Week 15 — E-Commerce System Design & Implementation Capstone¶

// src/app.js
const express = require('express');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');

const authRoutes = require('./routes/auth.routes');
const productRoutes = require('./routes/products.routes');
const cartRoutes = require('./routes/cart.routes');
const orderRoutes = require('./routes/orders.routes');
const webhookRoutes = require('./routes/webhooks.routes');
const errorHandler = require('./middleware/errorHandler');

const app = express();

// ── Security middleware ──────────────────────────────────────────────────────
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "https://js.stripe.com"],
      frameSrc: ["https://js.stripe.com"],
      connectSrc: ["'self'", "https://api.stripe.com"]
    }
  },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true }
}));

app.use(cors({
  origin: process.env.ALLOWED_ORIGINS.split(','),
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true
}));

// ── Stripe webhooks MUST receive raw body before JSON parsing ────────────────
app.use('/api/webhooks/stripe', express.raw({ type: 'application/json' }));

// ── Body parsing ─────────────────────────────────────────────────────────────
app.use(express.json({ limit: '10kb' }));  // Limit body size

// ── Global rate limiting ─────────────────────────────────────────────────────
const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,   // 15 minutes
  max: 100,                    // 100 requests per window per IP
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many requests, please try again later.' }
});
app.use('/api/', globalLimiter);

// ── Routes ───────────────────────────────────────────────────────────────────
app.use('/api/auth', authRoutes);
app.use('/api/products', productRoutes);
app.use('/api/cart', cartRoutes);
app.use('/api/orders', orderRoutes);
app.use('/api/webhooks', webhookRoutes);

// Health check (for load balancer / container orchestration)
app.get('/health', (req, res) => res.json({ status: 'ok', timestamp: new Date() }));

// ── Global error handler (must be last) ─────────────────────────────────────
app.use(errorHandler);

module.exports = app;

// src/controllers/auth.controller.js
const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');
const crypto = require('crypto');
const db = require('../config/database');

const SALT_ROUNDS = 12;
const ACCESS_TOKEN_EXPIRY = '15m';
const REFRESH_TOKEN_EXPIRY = '30d';

// ── Helper: Generate token pair ──────────────────────────────────────────────
function generateTokens(userId) {
  const accessToken = jwt.sign(
    { sub: userId, type: 'access' },
    process.env.JWT_ACCESS_SECRET,
    { expiresIn: ACCESS_TOKEN_EXPIRY, issuer: 'ecommerce-api' }
  );

  // Refresh token is a cryptographically random string (NOT a JWT)
  // JWTs as refresh tokens cannot be revoked server-side without a token store
  const refreshToken = crypto.randomBytes(40).toString('hex');

  return { accessToken, refreshToken };
}

// ── POST /api/auth/register ──────────────────────────────────────────────────
exports.register = async (req, res, next) => {
  try {
    const { email, password, firstName, lastName } = req.body;

    // Check for existing user
    const [existing] = await db.query(
      'SELECT id FROM users WHERE email = ?', [email]
    );
    if (existing.length > 0) {
      return res.status(409).json({ error: 'Email already registered' });
    }

    // Hash password — bcrypt with cost factor 12
    const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);

    // Insert user
    const [result] = await db.query(
      `INSERT INTO users (email, password_hash, first_name, last_name) 
       VALUES (?, ?, ?, ?)`,
      [email.toLowerCase(), passwordHash, firstName, lastName]
    );
    const userId = result.insertId;

    // Generate tokens
    const { accessToken, refreshToken } = generateTokens(userId);

    // Store hashed refresh token
    const refreshTokenHash = await bcrypt.hash(refreshToken, 10);
    const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
    await db.query(
      'INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES (?, ?, ?)',
      [userId, refreshTokenHash, expiresAt]
    );

    // Set refresh token as httpOnly cookie
    res.cookie('refreshToken', refreshToken, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'strict',
      maxAge: 30 * 24 * 60 * 60 * 1000   // 30 days
    });

    res.status(201).json({
      message: 'Account created successfully',
      accessToken,
      user: { id: userId, email, firstName, lastName }
    });

  } catch (error) {
    next(error);
  }
};

