# Clone the repo git clone https://github.com/zenska/backend.git cd backend # Install all dependencies npm install # Copy env template — NEVER commit the real .env cp .env.example .env # Now open .env and fill in your local values # Run Prisma migrations (creates tables in local Postgres) npx prisma migrate dev # Seed ingredient compatibility data npx prisma db seed # Start development server with hot reload npm run dev # → Server running at http://localhost:3000

# Create your feature branch — always from staging git checkout staging git pull origin staging git checkout -b feature/yourname-what-you-built # Good branch name examples: feature/jay-typesense-sync feature/maria-auth-endpoints feature/carlo-cod-validation # Branch hierarchy: main ← production · auto-deploys to Railway · seniors merge here only staging ← test here first · all PRs target this branch feature/* ← your daily work

# ── Server ── NODE_ENV=development PORT=3000 # ── Database (Railway auto-fills these in production) ── DATABASE_URL="postgresql://postgres:password@localhost:5432/zenska_dev" REDIS_URL="redis://localhost:6379" # ── Auth ── JWT_SECRET="run: openssl rand -hex 32" JWT_EXPIRES_IN="7d" # ── WooCommerce (read-only REST API) ── WC_BASE_URL="https://zenska.ph/wp-json/wc/v3" WC_CONSUMER_KEY="ck_..." WC_CONSUMER_SECRET="cs_..." # ── Typesense ── TYPESENSE_HOST="xxx.a1.typesense.net" TYPESENSE_PORT="443" TYPESENSE_PROTOCOL="https" TYPESENSE_API_KEY="your-admin-api-key" TYPESENSE_SEARCH_KEY="your-search-only-key" # ── PayMongo ── PAYMONGO_SECRET_KEY="sk_test_..." PAYMONGO_PUBLIC_KEY="pk_test_..." PAYMONGO_WEBHOOK_SECRET="whsk_..." # ── SMS (Semaphore PH) ── SEMAPHORE_API_KEY="your-key" SEMAPHORE_SENDER_NAME="ZENSKA" # ── Email (Resend) ── RESEND_API_KEY="re_..." EMAIL_FROM="orders@zenska.ph" # ── AWS S3 ── AWS_BUCKET_NAME="zenska-media" AWS_REGION="ap-southeast-1" AWS_ACCESS_KEY_ID="AKIA..." AWS_SECRET_ACCESS_KEY="..."

# Install Railway CLI npm install -g @railway/cli # Login railway login # Link your local project to Railway railway link # Run Prisma migrations on production Railway database railway run npx prisma migrate deploy # Open a shell into your production container railway shell # View live production logs railway logs # Get a specific environment variable value railway variables get DATABASE_URL

generator client { provider = "prisma-client-js" } datasource db { provider = "postgresql" url = env("DATABASE_URL") } model User { id String @id @default(cuid()) email String @unique phone String? @unique password String name String createdAt DateTime @default(now()) orders Order[] skinProfile SkinProfile? } model Order { id String @id @default(cuid()) userId String user User @relation(fields: [userId], references: [id]) wcOrderRef String? // WC order ID — bridge field status OrderStatus @default(PENDING) paymentMethod String // COD | GCASH | CARD totalAmount Float codEligible Boolean @default(false) createdAt DateTime @default(now()) items OrderItem[] settlement Settlement? } model OrderItem { id String @id @default(cuid()) orderId String order Order @relation(fields: [orderId], references: [id]) wcProductId Int vendorId String name String price Float quantity Int } model SkinProfile { id String @id @default(cuid()) userId String @unique user User @relation(fields: [userId], references: [id]) skinType String concerns String[] lastScanned DateTime @default(now()) } model Settlement { id String @id @default(cuid()) orderId String @unique order Order @relation(fields: [orderId], references: [id]) vendorId String grossAmount Float commission Float // 8% of grossAmount netAmount Float settledAt DateTime? status String @default("pending") } enum OrderStatus { PENDING CONFIRMED SHIPPED DELIVERED CANCELLED REFUNDED }

