ক্যাপস্টোন — “দোকানঘর”: একটি full-stack অ্যাপ বানানো ও deploy

dokanghor/
├── package.json            # workspaces: ["web", "api"]
├── .github/workflows/ci.yml
├── web/                    # Vite front end
│   ├── index.html
│   ├── src/  main.js  api.js  cart.js  render.js  styles.css
│   └── tests/  cart.test.js
├── api/                    # Express API
│   ├── src/  app.js  server.js  routes/  services/  repo/  bus.js
│   ├── migrations/  001_init.sql  002_users.sql
│   ├── tests/  orders.test.js
│   └── .env.example        # কোন কোন environment variable লাগে — মান ছাড়া
├── e2e/  checkout.spec.js  # Playwright
└── README.md

{
  "type": "module",
  "scripts": {
    "dev": "node --watch --env-file=.env src/server.js",
    "start": "node src/server.js",
    "migrate": "node scripts/migrate.js",
    "test": "vitest run",
    "lint": "eslint . && prettier --check ."
  }
}

import express from 'express';
import helmet from 'helmet';
import { ordersRouter } from './routes/orders.js';

export function createApp({ service }) {           // dependency বাইরে থেকে — টেস্টে সহজ
  const app = express();
  app.use(helmet());                                 // নিরাপত্তার header
  app.use(express.json({ limit: '20kb' }));          // বড় body আটকায়
  app.get('/healthz', (req, res) => res.json({ ok: true }));
  app.use('/api/orders', ordersRouter(service));
  app.use((err, req, res, next) => {                 // এক জায়গায় সব error
    if (!err.status) req.log?.error(err);            // অপ্রত্যাশিত হলে log
    res.status(err.status ?? 500).json({ error: err.status ? err.message : 'সার্ভারে সমস্যা' });
  });
  return app;
}

CREATE TABLE products (
  id          SERIAL PRIMARY KEY,
  title       TEXT    NOT NULL,
  price_paisa INTEGER NOT NULL CHECK (price_paisa > 0),
  stock       INTEGER NOT NULL CHECK (stock >= 0)
);
CREATE TABLE orders (
  id            SERIAL PRIMARY KEY,
  customer_name TEXT    NOT NULL,
  phone         TEXT    NOT NULL,
  status        TEXT    NOT NULL DEFAULT 'pending'
                CHECK (status IN ('pending','paid','packed','shipped','delivered','cancelled')),
  total_paisa   INTEGER NOT NULL,
  created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE TABLE order_items (
  order_id         INTEGER NOT NULL REFERENCES orders(id),
  product_id       INTEGER NOT NULL REFERENCES products(id),
  qty              INTEGER NOT NULL CHECK (qty > 0),
  unit_price_paisa INTEGER NOT NULL,
  PRIMARY KEY (order_id, product_id)
);

export async function insertOrder(pool, { customer, lines, total }) {
  const db = await pool.connect();                  // pool থেকে একটি সংযোগ ধার
  try {
    await db.query('BEGIN');
    for (const l of lines) {
      const r = await db.query(
        'UPDATE products SET stock = stock - $1 WHERE id = $2 AND stock >= $1', [l.qty, l.productId]);
      if (r.rowCount !== 1) throw new AppError(409, `পণ্য ${l.productId}: স্টক নেই`);
    }
    const { rows: [order] } = await db.query(
      'INSERT INTO orders (customer_name, phone, total_paisa) VALUES ($1, $2, $3) RETURNING *',
      [customer.fullName, customer.phone, total]);
    for (const l of lines) await db.query(
      'INSERT INTO order_items VALUES ($1, $2, $3, $4)', [order.id, l.productId, l.qty, l.price]);
    await db.query('COMMIT');
    return order;
  } catch (e) {
    await db.query('ROLLBACK');                      // মাঝপথের সব বদল বাতিল
    throw e;
  } finally {
    db.release();                                    // সংযোগ pool-এ ফেরত — না দিলে leak
  }
}

import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
import { promisify } from 'node:util';
const scryptAsync = promisify(scrypt);

async function verifyPassword(password, stored) {     // stored = 'salt:hash'
  const [salt, hash] = stored.split(':');
  const test = await scryptAsync(password, salt, 64);
  return timingSafeEqual(test, Buffer.from(hash, 'hex'));   // সময় দেখে আন্দাজ ঠেকায়
}