// ── POST /api/auth/login ─────────────────────────────────────────────────────
exports.login = async (req, res, next) => {
  try {
    const { email, password } = req.body;

    // Fetch user — use constant-time comparison to prevent timing attacks
    const [users] = await db.query(
      'SELECT id, email, password_hash, first_name, last_name, is_admin FROM users WHERE email = ?',
      [email.toLowerCase()]
    );

    // Always hash even if user not found (prevent timing oracle)
    const dummyHash = '$2a$12$K.sLHHs6WMsVF9WL4bZ9b.';
    const hashToCompare = users[0]?.password_hash || dummyHash;
    const passwordMatch = await bcrypt.compare(password, hashToCompare);

    if (!users[0] || !passwordMatch) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    const user = users[0];
    const { accessToken, refreshToken } = generateTokens(user.id);

    // Store refresh token
    const refreshTokenHash = await bcrypt.hash(refreshToken, 10);
    const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
    await db.query(
      'INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES (?, ?, ?)',
      [user.id, refreshTokenHash, expiresAt]
    );

    // Update last_login_at
    await db.query('UPDATE users SET last_login_at = NOW() WHERE id = ?', [user.id]);

    res.cookie('refreshToken', refreshToken, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'strict',
      maxAge: 30 * 24 * 60 * 60 * 1000
    });

    res.json({
      accessToken,
      user: {
        id: user.id,
        email: user.email,
        firstName: user.first_name,
        lastName: user.last_name,
        isAdmin: user.is_admin
      }
    });

  } catch (error) {
    next(error);
  }
};

// ── POST /api/auth/refresh ───────────────────────────────────────────────────
exports.refreshToken = async (req, res, next) => {
  try {
    const incomingToken = req.cookies.refreshToken;
    if (!incomingToken) {
      return res.status(401).json({ error: 'No refresh token' });
    }

    // Find non-expired, non-revoked tokens for comparison
    const [tokens] = await db.query(
      `SELECT rt.id, rt.token_hash, rt.user_id, u.email, u.is_admin
       FROM refresh_tokens rt
       JOIN users u ON rt.user_id = u.id
       WHERE rt.expires_at > NOW() AND rt.revoked_at IS NULL
       ORDER BY rt.created_at DESC LIMIT 10`
    );

    // Find matching token (bcrypt comparison)
    let matchedToken = null;
    for (const token of tokens) {
      if (await bcrypt.compare(incomingToken, token.token_hash)) {
        matchedToken = token;
        break;
      }
    }

    if (!matchedToken) {
      return res.status(401).json({ error: 'Invalid or expired refresh token' });
    }

    // Rotate: revoke old token, issue new pair
    await db.query(
      'UPDATE refresh_tokens SET revoked_at = NOW() WHERE id = ?',
      [matchedToken.id]
    );

    const { accessToken, refreshToken: newRefreshToken } = generateTokens(matchedToken.user_id);
    const newHash = await bcrypt.hash(newRefreshToken, 10);
    const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);

    await db.query(
      'INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES (?, ?, ?)',
      [matchedToken.user_id, newHash, expiresAt]
    );

    res.cookie('refreshToken', newRefreshToken, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'strict',
      maxAge: 30 * 24 * 60 * 60 * 1000
    });

    res.json({ accessToken });

  } catch (error) {
    next(error);
  }
};

// src/controllers/products.controller.js
const db = require('../config/database');

// ── GET /api/products ────────────────────────────────────────────────────────
// Supports: ?category=electronics&sort=price_asc&page=1&limit=20&search=laptop
exports.getProducts = async (req, res, next) => {
  try {
    const {
      category,
      sort = 'created_at_desc',
      page = 1,
      limit = 20,
      search,
      minPrice,
      maxPrice,
      featured
    } = req.query;

    const pageNum = Math.max(1, parseInt(page));
    const limitNum = Math.min(100, Math.max(1, parseInt(limit)));
    const offset = (pageNum - 1) * limitNum;