# Development — creates migration file + applies it to local DB npx prisma migrate dev --name add-settlements # Production on Railway — applies pending migrations only railway run npx prisma migrate deploy # View all data in browser GUI npx prisma studio # → Opens at http://localhost:5555 # Reset local database (NEVER on production) npx prisma migrate reset

import prisma from '../lib/prisma.js' import redis from '../lib/redis.js' import { tsClient } from '../lib/typesense.js' app.get('/health', async (req, reply) => { const checks = {} // Check Postgres try { await prisma.$queryRaw`SELECT 1` checks.postgres = 'ok' } catch { checks.postgres = 'error' } // Check Redis try { await redis.ping() checks.redis = 'ok' } catch { checks.redis = 'error' } // Check Typesense try { await tsClient.health.retrieve() checks.typesense = 'ok' } catch { checks.typesense = 'error' } const allOk = Object.values(checks).every(v => v === 'ok') reply.status(allOk ? 200 : 503).send({ status: allOk ? 'healthy' : 'degraded', checks }) }) // Test it: GET http://localhost:3000/health // Expected: { "status": "healthy", "checks": { "postgres": "ok", "redis": "ok", "typesense": "ok" } }

npm install node-cron

import cron from 'node-cron' import { syncProductsToTypesense } from './modules/search/sync.job.js' // Run sync every 30 minutes cron.schedule('*/30 * * * *', () => { syncProductsToTypesense().catch(console.error) }) // Also run once on startup to populate on fresh deploy syncProductsToTypesense().catch(console.error)

// Add to your theme's JS file (enqueued via functions.php) document.addEventListener('DOMContentLoaded', () => { const searchInput = document.querySelector('.search-field') const resultsContainer = document.getElementById('search-results-dropdown') if (!searchInput) return let debounceTimer searchInput.addEventListener('input', (e) => { clearTimeout(debounceTimer) debounceTimer = setTimeout(async () => { const q = e.target.value.trim() if (q.length < 2) { resultsContainer.innerHTML = ''; return } const res = await fetch(`https://api.zenska.ph/api/search?q=${encodeURIComponent(q)}&per_page=5`) const { hits } = await res.json() resultsContainer.innerHTML = hits.map(p => ` <a href="/product/${p.id}" class="search-result-item"> <img src="${p.image_url}" width="40" height="40"> <div> <div class="sr-name">${p.name}</div> <div class="sr-price">₱${p.price.toLocaleString()}</div> </div> </a>`).join('') }, 250) // 250ms debounce }) })

const res = pm.response.json() if (res.data?.token) { pm.environment.set("jwt_token", res.data.token) console.log("✓ JWT saved to environment") } pm.test("Status 200", () => pm.response.to.have.status(200)) pm.test("Has token", () => pm.expect(res.data).to.have.property('token'))

export function checkCODEligibility({ cartItems, cartTotal, user }) { // Rule 1: Total must not exceed ₱2,000 if (cartTotal > 2000) { return { eligible: false, reason: 'COD_LIMIT_EXCEEDED', message: `Cart total ₱${cartTotal} exceeds ₱2,000 COD limit` } } // Rule 2: Every item must be tagged COD eligible by vendor const blocked = cartItems.filter(item => !item.cod_eligible) if (blocked.length > 0) { return { eligible: false, reason: 'ITEMS_NOT_COD_ELIGIBLE', items: blocked.map(i => i.name) } } // Rule 3: New accounts (less than 7 days old) limited to ₱1,000 const accountAgeDays = (Date.now() - new Date(user.createdAt)) / 86400000 if (accountAgeDays < 7 && cartTotal > 1000) { return { eligible: false, reason: 'NEW_ACCOUNT_COD_LIMIT', message: 'New accounts are limited to ₱1,000 for COD orders' } } return { eligible: true } }

# Before (Railway) — these 2 lines change DATABASE_URL="postgresql://postgres:pass@containers.railway.app:5894/railway" REDIS_URL="redis://default:pass@containers.railway.app:6380" # After (AWS) — only these 2 lines are different DATABASE_URL="postgresql://zenska:pass@zenska.abc123.ap-southeast-1.rds.amazonaws.com:5432/zenska" REDIS_URL="redis://zenska-cache.abc123.0001.apse1.cache.amazonaws.com:6379" # Everything else — TYPESENSE, PAYMONGO, JWT_SECRET, S3 — stays identical

