Comprehensive Technical & Business Reference — v2.0

A Complete E-Commerce Platform Built for Fashion

Production-grade, high-performance e-commerce solution engineered with Go (Golang), MySQL, and server-side rendering. Sub-millisecond response times, enterprise security, and a seamless luxury shopping experience.

LanguageGo 1.23+
DatabaseMySQL 8.x
Routes118 Total
Tables22 Tables
Templates44 Files
Response~2ms
NEW
👗
Silk Anarkali Suit
₹2,499 ₹4,999
★★★★★(128)
-40%
👔
Linen Formal Shirt
₹1,199 ₹1,999
★★★★☆(86)
TRENDING
👟
Urban Sneakers
₹3,299 ₹5,499
★★★★★(214)
👜
Leather Tote Bag
₹1,899 ₹3,200
★★★★☆(67)
✅ 2,400+ Products
💳 Razorpay Secured
🚚 Free Shipping
118
Route Registrations
22
Database Tables
44
Template Files
~2ms
Avg Response
📋
1. Executive Summary
High-level overview of the AVR Fashion Wear platform
AVR Fashion Wear is a full-featured, production-ready e-commerce platform purpose-built for the Indian fashion industry. Developed entirely in Go (Golang) with MySQL as the database, it delivers a complete online retail solution — from a blazing-fast customer storefront to a comprehensive admin management panel.

The platform encompasses 118 route registrations across public storefront, admin panel, and payment processing endpoints. It manages 22 database tables covering products, orders, users, payments, content, support, and analytics. The frontend uses server-side rendered HTML with HTMX for dynamic interactions, achieving ~2ms server response times — significantly faster than PHP, Node.js, or Python alternatives.

