AURELIA — Luxury Fashion E-Commerce (VELOUR)

A production-grade luxury fashion storefront + admin console — a functional superset of the reference prototype pastel-aurelia-fashion-edit.base44.app with resting-state visual parity: full catalog, cart, guest+member checkout, wishlist, customer accounts, and a role-gated admin, where the reference shipped inert buttons and two pages.

Overview

The reference site is a polished visual prototype: working login, cart drawer and search overlay — but every commerce action (Add to Bag, category cards, wishlist) is inert, and every catalog route 404s. This codebase reproduces its look (measured computed styles: Cormorant Garamond + Montserrat — every heading rank, card names included, renders the display serif — warm-paper palette, gold accents, per-slide left/right/center-anchored hero with a horizontal push transition, the brand marquee strip, the composite Exclusive Deals section — merged header row with the right-stacked live countdown + bento tiles + inline sale grid, fixed-width product-row cards with the measured text stack (Cormorant name, stroke stars, color swatches, size chips, discount chips), the five-item w-80 mobile drawer with flex gap-5 stacking) on a real architecture — Next.js 16 App Router, server actions as the single mutation seam, Prisma/SQLite persistence, scrypt+session auth — and makes every interaction real.

Key Features

Architecture

Browser ── RSC pages (force-dynamic)
   │        └─ Server Actions (only mutation seam, Zod-validated)
   │             └─ Prisma ── SQLite (db/custom.db, schema-relative URL)
   └─ StoreProvider (single client seam; re-syncs from action DTOs)

Deep dive: Project_Architecture_Document.md · agent handbook: AGENTS.md · CLAUDE.md · distilled engineering skill: luxury-fashion-store_SKILL.md

Quick Start

Prerequisites: Node.js ≥ 20 (tested on 24), npm.

git clone [email protected]:nordeim/luxury-fashion-store.git
cd luxury-fashion-store
npm install
npm run db:setup      # create + seed db/custom.db (12 products, demo users)
npm run dev           # http://localhost:3000

Verify: curl localhost:3000/api/health → {"ok":true,"db":true}.

Demo accounts (printed on /login in development only — hidden in production builds since session 3, F-5):

Testing

npm run verify        # typecheck → lint → vitest (173) → production build
npm run test:e2e      # Playwright: boots the production standalone (build FIRST — 118 cases × 2 projects, +2 setup)
npx playwright test tests/e2e/mobile-navigation.spec.ts   # single spec
npx vitest run src/lib/money.test.ts                      # single unit file

The E2E suite boots the production standalone on :3100 against its own db/e2e.db; run npm run build first whenever source changed. Mobile coverage runs the same Chromium engine on the iPhone 14 profile (the one desktop-only geometry pin skips there). Global setup re-seeds the scratch DB and wipes transient state (carts/wishlists/sessions) so every run starts canonical.

Environment Variables

Production Build & Deploy

npm run build          # next build + scripts/assemble-standalone.mjs
PORT=3000 NODE_ENV=production AUTH_SECRET= DATABASE_URL="file:/db/custom.db" \
  node .next/standalone/server.js

output: "standalone" emits a self-contained server; the build’s assemble step copies .next/static + public/ into it (the step the Next.js docs require). On a real deployment pass an absolute DATABASE_URL — file tracing copies prisma/schema.prisma into the bundle, which would re-anchor a relative URL to a nonexistent /db/ path. Security headers (Referrer-Policy, nosniff, HSTS, X-Frame-Options: DENY) ship from next.config.ts; the CSP is minted per-request with a nonce by src/proxy.ts (production script-src 'self' 'nonce-…' — no unsafe-inline; dev keeps the React-runtime escape hatch), pinned by src/lib/csp.ts unit tests + the security-csp.spec.ts E2E gate. If you set TRUST_PROXY=1, the proxy must overwrite (not append) x-forwarded-for — the rate limiter reads the first hop.

Project Status

License

Proprietary — internal reference implementation.