    // Build dynamic WHERE clause
    let whereConditions = ['p.is_active = TRUE'];
    const params = [];

    if (category) {
      whereConditions.push('c.slug = ?');
      params.push(category);
    }
    if (search) {
      whereConditions.push('(p.name LIKE ? OR p.description LIKE ? OR p.sku LIKE ?)');
      const searchTerm = `%${search}%`;
      params.push(searchTerm, searchTerm, searchTerm);
    }
    if (minPrice) {
      whereConditions.push('p.price >= ?');
      params.push(parseFloat(minPrice));
    }
    if (maxPrice) {
      whereConditions.push('p.price <= ?');
      params.push(parseFloat(maxPrice));
    }
    if (featured === 'true') {
      whereConditions.push('p.is_featured = TRUE');
    }

    // Build ORDER BY
    const sortMap = {
      'price_asc':       'p.price ASC',
      'price_desc':      'p.price DESC',
      'name_asc':        'p.name ASC',
      'created_at_desc': 'p.created_at DESC',
      'popularity':      'order_count DESC'
    };
    const orderBy = sortMap[sort] || 'p.created_at DESC';

    const whereClause = whereConditions.join(' AND ');

    // Count query for pagination
    const [countResult] = await db.query(
      `SELECT COUNT(*) as total
       FROM products p
       JOIN categories c ON p.category_id = c.id
       WHERE ${whereClause}`,
      params
    );
    const total = countResult[0].total;

    // Data query
    const [products] = await db.query(
      `SELECT 
          p.id, p.name, p.slug, p.short_description,
          p.price, p.compare_price, p.stock_quantity,
          p.is_featured,
          c.name AS category_name, c.slug AS category_slug,
          pi.url AS primary_image, pi.alt_text AS primary_image_alt,
          COUNT(DISTINCT oi.id) AS order_count
       FROM products p
       JOIN categories c ON p.category_id = c.id
       LEFT JOIN product_images pi ON pi.product_id = p.id AND pi.is_primary = TRUE
       LEFT JOIN order_items oi ON oi.product_id = p.id
       WHERE ${whereClause}
       GROUP BY p.id
       ORDER BY ${orderBy}
       LIMIT ? OFFSET ?`,
      [...params, limitNum, offset]
    );

    res.json({
      data: products,
      pagination: {
        page: pageNum,
        limit: limitNum,
        total,
        totalPages: Math.ceil(total / limitNum)
      }
    });

  } catch (error) {
    next(error);
  }
};

// ── GET /api/products/:slug ──────────────────────────────────────────────────
exports.getProductBySlug = async (req, res, next) => {
  try {
    const { slug } = req.params;

    const [products] = await db.query(
      `SELECT 
          p.*,
          c.name AS category_name, c.slug AS category_slug
       FROM products p
       JOIN categories c ON p.category_id = c.id
       WHERE p.slug = ? AND p.is_active = TRUE`,
      [slug]
    );

    if (products.length === 0) {
      return res.status(404).json({ error: 'Product not found' });
    }

    const product = products[0];

    // Fetch all images
    const [images] = await db.query(
      'SELECT id, url, alt_text, sort_order, is_primary FROM product_images WHERE product_id = ? ORDER BY sort_order',
      [product.id]
    );

    product.images = images;
    delete product.cost_price;  // Never expose cost to frontend

    res.json({ data: product });

  } catch (error) {
    next(error);
  }
};

// src/controllers/cart.controller.js
// Cart is stored in Redis for authenticated users, localStorage on frontend
// This controller manages server-side cart validation before checkout

const db = require('../config/database');
const redis = require('../config/redis');

// ── POST /api/cart/validate ──────────────────────────────────────────────────
// Validates cart items before checkout: checks stock, verifies prices
exports.validateCart = async (req, res, next) => {
  try {
    const { items } = req.body;
    // items = [{ product_id: 1, quantity: 2 }, ...]