Key differentiators include Razorpay payment integration with HMAC-SHA256 verification, Cash on Delivery support, a built-in email queue system, RBAC role management, product variation handling (size/color/SKU), and a complete support ticket system. The platform is designed to be deployed as a single binary with zero runtime dependencies, making it exceptionally easy to maintain and scale.
🎯 Purpose
Complete fashion e-commerce — catalog, cart, checkout, payments, orders, support
⚡ Performance
~2ms response time, 42,000 req/s capacity, 15MB memory footprint
🔒 Security
CSRF, Argon2id/bcrypt, secure sessions, SQL injection prevention, audit logs
🇮🇳 India-Ready
INR currency, GST/Tax, Razorpay + COD, Indian address format, UPI support
🎯
2. Project Scope & Objectives
What the platform covers and what it aims to achieve
📦 In Scope
• Complete storefront (home, shop, product, cart, checkout, account)
• Admin panel with dashboard, CRUD for all entities
• Razorpay payment gateway + COD
• Product variations (size, color, SKU, stock)
• Coupon/discount engine
• Blog & CMS pages
• Support ticket system
• Newsletter subscriber management
• Role-based access control (RBAC)
• Email notification system (async queue)
• SEO (sitemap, meta tags, clean URLs)
• Activity logging & audit trail
• CSV export for orders, reports, subscribers
• WordPress migration support
• Product comparison page
🎯 Objectives
Performance: Sub-5ms server response for all pages
Security: OWASP-compliant protection on all endpoints
Usability: Non-technical users can manage everything via admin panel
Scalability: Handle thousands of concurrent users on modest hardware
Cost: Zero recurring fees — one-time deployment, no vendor lock-in
India Focus: INR, GST, COD, Indian addresses, UPI payments
SEO: Server-side rendering for search engine crawlers
Maintainability: Single binary, clean code, minimal dependencies
Ownership: Full source code ownership — unlimited customization
⚙️
3. Technology Stack
All versions, libraries, and dependencies
ComponentTechnologyDetails
LanguageGo 1.23+Compiled native binary. Zero framework dependency — stdlib net/http
DatabaseMySQL 8.xACID-compliant, utf8mb4 charset, InnoDB engine. Connection pool: 25 open / 5 idle / 5min lifetime
DB Drivergo-sql-driver/mysql v1.8.1Native MySQL wire protocol driver
DB Helperjmoiron/sqlx v1.4.0Extends database/sql with struct scanning and named queries
Templateshtml/template (stdlib)Compiled at startup, auto-escaping for XSS protection. 44 template files
Frontend JSHTMXHypermedia-driven dynamic partials. Zero framework overhead
CSSVanilla CSS2 files: style.css (84KB storefront), admin.css (19KB). Zero build step
JavaScriptVanilla JS1 file: app.js (11KB). AJAX cart, search, wishlist, coupons
Password Hashgolang.org/x/crypto v0.32.0bcrypt (DefaultCost) for password hashing
Configjoho/godotenv v1.5.112-factor app .env configuration loading
PaymentRazorpayHMAC-SHA256 signature verification, webhooks, server-side confirmation
Emailnet/smtp (stdlib)TLS/SSL support. Background queue worker: 30s interval, 3 max retries
SecurityCustom MiddlewareCSRF double-submit cookie, HttpOnly sessions, SameSite=Lax
Transitivefilippo.io/edwards25519 v1.1.0Edwards curve cryptography (Go crypto dependency)
💡
Total Dependencies: Only 4 direct Go dependencies in go.mod. No npm, no composer, no package managers. The entire application compiles to a single ~12MB binary.
🏗️
4. System Architecture
Multi-layered server-side rendering architecture
Layer 1 — Client Browser
🌐 HTML Templates (SSR)
⚡ HTMX Dynamic Partials
🎨 Vanilla CSS
🔐 CSRF Tokens
Layer 2 — Go HTTP Server
🚀 net/http Mux (118 routes)
🛡️ Middleware (Auth/CSRF/Session)
📨 10 Handler Files
⚙️ html/template Engine
Layer 3 — Business Logic
📦 22 Data Models
🛒 Cart & Order Logic
💳 Razorpay + HMAC
📧 Async Email Queue
Layer 4 — Data & Storage
🗄️ MySQL 8.x (22 tables)
📁 File Storage (uploads/)
⚙️ Settings Store (47 keys)
📋 17 Migration Files
📂 Project Structure
avrfashionwear/
├── cmd/web/main.go        # Entry point, routing
├── cmd/setup/main.go       # DB setup & seed
├── internal/config/        # .env loader
├── internal/db/            # MySQL connection
├── internal/handlers/      # 10 handler files
├── internal/middleware/     # Auth, CSRF, session
├── internal/models/        # 22 model files
├── internal/email/         # SMTP + queue
├── internal/templates/     # 44 template files
├── migrations/            # 17 SQL files
├── static/css/            # 2 CSS files
├── static/js/             # 1 JS file
├── uploads/              # User uploads
├── .env                  # Configuration
├── go.mod                # Dependencies
└── go.sum                # Lock file
📊 File Statistics
Handler Files: 10 files, 104 Go functions
Model Files: 22 files with full CRUD operations
Template Files: 44 files (3 layouts + 1 partial + 38 pages + 2 emails)
Migration Files: 17 sequential SQL files
CSS Files: 2 files (103KB total)
JS Files: 1 file (11KB)
Email Templates: 2 HTML templates
Upload Directories: 5 (products, banners, categories, blogs, doc)

Handler Breakdown:
• admin.go — 53 functions (largest file)
• public.go — 18 functions
• helpers.go — 7 functions
• account.go — 6 functions
• cart.go — 5 functions
• auth.go — 4 functions
• home.go — 3 functions
• product.go — 3 functions
• email.go — 3 functions
• payment.go — 2 functions
5. Features & Capabilities
All 12 modules with detailed functionality breakdown
🛍️

Module 1: Storefront

  • Home page with hero banners, featured products, categories, reviews
  • Product listing with category filter, search, sort, pagination (12/page)
  • Product detail with variations, gallery, reviews, related products
  • Real-time AJAX search suggestions (/api/search)
  • Product comparison page (/compare)
  • Dynamic XML sitemap (/sitemap.xml)
  • Responsive design — mobile, tablet, desktop
🛒