router.post('/login', loginLimiter, async (req, res) => {
  const user = await repo.findUserByEmail(req.body.email);
  if (!user || !(await verifyPassword(req.body.password, user.password_hash)))
    return res.status(401).json({ error: 'ইমেইল বা পাসওয়ার্ড ভুল' });  // কোনটি ভুল, বলি না
  const sid = randomBytes(32).toString('base64url');
  await repo.createSession(sid, user.id);              // মেয়াদসহ
  res.cookie('sid', sid, { httpOnly: true, secure: true, sameSite: 'lax', maxAge: 8 * 3600e3 });
  res.status(204).end();
});

import { bus } from '../bus.js';                    // node:events-এর EventEmitter

router.get('/:id/live', async (req, res) => {
  const id = Number(req.params.id);
  const order = await service.getOrder(id);          // না থাকলে 404 ছোড়ে
  res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache' });
  const send = (o) => res.write(`id: ${Date.now()}\nevent: status\ndata: ${JSON.stringify(o)}\n\n`);
  send({ id, status: order.status });                // শুরুতেই বর্তমান অবস্থা
  const onStatus = (o) => { if (o.id === id) send(o); };
  bus.on('status', onStatus);
  const ping = setInterval(() => res.write(': ping\n\n'), 25_000);   // proxy যেন সংযোগ না কাটে
  req.on('close', () => { bus.off('status', onStatus); clearInterval(ping); });   // leak ঠেকানো
});

export function watchOrder(id, onStatus) {
  const es = new EventSource(`/api/orders/${id}/live`);
  es.addEventListener('status', (e) => onStatus(JSON.parse(e.data).status));
  return () => es.close();                           // পাতা ছাড়লে বন্ধ করুন
}

const http = require("node:http");
// ===== repository: in-memory "ডেটাবেস" (আসল অ্যাপে PostgreSQL) =====
const db = {
  products: new Map([[1, { id: 1, name: "চাল ৫ কেজি", price: 42000, stock: 3 }],
                     [2, { id: 2, name: "ডাল ১ কেজি", price: 14000, stock: 1 }]]),
  orders: new Map(), nextId: 1,
};
function transaction(work) {                    // সব হবে, নয়তো কিছুই না
  const snapshot = structuredClone(db);
  try { return work(); } catch (e) { Object.assign(db, snapshot); throw e; }
}
// ===== service: ব্যবসার নিয়ম — HTTP চেনে না =====
class AppError extends Error { constructor(status, msg) { super(msg); this.status = status; } }
const NEXT = { pending: ["paid", "cancelled"], paid: ["packed", "cancelled"],
               packed: ["shipped"], shipped: ["delivered"], delivered: [], cancelled: [] };
function placeOrder(items) {
  if (!Array.isArray(items) || items.length === 0) throw new AppError(422, "কার্ট খালি");
  return transaction(() => {
    let total = 0;
    for (const { productId, qty } of items) {
      if (!Number.isInteger(qty) || qty < 1) throw new AppError(422, "qty ভুল");
      const p = db.products.get(productId);
      if (!p) throw new AppError(404, `পণ্য ${productId} নেই`);
      if (p.stock < qty) throw new AppError(409, `${p.name}: স্টক মাত্র ${p.stock}`);
      p.stock -= qty;                           // কমানো শুরু — মাঝপথে ভুল হলে rollback
      total += p.price * qty;
    }
    const order = { id: db.nextId++, items, total, status: "pending" };
    db.orders.set(order.id, order);
    return order;
  });
}
function changeStatus(id, to) {
  const o = db.orders.get(id);
  if (!o) throw new AppError(404, "অর্ডার নেই");
  if (!NEXT[o.status].includes(to)) throw new AppError(409, `${o.status} → ${to} চলবে না`);
  o.status = to;
  return o;
}
// ===== HTTP স্তর: অনুরোধ পড়ে service-কে ডাকে =====
const send = (res, code, data) =>
  res.writeHead(code, { "Content-Type": "application/json", Connection: "close" }).end(JSON.stringify(data));
const server = http.createServer(async (req, res) => {
  try {
    let body = "";
    for await (const chunk of req) body += chunk;
    const data = body ? JSON.parse(body) : {};
    const m = req.url.match(/^\/api\/orders\/(\d+)\/status$/);
    if (req.method === "GET" && req.url === "/api/products") return send(res, 200, [...db.products.values()]);
    if (req.method === "POST" && req.url === "/api/orders") return send(res, 201, placeOrder(data.items));
    if (req.method === "PATCH" && m) return send(res, 200, changeStatus(Number(m[1]), data.status));
    send(res, 404, { error: "এমন পথ নেই" });
  } catch (e) { send(res, e.status ?? 400, { error: e.message }); }
});
// ===== client: নিজের সার্ভারকেই fetch দিয়ে পরীক্ষা =====
server.listen(0, "127.0.0.1", async () => {
  const base = `http://127.0.0.1:${server.address().port}/api`;
  const call = async (method, path, body) => {
    const r = await fetch(base + path, { method, headers: { "Content-Type": "application/json" },
      body: body && JSON.stringify(body) });
    return [r.status, await r.json()];
  };
  const show = ([code, d]) => console.log(code, d.error ?? `#${d.id} ${d.status} ${d.total}`);
  show(await call("POST", "/orders", { items: [{ productId: 1, qty: 2 }] }));
  show(await call("POST", "/orders", { items: [{ productId: 1, qty: 1 }, { productId: 2, qty: 5 }] }));
  const [, list] = await call("GET", "/products");
  console.log("স্টক:", list.map((p) => `${p.name}=${p.stock}`).join(", "));
  show(await call("POST", "/orders", { items: [] }));
  show(await call("PATCH", "/orders/1/status", { status: "shipped" }));
  for (const s of ["paid", "packed", "shipped", "delivered"]) show(await call("PATCH", "/orders/1/status", { status: s }));
  show(await call("PATCH", "/orders/1/status", { status: "cancelled" }));
  server.close();
});

