Loading repository data…
Loading repository data…
SagarBiswas-MultiHAT / repository
BazaarFlow is a production-ready full-stack e-commerce monorepo with a Next.js storefront and admin panel, NestJS API, product catalog, cart, checkout, orders, coupons, inventory, analytics, reviews, Stripe and bKash payments, Meilisearch search, Supabase storage, Redis caching, and Brevo emails.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
BazaarFlow is a full-stack e-commerce project built as a real-world style monorepo:
This README is intentionally detailed so one developer can understand the project end-to-end without opening other docs.
data + meta)| Area | Highlights |
|---|---|
| Storefront | Product listing, product detail, search, cart, checkout, account |
| Admin | Dashboard, products, categories, orders, customers, coupons, inventory, analytics |
| Auth | Customer JWT + refresh cookies, admin auth + TOTP |
| Payments | Stripe intent + webhook, bKash create/execute/callback |
| Search | Meilisearch indexing + database fallback |
| Messaging | Brevo welcome/order/password/cart emails |
| Storage | Supabase Storage upload endpoints |
| Infra | Vercel + Railway + Cloudflare deployment path |
Browser (Storefront/Admin)
|
v
Frontend: Next.js (Vercel)
|
v
Backend: NestJS API (Railway)
| | | | |
v v v v v
Postgres Supabase Meilisearch Redis Stripe/bKash
(Supabase) Storage (catalog) cache + Brevo email
ecommerce-app/
├── backend/ NestJS API
├── frontend/ Next.js app (store + admin)
├── shared/ Shared TypeScript types
├── docs/ Setup references (Cloudflare, env guide)
├── .env.example Canonical variable template
├── package.json Workspace scripts
└── README.md This file
Run from ecommerce-app root:
npm install
Use whichever Meilisearch command you prefer.
Without explicit master key:
docker run -p 7700:7700 -v "$(pwd)/meili_data:/meili_data" getmeili/meilisearch:latest
With explicit master key:
docker run -p 7700:7700 -v "$(pwd)/meili_data:/meili_data" getmeili/meilisearch:latest --master-key O99aNSnbzPaW5AhLq3nTRTReATTcwo767A3toR1XpmU
Redis:
docker run -d --name redis-cache -p 6379:6379 redis:7-alpine
If you are using PowerShell and volume syntax acts up, use:
docker run -p 7700:7700 -v "${PWD}/meili_data:/meili_data" getmeili/meilisearch:latest
From root (ecommerce-app):
# Linux/macOS
cp .env.example backend/.env
# PowerShell
Copy-Item .env.example backend/.env
Create frontend local file manually:
frontend/.env.local
Add at least:
NEXT_PUBLIC_API_URL=http://localhost:3001
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_xxx
NEXT_PUBLIC_MEILISEARCH_URL=http://localhost:7700
NEXT_PUBLIC_MEILISEARCH_SEARCH_KEY=your_search_key
NEXT_PUBLIC_GA_MEASUREMENT_ID=G-XXXXXXX
From root:
cd backend
node -e "const bcrypt = require('bcrypt'); bcrypt.hash('your_password_here', 10).then(hash => console.log(hash))"
Copy output into ADMIN_PASSWORD_HASH in backend/.env.
From root in separate terminals:
npm run dev:backend
npm run dev:frontend
URLs:
http://localhost:3000http://localhost:3000/admin/loginhttp://localhost:3001http://localhost:3001/healthnpm run dev:frontend
npm run dev:backend
npm run build:frontend
npm run build:backend
npm run lint:frontend
npm run test:backend
cd backend
npm run build
npm run start:dev
npm run start:prod
npm run lint
npm run test
npm run test:e2e
npm run test:cov
cd frontend
npm run dev
npm run build
npm run start
npm run lint
npm run test
# Stop and remove Redis container
docker stop redis-cache
docker rm redis-cache
# Run Redis again
docker run -d --name redis-cache -p 6379:6379 redis:7-alpine
# Run Meilisearch (basic)
docker run -p 7700:7700 -v "$(pwd)/meili_data:/meili_data" getmeili/meilisearch:latest
# Run Meilisearch with master key
docker run -p 7700:7700 -v "$(pwd)/meili_data:/meili_data" getmeili/meilisearch:latest --master-key O99aNSnbzPaW5AhLq3nTRTReATTcwo767A3toR1XpmU
This section explains each variable in practical terms.