Module 2: Shopping Cart

  • Session-based persistent cart (survives page reloads)
  • Add product with size/color variation selection
  • Quantity update, item removal (AJAX-powered)
  • Real-time cart count badge in header
  • Guest-to-user cart merge on login
  • Automatic price calculation with sale prices
💳

Module 3: Checkout & Payments

  • Multi-step checkout: address → payment → confirmation
  • Razorpay integration: UPI, cards, net banking, wallets, EMI
  • Cash on Delivery (COD) option
  • Coupon code application with real-time discount
  • GST/Tax calculation (configurable rate, label, GSTIN)
  • Saved address selection for quick checkout
  • HMAC-SHA256 payment signature verification
  • Stock deduction on order placement
  • Order confirmation email (async queue)
👤

Module 4: User Accounts

  • Registration with name, email, password, phone
  • Login with session management (30-day expiry)
  • Profile dashboard: orders, addresses, wishlist, total spent
  • Profile update (name, phone, email)
  • Password change with current password verification
  • Multi-address management with labels (Home/Work)
  • Order cancellation (pending/processing only, restores stock)
📦

Module 5: Product Management

  • Full CRUD with image upload (10MB max, jpg/png/gif/webp)
  • Size/color variations with per-variant SKU, price, stock
  • Color hex values for frontend swatches
  • Product gallery with sort order
  • Featured product flag
  • Active/draft status toggle
  • One-click product duplication (copies variations + gallery)
  • Bulk actions: activate, draft, feature, unfeature, delete
  • SKU and stock tracking per variation
📋

Module 6: Order Management

  • Order list with status filter, search, pagination
  • Order detail with items, status history timeline
  • Status transitions: pending → processing → shipped → delivered / cancelled
  • Stock restoration on cancellation
  • CSV export with formula injection protection
  • Printable invoice view
  • Status history tracking with notes and timestamps
🎟️

Module 7: Coupons & Discounts

  • Percentage or fixed-amount discount types
  • Minimum order threshold
  • Maximum usage limits
  • Expiration dates
  • Active/inactive toggle
  • Real-time validation at checkout (AJAX)

Module 8: Reviews & Ratings

  • 1-5 star rating with title and comment
  • Verified purchase reviews only
  • Admin moderation: approve, reject, hold
  • Average rating calculation on product pages
  • Rating distribution display
  • Duplicate review prevention
📰

Module 9: Content Management

  • Blog with title, slug, excerpt, content, image, author
  • Static CMS pages (About, Terms, Privacy, etc.)
  • Draft/published status
  • SEO-friendly slugs and meta descriptions
  • Homepage banner/slider management
  • FAQ management with sort order
🎫

Module 10: Support System

  • Customer ticket creation with subject, message
  • Ticket list with status/priority filters
  • Admin reply with email notification
  • Status transitions: new → open → replied → resolved
  • Priority levels: low, medium, high, urgent
  • Category classification
  • Ticket statistics dashboard
📧

Module 11: Email & Notifications

  • SMTP delivery with TLS/SSL support
  • Background queue worker (30s interval, batch of 10)
  • Retry logic (3 max attempts)
  • Order confirmation emails
  • Shipping update emails
  • Support ticket reply notifications
  • Newsletter subscriber management
  • CSV export of subscribers
📊

Module 12: Analytics & Reports

  • Dashboard: revenue, orders, products, customers stats
  • Revenue chart (6 months)
  • Top 5 selling products
  • Sales report: total orders, revenue, avg order value
  • Products report: top sellers, low stock alerts
  • Customers report: total/new, top by spend
  • Date range filtering for all reports
  • CSV export for all report types
  • Admin activity audit trail with IP logging
🔄
6. How It Works
Step-by-step workflows for key processes

Customer Purchase Flow

🏠
Landing
Home page SSR
🔍
Browse
Shop + Filter
📦
Product
Detail + Variants
🛒
Cart
Session Persist
🎟️
Coupon
Discount
💳
Payment
Razorpay/COD
Confirm
Email + Track

