A multi-vendor clothing marketplace

Independent vendors list and sell clothing; shoppers browse, favorite, cart, and check out with Razorpay.

---

Overview

ClothHub is a Node.js / Express / MongoDB marketplace with three account types — shoppers, vendors, and admins — each with their own dashboard and permissions. Vendors list products with multiple color/size variants, shoppers browse, filter, favorite, and buy, and payments are processed through Razorpay (with signature-verified webhooks for reliable order confirmation).

Features

• Three roles, one app — user, vendor, admin, enforced server-side via role middleware, not just hidden UI.
• Auth — email/password (bcrypt + JWT in an httpOnly cookie) and Google OAuth (shopper accounts only).
• Product catalog — category/color/search filtering, paginated results, an /api/products endpoint for dynamic client-side filtering.
• Variants — each product supports multiple colors, each with its own image and per-size stock.
• Cart & favorites — add/remove, quantity adjustment, favorite a product in a specific color.
• Checkout & payments — Razorpay Checkout integration with server-side payment verification, plus a dedicated raw-body webhook route for asynchronous payment confirmation.
• Orders — order history, order detail, retry payment on a pending order, cancel an order.
• Vendor tools — vendor registration/login, vendor dashboard, storefront profile with a public shareable store page.
• Admin panel — view/ban/unban/delete accounts, remove or restore listings from the public catalog.
• Hardened by default — Helmet with a scoped CSP (allow-listing only what Razorpay Checkout needs, via per-request nonces), rate limiting, and input validation on auth/vendor forms.
• Tested — unit tests covering auth, validators, role/permission logic, pagination, and error handling (node --test).

Tech Stack

Layer	Technology
Runtime	Node.js, Express 5
Database	MongoDB (Atlas) via Mongoose
Views	EJS (server-rendered)
Auth	JWT (httpOnly cookie), bcrypt, Passport (Google OAuth 2.0)
Payments	Razorpay (Checkout + Webhooks)
Security	Helmet (CSP w/ nonces), express-rate-limit, express-validator
Uploads	Multer
Testing	Node's built-in test runner (node --test)

Project Structure

cloth-app/
├── app.js                  # App entry point — middleware, CSP, route mounting
├── config/                 # DB connection, Passport strategy, Razorpay client
├── controllers/            # Route handlers (auth, home, product, order, admin, vendor, page)
├── middleware/              # auth (protect/guestOnly), role guard, admin guard, uploads, error handler
├── models/                 # Mongoose schemas: User, Product, Order
├── routes/                 # auth, shop, order, vendor, admin, store, webhook, index
├── validators/             # express-validator rule sets (auth, vendor)
├── views/                  # EJS templates (shopper, vendor/, admin/)
├── public/                 # Static assets — css, js, images
├── scripts/                # One-off ops scripts (see below)
└── test/                   # Unit tests

Getting Started

Prerequisites

• Node.js 18+
• A MongoDB Atlas cluster (or any MongoDB instance)
• A Razorpay account (test mode keys are fine for development)
• A Google Cloud OAuth client (only required if you want Google sign-in)

Installation

git clone <your-repo-url>
cd cloth-app
npm install

Environment variables

Create a .env file in the project root:

# Server
PORT=3000
NODE_ENV=development

# Database
MONGO_URI=mongodb+srv://<user>:<password>@<cluster>.mongodb.net/clothhub?retryWrites=true&w=majority

# Auth
JWT_SECRET=replace-with-a-long-random-string

# Google OAuth (shopper login only)
GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-client-secret
GOOGLE_CALLBACK_URL=http://localhost:3000/auth/google/callback

# Razorpay
RAZORPAY_KEY_ID=your-razorpay-key-id
RAZORPAY_KEY_SECRET=your-razorpay-key-secret
RAZORPAY_WEBHOOK_SECRET=your-razorpay-webhook-secret

In production (e.g. Render), set these as environment variables in your host's dashboard rather than committing .env — it's already git-ignored.

Run it

npm run dev     # nodemon, auto-restarts on change
npm start       # plain node, for production

The app runs at http://localhost:3000 by default.

Seed an admin account

The database starts empty — there's no default admin. Create one (or promote an existing account) with:

node scripts/seedAdmin.js "Admin Name" admin@example.com "somePassword123"

Payments: Razorpay Webhook Setup

The webhook route (POST /webhook/razorpay) verifies Razorpay's signature over the raw request body, so it's deliberately excluded from the app's global JSON body parser.

• Locally: expose your dev server with a tunnel (e.g. ngrok http 3000) and point Razorpay's webhook config at the generated HTTPS URL.
• In production: point it directly at your deployed URL, e.g. https://your-app.onrender.com/webhook/razorpay — no tunnel needed once you have a real public host.

Set the same secret you configure in the Razorpay dashboard as RAZORPAY_WEBHOOK_SECRET.

Roles & Access

Role	Can do
user	Browse, favorite, cart, checkout, pay, view/cancel own orders
vendor	Manage own storefront profile and listings; cannot buy
admin	Ban/unban/delete accounts, remove/restore any listing from the public catalog

Role checks are enforced server-side in middleware/role.js and middleware/admin.js — not just hidden in the UI.

Testing

npm test

Runs the unit test suite (test/) covering auth flows, validators, role/permission logic, pagination edge cases, and error handling.

Deployment Notes

• Set the platform's start command to npm start.
• Ensure the server binds to process.env.PORT (it already does) — most hosts assign this dynamically.
• Add all variables from the Environment variables section to your host's environment settings.
• In MongoDB Atlas → Network Access, allow your host's IP. Hosts without a fixed outbound IP (e.g. Render's free/starter tiers) typically require 0.0.0.0/0.
• Update GOOGLE_CALLBACK_URL and your Razorpay webhook URL to your production domain once deployed.