the backend
• -Dual-token JWT auth: 15-minute access token, 7-day refresh token stored in Redis with rotation on refresh
• -Role-based access (user, admin) enforced in middleware
• -Admin dashboard: orders, users, cancellation-request approval
• -Nginx reverse proxy with rate limiting and a health-checked startup order in Docker Compose

• -Nginx is the single public entry point, with rate limits on auth endpoints and on the rest of the API.
• -Go with Gin in three layers: HTTP handlers, services for business logic, repositories for SQL.
• -Next.js 14 App Router: server components for the home page (SSR, server-side fetch inside the Docker network), client components with Zustand and Axios for cart, checkout, and profile.
• -PostgreSQL 16 for users, orders, order items, cart items, and wishlist items, with golang-migrate migrations run at startup.
• -Redis 7 for refresh tokens and the catalog cache.

1. 1.Catalog: request → Redis (5-minute TTL) → on a miss, the external toy API. If Redis is down, the request continues without caching and logs a warning.
2. 2.Checkout: the frontend asks the API for a PaymentIntent, Stripe.js tokenizes the card in the browser, and the API verifies the intent succeeded before creating the order with line-item snapshots.
3. 3.Auth: login issues an access token and a refresh token; the Axios interceptor refreshes transparently on 401; logout deletes the refresh token from Redis.

• -Line-item snapshots: orders store name, price, and image at purchase time, because the external catalog can change or remove toys.
• -UUID primary keys to avoid ID enumeration.
• -bcrypt with cost factor 12 for passwords.
• -Zod validation on every form, with Serbian error messages; next-themes dark mode.
• -Docker Compose startup order: PostgreSQL → Redis → API (runs migrations, exposes /health) → frontend → Nginx.

→ Refresh tokens in Redis

JWTs cannot be revoked on their own. Storing the refresh token server-side with a TTL makes logout real: no token in Redis, no session.

→ Snapshot order lines

The catalog is external and can change. Paid orders must show exactly what was bought at the price it was bought.

→ Rate limiting in Nginx, not in Go

Abusive traffic is dropped before it allocates anything in the application process.

→ Three-layer backend

Handlers, services, and repositories can be tested and changed independently.

• -Search is in-memory filtering and catalog pagination is client-side, which will not scale past a small catalog.
• -Stripe webhooks need the Stripe CLI locally; the stack runs over HTTP with no TLS configured.
• -No email notifications.

• -A complete, documented e-commerce stack that starts with one command and demonstrates production patterns end to end: layered backend, revocable JWT sessions, cache-aside reads with graceful degradation, and a PCI-friendly payment flow.

• [Go 1.23]
• [Gin]
• [Next.js 14]
• [TypeScript]
• [PostgreSQL 16]
• [Redis 7]
• [Nginx]
• [Docker Compose]
• [Stripe]
• [JWT]
• [Zustand]
• [Zod]
• [Tailwind CSS]

• Repository ↗ (opens in a new tab)