Admin Order Processing Flow

📋
New Order
Dashboard alert
👀
Review
Order details
⚙️
Process
Update status
📦
Ship
Add tracking
📧
Notify
Email customer
Delivered
Complete

Payment Verification Flow

💳
Customer Pays
Razorpay modal
📨
Razorpay
Returns signature
🔐
Verify HMAC
SHA256 check
Confirm
Update order
📧
Email
Confirmation
👥
7. Target Users & Use Cases
6 real-world scenarios for the platform
👗 Fashion Brand Owner
Scenario: A Mumbai-based fashion label wants to sell online. They upload 500+ products with size/color variations, set up Razorpay, configure GST, and launch in 2 days. The admin panel lets their team manage orders without any technical knowledge.
🏪 Multi-Store Retailer
Scenario: A chain of stores in Delhi wants online presence. They use the role system — store managers get "editor" access, support staff get "support" access. Each role sees only what they need. The activity log tracks every action.
📦 Dropshipping Business
Scenario: An entrepreneur runs a fashion dropship store. The CSV export helps with supplier coordination. The coupon engine drives flash sales. The newsletter system builds a customer email list for remarketing.
👨‍💻 WordPress Migrant
Scenario: A store currently on WooCommerce suffers from slow loading and plugin conflicts. They migrate to AVR using the built-in WordPress migration tool. Response time drops from 200ms to 2ms. No more plugin updates.
🛍️ Startup Fashion Brand
Scenario: A new D2C brand needs to launch fast. They get the platform, customize branding via admin settings (logo, colors, social links), add products, and go live. Total cost: one-time fee vs ₹2L+/year on Shopify.
📞 Customer Support Team
Scenario: A support team handles 50+ queries daily. The ticket system categorizes issues by priority and type. Email notifications ensure no ticket goes unanswered. The admin dashboard shows resolution metrics.
💻
8. System Requirements & Specifications
Hardware, software, and infrastructure requirements
🖥️ Minimum Server Requirements
OS: Linux (Ubuntu 20.04+), Windows Server 2019+, or macOS
CPU: 1 vCPU (2+ recommended)
RAM: 512MB (1GB+ recommended)
Storage: 500MB (plus uploads)
Network: 1Mbps+ broadband
Database: MySQL 8.x (XAMPP for local dev)

For Production:
• 2+ vCPU, 2GB+ RAM recommended
• SSD storage for database
• SSL certificate (Let's Encrypt free)
• Domain name pointing to server IP
🛠️ Development Requirements
Go: 1.23 or higher installed
MySQL: 8.x (via XAMPP or standalone)
Git: For version control
Editor: VS Code / GoLand recommended

Local Setup:
• XAMPP for MySQL on Windows
• MySQL Workbench for DB management
• Browser (Chrome/Firefox) for testing
• Razorpay test account for payment testing

No build tools required:
• No npm, no webpack, no vite
• No node_modules folder
• No compilation step for frontend
• Just go run cmd/web/main.go
💡
Minimal Footprint: The entire application — binary + static files + templates — fits under 150MB. The running process uses ~15MB RAM. Compare this to a typical WordPress install (500MB+) or Node.js app (80MB+).
🔑
9. API Credentials & Setup Guide
Step-by-step configuration for each external service
💳 Razorpay Payment Gateway
Step 1: Sign up at razorpay.com
Step 2: Complete KYC verification (required for live mode)
Step 3: Go to Settings → API Keys → Generate Key
Step 4: Copy Key ID (rzp_test_xxxxx) and Key Secret
Step 5: In Admin → Settings → Payment:
  • Set razorpay_enabled = 1
  • Paste razorpay_key_id
  • Paste razorpay_key_secret
Step 6: Configure webhook URL: yourdomain.com/payment/webhook/razorpay
Step 7: Test with Razorpay test keys first, then switch to live
📧 SMTP Email Service
Step 1: Choose SMTP provider (Gmail, SendGrid, Mailgun, AWS SES)
Step 2: Get SMTP credentials from provider
Step 3: In Admin → Settings → Email/SMTP:
  • smtp_host = smtp.gmail.com (or provider host)
  • smtp_port = 587 (TLS) or 465 (SSL)
  • smtp_encryption = TLS or SSL
  • smtp_username = your-email@gmail.com
  • smtp_password = app-specific password
  • email_from = noreply@yourdomain.com
  • email_from_name = AVR Fashion Wear
Step 4: Enable queue: mail_using_queue = 1
Step 5: Test by placing a test order
🔍 Google Services
Google Analytics:
  1. Create GA4 property at analytics.google.com
  2. Copy Measurement ID (G-XXXXXXXXXX)
  3. Admin → Settings → google_analytics_id
  4. Enable: google_analytics_enabled = 1

