Microsserv52 store

Application stack

Build, checks and delivery

Browser observability; disabled by default

The PWA is online-only; offline caching is not implemented.

English-language educational mock store frontend at /store/. No real payments or transactions take place, and no goods are shipped.

This independent repository is integrated at platform/web/store as a Git submodule. It uses Next.js App Router, TypeScript, MUI with Emotion, Tailwind, TanStack Query, runtime validation and configurable Grafana Faro/Umami. Admin additionally uses TanStack Table; store/admin use React Hook Form.

Local development

Use Node.js 24 and npm. Copy .env.example to .env.local if local values are needed; never commit credentials.

npm ci
npm run dev

The application has a fixed build-time base path /store/. Run the platform Compose environment for same-origin API/cookie testing. A standalone dev server needs an explicitly configured API origin/proxy; do not weaken CORS or save JWTs in browser storage to make a development shortcut work.

Checks

npm run format:check
npm run lint
npm run typecheck
npm test
npm run build
npm run test:e2e
pre-commit run --all-files

Browser tests use labeled API fixtures and a local static test server. CI installs Chromium before running them. For a running platform preview set PLAYWRIGHT_BASE_URL. The tests validate UI contracts, not live backend behavior.

Static output and containers

npm run build exports the site to out/. It requires no Next.js server, server actions, BFF, or database connection at runtime. Detail screens use query IDs because arbitrary runtime IDs cannot be pre-generated by static export.

The Dockerfile uses the official Node build image and serves the export with Nginx. The platform Compose proxy reserves each zone's prefix and routes /api/ to Gateway. The frontend Kubernetes deployment is deferred. CDN provider, production origins and environment values must be discussed with the owner before deployment.

All NEXT_PUBLIC_* values are public, compiled at build time and require a new build when changed. Set API URL, display timezone, app environment/version and telemetry values using .env.example. Telemetry defaults to disabled until hosting and policy are agreed. No secret belongs in a public variable.

Authentication and privacy

Gateway owns the HttpOnly ms52-session cookie and browser session endpoints. Mutations obtain a CSRF token first. Gateway and services enforce access; frontend route guards only control presentation. Expired sessions require login. Only cart product IDs/quantities and UI preferences are stored on the device. The store PWA is online-only; no service worker caches private data or replays orders. Every checkout is explicitly labeled as a demo.

Design and integration documentation

The approved defaults and visual references live in the platform design direction. See the platform frontend documentation for routing, feature scope, package decisions, API prerequisites, local fixture mode and verification evidence. antislop is applied during implementation.

Source was initialized with official create-next-app@16.4.5; browser testing was initialized with official create-playwright@1.17.139. Each repository owns its npm lockfile, checks, immutable image workflow and source history. CodeQL on private repositories requires the organization's corresponding GitHub security entitlement. CI configuration is included; remote workflow results are not claimed until the branches are pushed and checks have run.