amalbabu0/ecomerce

Purpose and Runtime

Pavan Foods is a Phase-1 ecommerce storefront for catalog browsing, authenticated accounts, checkout, operations, and security visibility. It runs on Next.js 16 App Router with TypeScript, deployed to Vercel, backed by Supabase and Razorpay. Root application shell and metadata behavior begin at app/layout.tsx; route access mediation is centralized in proxy.ts.

Route Domains and Entry Points

Public storefront routes cover marketing, category/product discovery, cart, and checkout: app/(marketing)/page.tsx, app/(shop)/products/[slug]/page.tsx, and app/checkout/page.tsx. Authenticated account routes provide profiles, addresses, and order history under app/(account)/account/. Privileged operations are separately mounted at app/admin/layout.tsx and app/developer/layout.tsx, with role enforcement both at routing and server/page boundaries.

Supabase Data, Authentication, and Authorization

Supabase provides Postgres, Auth, Storage, and RLS-controlled API access. Client/server/admin connection boundaries are explicit in lib/supabase/client.ts, lib/supabase/server.ts, and lib/supabase/admin.ts; the latter is service-role-only and therefore reserved for verified server actions. Schema, seed data, database functions, roles, security logs, and storage policies evolve through supabase/migrations/0001_init.sql through supabase/migrations/0010_fix_auth_audit_log_type.sql. Email/password and Google OAuth flows are implemented in features/auth/actions.ts and return through app/api/auth/callback/route.ts.

Catalog and Cart Flow

Server-side catalog queries supply product lists, search, category pages, and PDPs through features/catalog/queries.ts, rendered by routes such as app/(shop)/products/page.tsx. The browser cart is a dedicated client-state boundary in features/cart/store.ts; interaction components such as features/cart/add-to-cart-button.tsx update it, while app/cart/page.tsx presents the current purchase state. Product imagery is served from local public assets and Supabase Storage, with admin uploads targeting the product-images bucket.

Checkout, Order Creation, and Payments

Checkout gathers validated customer/address input in features/checkout/checkout-form.tsx and invokes server-side orchestration in features/checkout/actions.ts. Razorpay server integration and payment-signature verification are isolated in lib/razorpay/server.ts and lib/razorpay/verify.ts. The normal browser verification path is supplemented by Razorpay’s authoritative asynchronous webhook at app/api/razorpay/webhook/route.ts; both paths update payment/order state and record relevant failures. Database-side order creation is established in supabase/migrations/0003_create_order_function.sql.

Administrative Operations

The admin area exposes metrics, order visibility, product creation/deletion, user deletion, and review moderation through app/admin/page.tsx, app/admin/products/new/page.tsx, and features/admin/actions.ts. Admin role originates in immutable-to-users auth.users.app_metadata, is checked from JWT claims, and is revalidated by server actions before service-role operations. Product creation accepts native FormData, validates uploaded file type/size server-side, writes product records, then uploads images; upload failure does not roll back the product.

Security and Developer Observability

Observed security events are logged by server code using lib/security-log.ts: failed authentication, failed checkout verification, and malformed/invalid Razorpay webhooks. Developer-only views in app/developer/page.tsx and app/developer/auth-log/page.tsx query event data and Supabase Auth audit records. The audit log crosses the otherwise protected auth schema through a security-definer database function introduced in supabase/migrations/0008_developer_security_logs.sql; it is not a client-exposed table.