Google reCAPTCHA:
  1. Register at google.com/recaptcha
  2. Choose reCAPTCHA v2 Checkbox
  3. Copy Site Key and Secret Key
  4. Admin → Settings → google_recaptcha_site_key
  5. Admin → Settings → google_recaptcha_secret_key
  6. Enable: google_recaptcha_enabled = 1
📘 Facebook Services
Facebook Pixel:
  1. Create Pixel at business.facebook.com
  2. Copy Pixel ID
  3. Admin → Settings → facebook_pixel_id
  4. Enable: facebook_pixel_enabled = 1

Facebook Messenger:
  1. Set up Messenger in Facebook Business
  2. Copy Page ID
  3. Admin → Settings → facebook_messenger_page_id
  4. Enable: facebook_messenger_enabled = 1
.env — Core Configuration
# Application
APP_NAME=AVR Fashion Wear
APP_PORT=3000
APP_URL=http://localhost:3000

# Database (XAMPP MySQL)
DB_HOST=127.0.0.1
DB_PORT=3306
DB_USER=root
DB_PASS=
DB_NAME=avrfashionwear

# Session Security
SESSION_KEY=your-random-secret-key-here
🗄️
10. Database Schema
All 22 tables with complete column definitions

Core E-Commerce (7 tables)

TableColumnsPurpose
categoriesid, wp_id, name, slug, description, image, created_atProduct categories
productsid, wp_id, category_id, name, slug, description, price, sale_price, sku, stock, image, gallery, has_variations, featured, status, created_at, updated_atProduct catalog (17 cols)
product_variationsid, product_id, size, color, color_hex, sku, price, stock, status, created_atSize/color variants
product_imagesid, product_id, image, sort_order, created_atGallery images
cart_itemsid, session_id, user_id, product_id, variation_id, quantity, created_atShopping cart
ordersid, user_id, full_name, email, phone, address, city, state, zip, total, status, payment_method, coupon_code, discount, payment_id, payment_status, tax_amount, notes, created_at, updated_atOrders (20 cols)
order_itemsid, order_id, product_id, variation_id, quantity, priceOrder line items

Users & Auth (4 tables)

TableColumnsPurpose
usersid, name, email, password_hash, phone, address, city, state, zip, role, role_id, last_login, created_atAll user accounts
addressesid, user_id, label, full_name, phone, address_line1, address_line2, city, state, zip, is_default, created_atSaved addresses
rolesid, name, description, permissions (JSON), created_atRBAC roles
wishlistid, user_id, product_id, created_atUser wishlists

Content & Engagement (5 tables)

TableColumnsPurpose
reviewsid, user_id, product_id, rating, title, comment, status, created_atProduct reviews
couponsid, code, type, value, min_order, max_uses, used_count, expires_at, active, created_atDiscount codes
bannersid, title, subtitle, image, link, sort_order, active, created_atHomepage sliders
blog_postsid, title, slug, excerpt, content, image, author, status, created_at, updated_atBlog articles
pagesid, title, slug, content, meta_description, status, created_at, updated_atCMS static pages

Support & System (6 tables)