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
NODE_ENV | Runtime mode (development/production) | Enables correct behavior (logs, perf, security modes) | Set manually |
PORT | Backend port | Needed so API binds to expected port | Local: 3001; Railway can auto-set |
FRONTEND_URL | Allowed frontend origin | Used by CORS and callback URL generation | Local: http://localhost:3000, prod: your Vercel domain |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
DATABASE_URL | PostgreSQL connection string | TypeORM uses it for all DB reads/writes | Supabase Project -> Database -> Connection string (pooler) |
SUPABASE_URL | Supabase project URL | Required for storage client initialization | Supabase Project -> Settings -> API -> Project URL |
SUPABASE_SERVICE_ROLE_KEY | Supabase service key | Required for privileged storage uploads/deletes | Supabase Project -> Settings -> API -> service role key |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
JWT_SECRET | Access-token signing secret | Prevents token forgery | Generate: openssl rand -hex 32 |
JWT_EXPIRY | Access-token lifetime | Balances security + UX | Set manually, e.g. 15m |
REFRESH_TOKEN_SECRET | Refresh-token signing secret | Separates refresh and access token trust | Generate: openssl rand -hex 32 |
REFRESH_TOKEN_EXPIRY | Refresh-token lifetime | Controls session length | Set manually, e.g. 30d |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
ADMIN_EMAIL | Admin login email | Protects admin access path | Set your admin mailbox |
ADMIN_PASSWORD_HASH | bcrypt hash of admin password | Never store admin password in plaintext | Generate with the Node/bcrypt command above |
ADMIN_ALLOWED_IPS | Comma-separated allowlist for admin routes | Optional hardening for admin area | Put office/VPN static IPs, or leave empty in local dev |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
STRIPE_SECRET_KEY | Server-side Stripe API key | Needed for payment intent creation and server calls | Stripe Dashboard -> Developers -> API keys |
STRIPE_WEBHOOK_SECRET | Stripe signature secret | Required for secure webhook verification | Stripe Dashboard -> Developers -> Webhooks |
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY | Browser-safe Stripe key | Needed by frontend Stripe components | Stripe Dashboard -> Developers -> API keys |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
BKASH_APP_KEY | bKash app key | Required for bKash token and payment APIs | bKash merchant portal |
BKASH_APP_SECRET | bKash app secret | Required for secure API auth | bKash merchant portal |
BKASH_USERNAME | bKash username | Required for tokenized API calls | bKash merchant portal |
BKASH_PASSWORD | bKash password | Required for tokenized API calls | bKash merchant portal |
BKASH_BASE_URL | bKash endpoint base | Switches sandbox vs production | Use sandbox during development |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
BREVO_API_KEY | Email API auth | Required to send transactional emails | Brevo Dashboard -> SMTP & API -> API keys |
SENDER_EMAIL | Email sender address | Required by provider and templates | Create/verify sender in Brevo |
SENDER_NAME | Sender display name | Better deliverability + branding clarity | Set manually |
BRAND_COLOR | Template accent color | Keeps transactional mails on-brand | Set manually (#RRGGBB) |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
MEILISEARCH_URL | Search server URL | Required for backend indexing/search | Local: http://localhost:7700 |
MEILISEARCH_API_KEY | Admin/search API key | Required for backend index management and queries | Meilisearch master key or cloud key |
NEXT_PUBLIC_MEILISEARCH_URL | Browser search endpoint | Needed if frontend sends search traffic directly | Typically same as MEILISEARCH_URL in local |
NEXT_PUBLIC_MEILISEARCH_SEARCH_KEY | Browser-safe search-only key | Prevents exposing admin key in frontend | Create search key in Meilisearch |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
UPSTASH_REDIS_URL | Redis endpoint | Cache module uses it for endpoint caching | Upstash dashboard or local redis URL |
UPSTASH_REDIS_TOKEN | Redis auth token/password | Required when redis requires auth | Upstash dashboard token |
| Variable | What it controls | Why it exists | How to get value |
|---|---|---|---|
NEXT_PUBLIC_API_URL | API base URL in browser | All frontend API requests depend on it | Local: http://localhost:3001, pro |