    if (!items || items.length === 0) {
      return res.status(400).json({ error: 'Cart is empty' });
    }

    const productIds = items.map(item => item.product_id);

    const [products] = await db.query(
      `SELECT id, name, slug, price, stock_quantity, is_active
       FROM products WHERE id IN (?)`,
      [productIds]
    );

    const productMap = {};
    products.forEach(p => { productMap[p.id] = p; });

    const validationErrors = [];
    const validatedItems = [];
    let subtotal = 0;

    for (const item of items) {
      const product = productMap[item.product_id];

      if (!product) {
        validationErrors.push({
          product_id: item.product_id,
          error: 'Product not found'
        });
        continue;
      }

      if (!product.is_active) {
        validationErrors.push({
          product_id: item.product_id,
          name: product.name,
          error: 'Product is no longer available'
        });
        continue;
      }

      if (product.stock_quantity < item.quantity) {
        validationErrors.push({
          product_id: item.product_id,
          name: product.name,
          error: `Only ${product.stock_quantity} units available`,
          available_quantity: product.stock_quantity
        });
        continue;
      }

      const itemSubtotal = product.price * item.quantity;
      subtotal += itemSubtotal;

      validatedItems.push({
        product_id: product.id,
        name: product.name,
        slug: product.slug,
        unit_price: product.price,
        quantity: item.quantity,
        subtotal: itemSubtotal
      });
    }

    if (validationErrors.length > 0) {
      return res.status(422).json({
        error: 'Cart validation failed',
        validation_errors: validationErrors
      });
    }

    res.json({
      items: validatedItems,
      subtotal: subtotal.toFixed(2)
    });

  } catch (error) {
    next(error);
  }
};

// src/controllers/orders.controller.js
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const db = require('../config/database');

// ── POST /api/orders/create-payment-intent ────────────────────────────────── 
// Step 1: Create Stripe PaymentIntent, return client_secret to frontend
exports.createPaymentIntent = async (req, res, next) => {
  try {
    const { items, shipping_address } = req.body;
    const userId = req.user?.id || null;

    // Validate cart server-side (never trust client-provided totals)
    const productIds = items.map(i => i.product_id);
    const [products] = await db.query(
      'SELECT id, name, sku, price, stock_quantity FROM products WHERE id IN (?) AND is_active = TRUE',
      [productIds]
    );

    const productMap = {};
    products.forEach(p => { productMap[p.id] = p; });

    let subtotal = 0;
    const lineItems = [];

    for (const item of items) {
      const product = productMap[item.product_id];
      if (!product || product.stock_quantity < item.quantity) {
        return res.status(422).json({ 
          error: 'Cart validation failed', 
          product_id: item.product_id 
        });
      }
      const lineTotal = product.price * item.quantity;
      subtotal += lineTotal;
      lineItems.push({ ...product, quantity: item.quantity, subtotal: lineTotal });
    }

    // Calculate tax (simplified; real implementation uses Stripe Tax or TaxJar)
    const taxRate = 0.06;  // 6% flat tax
    const taxAmount = subtotal * taxRate;
    const shippingAmount = subtotal >= 50 ? 0 : 7.99;  // free shipping over $50
    const totalAmount = subtotal + taxAmount + shippingAmount;

    // Convert to cents (Stripe uses integer cents)
    const amountCents = Math.round(totalAmount * 100);

    // Get or create Stripe customer for authenticated users
    let stripeCustomerId;
    if (userId) {
      const [userRows] = await db.query(
        'SELECT stripe_customer_id, email, first_name, last_name FROM users WHERE id = ?',
        [userId]
      );
      const user = userRows[0];

      if (!user.stripe_customer_id) {
        const customer = await stripe.customers.create({
          email: user.email,
          name: `${user.first_name} ${user.last_name}`,
          metadata: { user_id: String(userId) }
        });
        stripeCustomerId = customer.id;
        await db.query(
          'UPDATE users SET stripe_customer_id = ? WHERE id = ?',
          [customer.id, userId]
        );
      } else {
        stripeCustomerId = user.stripe_customer_id;
      }
    }

    // Create PaymentIntent
    const paymentIntent = await stripe.paymentIntents.create({
      amount: amountCents,
      currency: 'usd',
      customer: stripeCustomerId,
      automatic_payment_methods: { enabled: true },
      metadata: {
        user_id: userId ? String(userId) : 'guest',
        subtotal: subtotal.toFixed(2),
        tax: taxAmount.toFixed(2),
        shipping: shippingAmount.toFixed(2)
      }
    });