const tk = new Intl.NumberFormat('bn-BD', { style: 'currency', currency: 'BDT' });
const money = (paisa) => tk.format(paisa / 100);
const PRODUCTS = [{ id: 1, title: 'চাল ৫ কেজি', price: 42000 }, { id: 2, title: 'ডাল ১ কেজি', price: 14000 },
                  { id: 3, title: 'চা-পাতা', price: 9550 }];
// ===== নকল API — আসল অ্যাপে এখানে fetch('/api/orders', …) =====
const api = {
  stock: { 1: 3, 2: 1, 3: 10 }, nextId: 101,
  async placeOrder(lines) {
    const short = lines.find((l) => l.qty > this.stock[l.id]);
    if (short) throw new Error(`${short.title}: স্টক মাত্র ${this.stock[short.id]}টি`);
    lines.forEach((l) => { this.stock[l.id] -= l.qty; });
    return { id: this.nextId++, status: 'pending' };
  },
};
// ===== pure core: কার্ট = { productId: qty } =====
const addItem = (cart, id) => ({ ...cart, [id]: (cart[id] ?? 0) + 1 });
const removeItem = (cart, id) => {
  const { [id]: qty = 0, ...rest } = cart;
  return qty > 1 ? { ...rest, [id]: qty - 1 } : rest;
};
const toLines = (cart) => Object.entries(cart).map(([id, qty]) => ({ ...PRODUCTS.find((p) => p.id === +id), qty }));
const sum = (lines) => lines.reduce((s, l) => s + l.price * l.qty, 0);
function validateCustomer({ fullName, phone }) {
  if (fullName.trim().length < 2) return 'নাম লিখুন';
  if (!/^01[3-9]\d{8}$/.test(phone)) return 'মোবাইল নম্বর ০১ দিয়ে শুরু, ১১ অঙ্কের হতে হবে';
  return null;
}
// ===== thin UI shell =====
let cart = {};
const $ = (sel) => document.querySelector(sel);
function render() {
  $('#shop').replaceChildren(...PRODUCTS.map((p) => Object.assign(document.createElement('button'),
    { type: 'button', textContent: `+ ${p.title} ${money(p.price)}`, value: `add:${p.id}` })));
  const lines = toLines(cart);
  $('#cart').replaceChildren(...lines.map((l) => {
    const li = document.createElement('li');
    li.textContent = `${l.title} × ${l.qty} = ${money(l.price * l.qty)} `;
    li.append(Object.assign(document.createElement('button'), { type: 'button', textContent: '−', value: `rm:${l.id}` }));
    return li;
  }));
  $('#total').textContent = lines.length ? `মোট ${money(sum(lines))}` : 'কার্ট খালি';
  $('#pay').disabled = lines.length === 0;
}
document.body.addEventListener('click', (ev) => {        // event delegation
  const [act, id] = (ev.target.value ?? '').split(':');
  if (act === 'add') cart = addItem(cart, id);
  if (act === 'rm') cart = removeItem(cart, id);
  if (act === 'add' || act === 'rm') render();
});
async function checkout() {
  const error = validateCustomer({ fullName: $('#fullName').value, phone: $('#phone').value });
  if (error) return ($('#msg').textContent = error);
  $('#pay').disabled = true;
  $('#msg').textContent = 'পাঠানো হচ্ছে…';
  try {
    const order = await api.placeOrder(toLines(cart));
    cart = {};
    $('#msg').textContent = `অর্ডার #${order.id} নেওয়া হয়েছে — অবস্থা: ${order.status}`;
  } catch (e) {
    $('#msg').textContent = e.message;
  }
  render();
  return $('#msg').textContent;
}
$('#form').addEventListener('submit', (ev) => { ev.preventDefault(); checkout(); });
render();
// ===== scripted demo: একই ক্রমে বোতাম চাপা, তাই আউটপুট সবসময় একই =====
(async () => {
  const press = (v) => document.querySelector(`button[value="${v}"]`).click();
  ['add:1', 'add:1', 'add:3', 'rm:1'].forEach(press);
  console.log($('#total').textContent, JSON.stringify(cart));
  $('#fullName').value = 'রাফি'; $('#phone').value = '0171234567';
  console.log(await checkout());
  $('#phone').value = '01712345678';
  console.log(await checkout());
  ['add:2', 'add:2'].forEach(press);
  console.log(await checkout(), '|', $('#total').textContent);
})();