# Dump Railway Postgres and restore into RDS in one pipe # Takes under 5 minutes for Zenska's early data size pg_dump $(railway variables get DATABASE_URL) \ | psql "postgresql://zenska:pass@your-rds-endpoint:5432/zenska" # Run Prisma migrations on RDS to ensure schema is current DATABASE_URL="postgresql://zenska:pass@your-rds:5432/zenska" \ npx prisma migrate deploy

// Use Fastify's built-in pino logger — already included // Just configure it to output structured JSON in production const app = Fastify({ logger: { level: process.env.NODE_ENV === 'production' ? 'info' : 'debug', serializers: { req(req) { return { method: req.method, url: req.url, userId: req.user?.id } } } } }) // In route handlers — use req.log instead of console.log app.get('/api/orders/:id', async (req, reply) => { req.log.info({ orderId: req.params.id, userId: req.user.id }, 'Order requested') // Railway stores these as searchable JSON — you can filter by userId, orderId, etc. })

model FraudSignal { id String @id @default(cuid()) userId String? phone String? addressHash String? // hashed delivery address for privacy ipAddress String? signalType String // COD_REFUSED | FAKE_ADDRESS | VELOCITY | NEW_ACCOUNT_LIMIT orderId String? riskScore Int @default(0) note String? createdAt DateTime @default(now()) resolvedAt DateTime? resolvedBy String? @@index([phone]) @@index([addressHash]) @@index([userId]) } model BlockedEntity { id String @id @default(cuid()) entityType String // PHONE | ADDRESS_HASH | USER_ID | IP entityValue String reason String blockedBy String // admin user ID who blocked blockedAt DateTime @default(now()) expiresAt DateTime? isActive Boolean @default(true) @@unique([entityType, entityValue]) @@index([entityType, entityValue, isActive]) }

import prisma from '../../lib/prisma.js' import redis from '../../lib/redis.js' import crypto from 'crypto' import * as Sentry from '@sentry/node' // Hash address for privacy (we compare hashes, not raw addresses) function hashAddress(address) { return crypto.createHash('sha256') .update(address.toLowerCase().replace(/\s+/g, ' ').trim()) .digest('hex') } export async function calculateFraudRisk({ userId, phone, address, cartTotal, ip }) { let riskScore = 0 const signals = [] const addressHash = hashAddress(address) // ── CHECK 1: Is this entity already blocked? ── const blocked = await prisma.blockedEntity.findFirst({ where: { isActive: true, OR: [ { entityType: 'PHONE', entityValue: phone }, { entityType: 'ADDRESS_HASH', entityValue: addressHash }, { entityType: 'USER_ID', entityValue: userId }, { entityType: 'IP', entityValue: ip }, ] } }) if (blocked) { return { blocked: true, reason: blocked.reason, riskScore: 100 } } // ── CHECK 2: COD refusal history on this phone ── const phoneRefusals = await prisma.fraudSignal.count({ where: { phone, signalType: 'COD_REFUSED', createdAt: { gte: new Date(Date.now() - 30 * 86400000) } } }) if (phoneRefusals >= 3) { riskScore += 50; signals.push('3+ COD refusals this month') } else if (phoneRefusals >= 1) { riskScore += 20; signals.push(`${phoneRefusals} COD refusal(s)`) } // ── CHECK 3: COD refusal history on this address ── const addressRefusals = await prisma.fraudSignal.count({ where: { addressHash, signalType: 'COD_REFUSED', createdAt: { gte: new Date(Date.now() - 30 * 86400000) } } }) if (addressRefusals >= 2) { riskScore += 40; signals.push('Multiple refusals at this address') } // ── CHECK 4: Velocity — too many orders today from same phone ── const velocityKey = `codvelocity:${phone}:${new Date().toDateString()}` const todayOrders = parseInt(await redis.get(velocityKey) || '0') if (todayOrders >= 3) { riskScore += 35; signals.push('3+ COD orders today same phone') } else if (todayOrders >= 2) { riskScore += 15; signals.push('2 COD orders today same phone') } // ── CHECK 5: New account + high cart value ── const user = await prisma.user.findUnique({ where: { id: userId } }) const accountAgeDays = (Date.now() - new Date(user.createdAt)) / 86400000 if (accountAgeDays < 3 && cartTotal > 800) { riskScore += 30; signals.push('Account under 3 days old, high cart value') } // ── CHECK 6: No prior successful orders ── const successfulOrders = await prisma.order.count({ where: { userId, status: 'DELIVERED' } }) if (successfulOrders === 0 && cartTotal > 1200) { riskScore += 15; signals.push('No prior successful orders, high value') } // ── DECISION ── const decision = riskScore >= 70 ? 'BLOCK' : riskScore >= 40 ? 'REVIEW' : riskScore >= 20 ? 'FLAG' : 'ALLOW' if (decision !== 'ALLOW') { Sentry.captureMessage(`COD fraud signal: ${decision}`, 'warning', { extra: { userId, phone, cartTotal, riskScore, signals } }) } return { blocked: decision === 'BLOCK', decision, riskScore, signals } }