    // Create pending order in DB (updated to 'paid' after webhook confirmation)
    const orderNumber = `ORD-${new Date().getFullYear()}-${String(Date.now()).slice(-6)}`;

    const [orderResult] = await db.query(
      `INSERT INTO orders 
       (user_id, order_number, status, subtotal, tax_amount, shipping_amount, 
        total_amount, shipping_name, shipping_address1, shipping_address2,
        shipping_city, shipping_state, shipping_postal, shipping_country,
        guest_email)
       VALUES (?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
      [
        userId, orderNumber, subtotal, taxAmount, shippingAmount, totalAmount,
        shipping_address.name, shipping_address.address1, shipping_address.address2 || null,
        shipping_address.city, shipping_address.state, shipping_address.postal_code,
        shipping_address.country || 'US', shipping_address.email || null
      ]
    );
    const orderId = orderResult.insertId;

    // Insert order items
    for (const item of lineItems) {
      await db.query(
        `INSERT INTO order_items 
         (order_id, product_id, product_name, product_sku, unit_price, quantity, subtotal)
         VALUES (?, ?, ?, ?, ?, ?, ?)`,
        [orderId, item.id, item.name, item.sku, item.price, item.quantity, item.subtotal]
      );
    }

    // Create payment record
    await db.query(
      `INSERT INTO payments 
       (order_id, stripe_payment_intent_id, amount, currency, status)
       VALUES (?, ?, ?, 'usd', 'pending')`,
      [orderId, paymentIntent.id, totalAmount]
    );

    res.json({
      client_secret: paymentIntent.client_secret,
      order_id: orderId,
      order_number: orderNumber,
      summary: {
        subtotal: subtotal.toFixed(2),
        tax: taxAmount.toFixed(2),
        shipping: shippingAmount.toFixed(2),
        total: totalAmount.toFixed(2)
      }
    });

  } catch (error) {
    next(error);
  }
};

// ── POST /api/webhooks/stripe ─────────────────────────────────────────────── 
// Stripe sends server-to-server webhook when payment succeeds/fails
// This is the AUTHORITATIVE payment confirmation source
exports.handleStripeWebhook = async (req, res) => {
  const sig = req.headers['stripe-signature'];
  let event;

  try {
    // Verify webhook signature (prevents forged webhooks)
    event = stripe.webhooks.constructEvent(
      req.body,  // raw body — must NOT be parsed by express.json()
      sig,
      process.env.STRIPE_WEBHOOK_SECRET
    );
  } catch (err) {
    console.error('Webhook signature verification failed:', err.message);
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }

  // Handle event types
  switch (event.type) {
    case 'payment_intent.succeeded': {
      const paymentIntent = event.data.object;

      // Update payment record
      await db.query(
        `UPDATE payments 
         SET status = 'succeeded', 
             stripe_charge_id = ?,
             card_last4 = ?,
             card_brand = ?,
             updated_at = NOW()
         WHERE stripe_payment_intent_id = ?`,
        [
          paymentIntent.latest_charge,
          paymentIntent.payment_method_details?.card?.last4 || null,
          paymentIntent.payment_method_details?.card?.brand || null,
          paymentIntent.id
        ]
      );

      // Update order status and decrement stock
      const [paymentRows] = await db.query(
        'SELECT order_id FROM payments WHERE stripe_payment_intent_id = ?',
        [paymentIntent.id]
      );

      if (paymentRows.length > 0) {
        const orderId = paymentRows[0].order_id;

        await db.query(
          "UPDATE orders SET status = 'paid', paid_at = NOW() WHERE id = ?",
          [orderId]
        );

        // Decrement stock quantities
        const [items] = await db.query(
          'SELECT product_id, quantity FROM order_items WHERE order_id = ?',
          [orderId]
        );

        for (const item of items) {
          await db.query(
            'UPDATE products SET stock_quantity = stock_quantity - ? WHERE id = ?',
            [item.quantity, item.product_id]
          );
        }

        // TODO: Send order confirmation email via SendGrid
      }
      break;
    }

    case 'payment_intent.payment_failed': {
      const paymentIntent = event.data.object;
      await db.query(
        "UPDATE payments SET status = 'failed' WHERE stripe_payment_intent_id = ?",
        [paymentIntent.id]
      );
      break;
    }
  }

  res.json({ received: true });
};