import request from 'supertest';
import { describe, it, expect, beforeEach } from 'vitest';
import { createApp } from '../src/app.js';
import { makeService } from '../src/services/orders.js';
import { pool, resetDb } from './db.js';               // টেস্টের আলাদা ডেটাবেস

const app = createApp({ service: makeService(pool) });
beforeEach(() => resetDb({ products: [{ id: 1, title: 'চাল', price_paisa: 42000, stock: 1 }] }));

describe('POST /api/orders', () => {
  it('স্টকের বেশি চাইলে 409, আর স্টক অপরিবর্তিত', async () => {
    await request(app).post('/api/orders')
      .send({ customer: { fullName: 'রাফি', phone: '01712345678' }, items: [{ productId: 1, qty: 2 }] })
      .expect(409);
    const { rows } = await pool.query('SELECT stock FROM products WHERE id = 1');
    expect(rows[0].stock).toBe(1);
  });
});

import { test, expect } from '@playwright/test';

test('ক্রেতা একটি অর্ডার দিতে পারেন', async ({ page }) => {
  await page.goto('/');
  await page.getByRole('button', { name: /চাল ৫ কেজি/ }).click();
  await page.getByLabel('নাম').fill('রাফি');
  await page.getByLabel('মোবাইল').fill('01712345678');
  await page.getByRole('button', { name: 'অর্ডার দিন' }).click();
  await expect(page.getByRole('status')).toContainText('অর্ডার #');
});

name: ci
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env: { POSTGRES_PASSWORD: test }
        ports: ['5432:5432']
        options: --health-cmd pg_isready --health-interval 5s --health-retries 10
    env:
      DATABASE_URL: postgres://postgres:test@localhost:5432/postgres
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 24, cache: npm }
      - run: npm ci                      # lockfile হুবহু মেনে install
      - run: npm run lint
      - run: npm run migrate -w api
      - run: npm test --workspaces
      - run: npx playwright install --with-deps chromium && npm run e2e
      - run: npm run build -w web

NODE_ENV=production
PORT=3000
DATABASE_URL=postgres://USER:PASSWORD@HOST:5432/dokanghor
SESSION_SECRET=লম্বা-এলোমেলো-মান-এখানে-নয়-secret-store-এ
WEB_ORIGIN=https://dokanghor.com

FROM node:24-slim
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev          # শুধু production dependency
COPY src ./src
COPY migrations ./migrations
USER node                      # root হিসেবে নয়
ENV NODE_ENV=production
EXPOSE 3000
CMD ["node", "src/server.js"]

server {
  server_name dokanghor.com;
  root /var/www/dokanghor/dist;                  # Vite-এর build
  location / { try_files $uri /index.html; }     # SPA-র সব পথে index.html
  location /api/ {
    proxy_pass http://127.0.0.1:3000;            # Node শুধু localhost-এ শোনে
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Connection '';
    proxy_buffering off;                         # SSE-র বার্তা সাথে সাথে যাক
    proxy_read_timeout 1h;
  }
}

npm ci --omit=dev && npm run migrate
pm2 start src/server.js --name dokanghor-api    # crash হলে নিজে থেকে আবার চালু
pm2 startup && pm2 save                         # সার্ভার reboot-এর পরও চালু
sudo certbot --nginx -d dokanghor.com           # Let's Encrypt থেকে HTTPS certificate
sudo ufw allow 'Nginx Full' && sudo ufw allow OpenSSH