// Called from logistics webhook handler when status = 'delivery_failed' export async function recordCODRefusal(orderId) { const order = await prisma.order.findUnique({ where: { id: orderId }, include: { user: true } }) if (!order || order.paymentMethod !== 'COD') return // Log the fraud signal await prisma.fraudSignal.create({ data: { userId: order.userId, phone: order.user.phone, addressHash: hashAddress(order.deliveryAddress), signalType: 'COD_REFUSED', orderId: orderId, riskScore: 25, note: 'COD delivery refused by recipient' } }) // Update velocity counter (expires in 7 days) const countKey = `codrefusals:${order.user.phone}` await redis.incr(countKey) await redis.expire(countKey, 7 * 86400) // Auto-block if this phone has 3+ refusals this month const recentRefusals = await prisma.fraudSignal.count({ where: { phone: order.user.phone, signalType: 'COD_REFUSED', createdAt: { gte: new Date(Date.now() - 30 * 86400000) } } }) if (recentRefusals >= 3) { await prisma.blockedEntity.upsert({ where: { entityType_entityValue: { entityType: 'PHONE', entityValue: order.user.phone } }, create: { entityType: 'PHONE', entityValue: order.user.phone, reason: 'Auto-blocked: 3+ COD refusals in 30 days', blockedBy: 'SYSTEM' }, update: { isActive: true, reason: 'Auto-blocked: 3+ COD refusals in 30 days' } }) Sentry.captureMessage(`Auto-blocked phone ${order.user.phone} after 3 refusals`, 'warning') } }

import { checkCODEligibility } from './orders.service.js' import { calculateFraudRisk } from './fraud.service.js' fastify.post('/api/orders', { preHandler: [authMiddleware, validateMiddleware(orderSchema)] }, async (req, reply) => { const { cartItems, cartTotal, address, paymentMethod } = req.body // Step 1: COD eligibility (existing logic) if (paymentMethod === 'COD') { const eligibility = checkCODEligibility({ cartItems, cartTotal, user: req.user }) if (!eligibility.eligible) { return reply.status(400).send({ success: false, error: { code: eligibility.reason, message: eligibility.message } }) } // Step 2: Fraud risk check (new) const fraud = await calculateFraudRisk({ userId: req.user.id, phone: req.user.phone, address, cartTotal, ip: req.ip }) if (fraud.blocked) { return reply.status(403).send({ success: false, error: { code: 'COD_BLOCKED', message: 'COD is not available for this order. Please use online payment.' } }) } if (fraud.decision === 'REVIEW') { // Allow order but flag for manual review — don't block the customer req.fraudFlag = { riskScore: fraud.riskScore, signals: fraud.signals } } } // Step 3: Create order (existing logic) // ... } )