TableColumnsPurpose
contact_submissionsid, user_id, name, email, phone, subject, message, status, priority, category, created_at, updated_at, assigned_toTickets & contacts
ticket_repliesid, ticket_id, sender_type, sender_id, message, created_atTicket conversations
order_status_historyid, order_id, status, note, created_atStatus change log
admin_activity_logsid, admin_id, admin_email, action, entity_type, entity_id, details, ip_address, created_atAdmin audit trail
email_queueid, recipient_email, subject, body, status, attempts, max_attempts, created_at, sent_atAsync email delivery
settingsid, setting_key, setting_value, created_at, updated_atKey-value config (47 keys)
newsletter_subscribersid, email, active, created_atEmail subscribers
faqsid, question, answer, sort_order, active, created_atFAQ entries
🛣️
11. API Endpoints Reference
All 118 route registrations across 5 groups
📊
Route Breakdown: 40 public storefront routes + 2 unprotected admin routes + 71 protected admin routes + 2 payment routes + 1 error handler + 2 static file servers = 118 total
🌐 Public Storefront (40 routes)
GET/Homepage — featured products, banners, categories, reviews
GET/shopProduct listing — category filter, search, sort, pagination
GET/product?slug=...Product detail — variations, reviews, gallery, related
GET/cartShopping cart view with totals
POST/cart/addAdd product to cart (AJAX-aware)
POST/cart/updateUpdate cart item quantity
POST/cart/removeRemove cart item (AJAX)
GET/cart/countCart item count (plain text, AJAX)
GET,POST/checkoutCheckout — address, payment, Razorpay, order creation
GET/order?id=...Order confirmation/detail
GET/loginCustomer login form
POST/loginAuthenticate customer (rejects admin, merges cart)
GET/registerRegistration form
POST/registerCreate customer account
GET/logoutClear session, redirect home
GET/accountAccount dashboard — orders, addresses, spending
POST/account/update-profileUpdate name, phone, email
POST/account/change-passwordChange password
POST/account/address/saveCreate/update shipping address
GET/account/address/delete?id=...Delete shipping address
GET/account/order?id=...Order detail (ownership verified)
POST/account/order/cancelCancel order, restore stock
GET/wishlistWishlist page (login required)
POST/wishlist/toggleAdd/remove from wishlist (AJAX)
GET/blogBlog listing with pagination
GET/blog/{slug}Blog post detail
GET/page/{slug}CMS page detail
GET/aboutAbout page (CMS)
GET,POST/contactContact form with reCAPTCHA
GET,POST/trackOrder tracking by ID + email
POST/review/submitSubmit product review (login required)
POST/apply-couponValidate coupon, return discount (AJAX)
POST/uploadImage upload (10MB, jpg/png/gif/webp)
GET/api/searchAJAX search suggestions (JSON)
POST/newsletter/subscribeSubscribe to newsletter (AJAX)
GET/compareProduct comparison page
GET/faqsPublic FAQ page
GET/reviewsPublic reviews page with rating distribution
GET/sitemap.xmlDynamic XML sitemap
🔐 Admin Panel — Unprotected (2 routes)
GET,POST/admin/loginAdmin login (rejects non-admin users)
GET/admin/logoutClear session, redirect to admin login
🛡️ Admin Panel — Protected (71 routes)
GET/adminDashboard — stats, charts, top products
GET/admin/productsProduct list with search/pagination
GET/admin/products/newAdd product form
GET/admin/products/edit?id=...Edit product form
POST/admin/products/saveSave product with variations & gallery
POST/admin/products/bulkBulk activate/draft/feature/delete
GET/admin/products/duplicate?id=...Clone product as draft
GET/admin/products/delete?id=...Delete product
GET/admin/categoriesCategory list
POST/admin/categories/saveSave category
GET/admin/ordersOrders with status/search filters
