KillSwitch

Full-stack e‑commerce platform for gaming hardware and computer components — a Next.js storefront + admin dashboard backed by an Express / PostgreSQL API with Stripe payments, Cloudinary media, Google OAuth, real‑time chat and an AI chatbot.

---

Tech stack

Layer	Main technologies
Frontend	Next.js 15 (App Router), React 18, Tailwind CSS 4, Framer Motion, @stripe/react-stripe-js, socket.io-client
Backend	Node.js, Express 5, Sequelize 6, PostgreSQL, Socket.IO, Passport (Google OAuth 2.0), JWT
Payments	Stripe (Payment Intents + webhooks)
Media	Cloudinary (image/video uploads via Multer)
Email	Nodemailer / SMTP
AI chatbot	OpenRouter (DeepSeek), OpenAI, with a rule-based fallback service

---

Repository structure

killswitch/
├── backend/                 Express REST API + Socket.IO server
│   ├── config/              DB, Passport, Stripe, Cloudinary configuration
│   ├── controllers/         Route handlers (auth, products, orders, cart, …)
│   ├── middleware/           Auth, admin guard, file upload
│   ├── migrations/          Sequelize migrations
│   ├── models/              Sequelize models
│   ├── routes/              Express routers
│   ├── services/            Chatbot + background services
│   ├── utils/               Email, tokens, Cloudinary helpers
│   ├── server.js            App entry point
│   └── .env.example         Backend environment template
│
└── frontend/                Next.js app (storefront + admin dashboard)
    ├── src/app/             Routes (products, cart, orders, Admin, …)
    ├── public/              Static assets
    └── .env.example         Frontend environment template

---

Features

• Product catalog with categories, subcategories, brands, images, specifications and reviews
• Cart, coupons, checkout and Stripe payments with webhook handling
• Order management and order tracking
• User accounts with email/password and Google OAuth login, JWT + refresh tokens
• Address book
• Admin dashboard: products, orders, brands/categories, coupons, users, role management, activity logs and analytics
• Real-time customer ↔ admin chat (Socket.IO) with offline message handling
• AI product-assistant chatbot with provider fallback
• Newsletter signup, contact form, quote requests
• Cookie-consent management

---

Getting started

Prerequisites

• Node.js 18+
• PostgreSQL 13+
• Accounts / API keys for Stripe, Cloudinary, Google OAuth, and (optionally) an LLM provider for the chatbot

1. Clone

git clone <your-repo-url>
cd killswitch

2. Backend

cd backend
npm install
cp .env.example .env        # then fill in real values

Create the database and run migrations:

createdb killswitch_db
npx sequelize-cli db:migrate
# optional demo data
node seed.js
node seedReviews.js

Start the API (defaults to http://localhost:8000):

npm run dev        # nodemon
# or
node server.js

3. Frontend

cd ../frontend
npm install
cp .env.example .env        # set NEXT_PUBLIC_API_URL + Stripe publishable key
npm run dev                 # http://localhost:3000

---

Ports

App	Port	URL	How it's set
Backend (API)	8000	http://localhost:8000	PORT in backend/.env
Frontend (web)	3000	http://localhost:3000	Next.js default (next dev)
PostgreSQL	5432	localhost:5432	DB_PORT in backend/.env

The frontend talks to the backend through NEXT_PUBLIC_API_URL, so if you change the backend port, update that value too.

Environment variables

Both apps are configured entirely through environment variables. Copy the templates (cp .env.example .env) and fill in real values. Never commit a real .env file — they are git-ignored on purpose.

backend/.env

Variable	Required	What it's for
PORT	no (default 8000)	Port the API listens on
NODE_ENV	no	development / production
WEB_ORIGIN	yes	Frontend URL, used for CORS + cookies (e.g. http://localhost:3000)
COOKIE_SECURE	prod only	true when served over HTTPS
ADMIN_EMAIL	yes	Where admin notifications (new orders etc.) are sent
DB_HOST DB_PORT DB_NAME DB_USER DB_PASSWORD DB_DIALECT	yes*	PostgreSQL connection (local dev)
DATABASE_PUBLIC_URL	prod	Single Postgres connection string; used instead of the DB_* vars when present (Railway/Heroku style)
JWT_SECRET	yes	Signs access tokens — any long random string
REFRESH_TOKEN_SECRET	yes	Signs refresh tokens — any long random string
SESSION_SECRET	yes	Express session secret
GOOGLE_CLIENT_ID CLIENT_SECRET	for Google login	OAuth 2.0 credentials from Google Cloud Console
CALLBACK_URL	for Google login	OAuth redirect, e.g. http://localhost:8000/auth/google/callback
SMTP_HOST SMTP_PORT SMTP_SECURE SMTP_USER SMTP_PASS SMTP_FROM	for email	Outgoing mail (order confirmations, password reset, contact form)
email_user EMAIL_PASS	for email	Legacy mail vars still read by some routes — set to the same mailbox
CLOUDINARY_CLOUD_NAME CLOUDINARY_API_KEY CLOUDINARY_API_SECRET	for uploads	Product image / video hosting
STRIPE_PUBLISHABLE_KEY	yes	Stripe publishable key (pk_test_… in dev)
STRIPE_SECRET_KEY	yes	Stripe secret key (sk_test_… in dev)
STRIPE_WEBHOOK_SECRET	for payments	whsec_… from the Stripe webhook you point at /stripe/webhook
OPENAI_API_KEY OPENAI_MODEL	optional	Chatbot via OpenAI
OPENROUTER_API_KEY	optional	Chatbot via OpenRouter (DeepSeek model)
GEMINI_API_KEY	optional	Used by list-gemini-models.js helper

* Either the DB_* group or DATABASE_PUBLIC_URL must be set.

frontend/.env

Variable	Required	What it's for
NEXT_PUBLIC_API_URL	yes	Base URL of the backend, e.g. http://localhost:8000
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY	yes	Stripe publishable key (safe to expose in the browser)

Only NEXT_PUBLIC_* values reach the browser — never put a secret key in the frontend .env.

---

API overview

The Express server mounts these route groups (see backend/server.js):

/auth            /products        /categories      /brand
/cart            /orders          /coupons         /reviews
/addresses       /quotes          /contact         /newsletter
/chat            /chatbot         /analytics       /activity-logs
/admin-requests  /cookie-consent  /stripe          /data (uploads)

Static uploads are served from /uploads; the Stripe webhook is at /stripe/webhook.

---

Deployment notes

• The backend reads DATABASE_PUBLIC_URL when present (e.g. Railway) instead of the individual DB_* variables.
• Set NODE_ENV=production and COOKIE_SECURE=true behind HTTPS.
• Point WEB_ORIGIN at the deployed frontend URL and CALLBACK_URL at the deployed backend's Google OAuth callback.
• Configure the Stripe webhook endpoint and set STRIPE_WEBHOOK_SECRET.

---

License

Proprietary — all rights reserved unless stated otherwise.