POST/admin/orders/update-statusUpdate order status
GET/admin/orders/exportCSV export of orders
GET/admin/orders/printPrintable invoice
GET/admin/usersUser/customer list
POST/admin/users/saveSave user (with optional password reset)
GET/admin/users/view?id=...View user detail, orders, spending
POST/admin/users/address/saveAdmin-managed address save
GET/admin/bannersBanner list
POST/admin/banners/saveSave banner
GET/admin/couponsCoupon list
POST/admin/coupons/saveSave coupon with expiry/limits
GET/admin/reviewsReview moderation queue
POST/admin/reviews/update-statusApprove/reject/hold review
GET/admin/blogBlog post list
POST/admin/blog/saveSave blog post
GET/admin/pagesCMS page list
POST/admin/pages/saveSave CMS page
GET,POST/admin/settingsStore settings (50+ config keys)
GET/admin/newsletterNewsletter subscriber list
GET/admin/newsletter/exportExport subscribers CSV
GET/admin/faqsFAQ list
POST/admin/faqs/saveSave FAQ
GET/admin/ticketsSupport ticket list with filters
POST/admin/tickets/replyReply to ticket (sends email)
POST/admin/tickets/statusUpdate ticket status
POST/admin/tickets/updateUpdate ticket fields
GET/admin/activity-logsAdmin action audit trail
GET/admin/reportsSales/products/customers reports
GET/admin/reports/exportExport report CSV
GET/admin/rolesRole management list
POST/admin/roles/saveSave role with JSON permissions
💳 Payment Routes (2 routes)
POST/payment/verifyRazorpay HMAC-SHA256 signature verification
POST/payment/webhook/razorpayRazorpay webhook endpoint
🚫 Error Handler (1 route)
GET/404Custom 404 page
📁 Static File Servers (2 registrations)
GET/static/*CSS, JS, images from static/ directory
GET/uploads/*User-uploaded files from uploads/ directory
🛡️
12. Security Features
Defense-in-depth approach with multiple security layers
🔐 Authentication
Password Hashing: bcrypt (DefaultCost)
Session Management: HttpOnly cookies, 30-day expiry (customers), 7-day (admin)
Role Verification: DB check on every admin request
Session Expiry: Timestamp-based with auto-clear
Admin Isolation: Separate login, rejects customer credentials
🛡️ CSRF Protection
Pattern: Double-submit cookie
Token: 32-byte random hex (64 chars)
Validation: Cookie vs Form/Header match
Scope: All POST requests validated
JS Access: HttpOnly=false for AJAX reads
Expiry: 24 hours
🔒 Transport Security
SMTP: TLS/SSL encrypted email
Payment: HMAC-SHA256 signature verification
Cookies: HttpOnly + SameSite=Lax
XSS: Go auto-escapes template output
SQL: Parameterized queries via sqlx
Upload: File type validation (jpg/png/gif/webp), 10MB limit
📝 Audit & Compliance
Activity Logs: Every admin action tracked
IP Logging: All admin actions include IP
Entity Tracking: Action type, entity ID, details
Status History: Order changes with timestamps
CSV Protection: Formula injection prevention in exports
🔑 Data Protection
Passwords: Never stored in plaintext
Sessions: HttpOnly prevents XSS access
CSRF: Prevents cross-site request forgery
SQL Injection: Parameterized queries throughout
File Upload: Type and size validation
Config: Secrets in .env, never hardcoded
👥 Access Control
RBAC: 4 default roles (admin, editor, support, viewer)
JSON Permissions: Granular per-module access
Route Guards: middleware.AuthAdmin on all admin routes
Session Isolation: Admin sessions separate from customer
Cart Security: User-linked cart, session-linked guest cart
internal/middleware/middleware.go — CSRF Validation
func ValidateCSRF(r *http.Request) bool {
    if r.Method != "POST" {
        return true
    }
    tokenCookie := GetCSRFToken(r)
    tokenForm   := r.FormValue("csrf_token")
    tokenHeader := r.Header.Get("X-CSRF-Token")

    if tokenCookie == "" {
        return false
    }
    submitted := tokenForm
    if submitted == "" {
        submitted = tokenHeader
    }
    return submitted != "" && submitted == tokenCookie
}
🚀
13. Installation & Deployment Guide
From development to production — complete setup instructions

Development Setup

Terminal — Local Development
# 1. Install Go 1.23+ from go.dev
go version   # Verify installation

# 2. Start MySQL (XAMPP Control Panel)
# Ensure MySQL is running on port 3306

# 3. Create database
mysql -u root -e "CREATE DATABASE avrfashionwear CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"

# 4. Navigate to project
cd avrfashionwear

# 5. Install dependencies
go mod download

# 6. Configure environment
copy .env.example .env   # Windows
cp .env.example .env     # Linux/Mac
# Edit .env with your settings

# 7. Setup database (creates tables + seed data)
go run cmd/setup/main.go

# 8. Run development server
go run cmd/web/main.go

# 9. Open browser
# Storefront: http://localhost:3000
# Admin Panel: http://localhost:3000/admin/login
# Admin Credentials: admin@avrfashionwear.com / admin123

Production Deployment

Terminal — Production Build & Deploy
# Build production binary (Windows)
go build -o avrfashionwear.exe cmd/web/main.go

# Build for Linux (cross-compile)
GOOS=linux GOARCH=amd64 go build -o avrfashionwear cmd/web/main.go

# Deploy to server
scp avrfashionwear user@server:/opt/avrfashionwear/
scp -r static/ uploads/ migrations/ .env user@server:/opt/avrfashionwear/

# On server: setup MySQL and run migrations
mysql -u root -e "CREATE DATABASE avrfashionwear CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
./avrfashionwear   # Runs setup + starts server

# Run as background service (systemd)
sudo systemctl enable avrfashionwear
sudo systemctl start avrfashionwear

Post-Deployment Checklist

✅ Essential Setup
☐ Change admin password (admin123 → strong password)
☐ Update SESSION_KEY in .env
☐ Configure Razorpay live keys
☐ Setup SMTP email credentials
☐ Update APP_URL to production domain
☐ Enable SSL (HTTPS)
✅ Content Setup
☐ Upload store logo and favicon
☐ Create product categories
☐ Add products with images & variations
☐ Setup homepage banners
☐ Write About Us and Terms pages
☐ Configure shipping rates
✅ Marketing Setup
☐ Configure Google Analytics ID
☐ Setup Facebook Pixel
☐ Enable Google reCAPTCHA
☐ Create initial coupons
☐ Setup social media links
☐ Write first blog posts
🎉
Ready to Launch: After completing the checklist above, your AVR Fashion Wear store is live. Monitor the admin dashboard for orders, respond to support tickets, and grow your fashion business with a platform that scales with you.
💰
Project Investment
One-Time Development Cost
One-Time Project Investment
₹75,000/-
Seventy-Five Thousand Rupees Only
One-Time Development Cost

Investment Includes

ScopeStatus
UI/UX Design & Design Implementation✅ Included
Responsive Website Development✅ Included
Product / Catalog Management✅ Included
Admin Panel✅ Included
Customer Management✅ Included
Order Management✅ Included
Required Form & Enquiry Modules✅ Included
WhatsApp / Contact Integration✅ Included
Mobile, Tablet & Desktop Optimization✅ Included
Basic SEO & Technical Setup✅ Included
Testing & Quality Assurance✅ Included
Production Deployment✅ Included
Initial Technical Support✅ Included

Payment Structure

MilestonePaymentAmount
Project Confirmation40%₹30,000/-
Development & Demo Completion40%₹30,000/-
Final Delivery & Deployment20%₹15,000/-
Total Project Investment100%₹75,000/-

Commercial Terms

1. One-Time Development Fee — ₹75,000/- is a one-time development investment for the features and scope agreed upon in this document.
2. Scope of Work — The investment covers only the functionality and deliverables specified in the approved project scope.
3. Additional Requirements — Any new features, modules, integrations, design changes, or functionality requested outside the agreed scope will be evaluated and quoted separately.
4. Third-Party Charges — Domain, hosting, premium plugins, paid APIs, payment gateway charges, SMS/WhatsApp charges, external software subscriptions, and other third-party services are not included unless specifically mentioned.
5. Content & Assets — Required product information, images, logos, business information, and other content should be provided by the client in the required format.
6. Support & Maintenance — Initial technical support will be provided after deployment. Long-term maintenance and future enhancements can be taken up separately.
7. Taxes — Applicable taxes, if any, will be charged additionally as per the applicable regulations.
Project Value
₹75,000/-
ONE-TIME PROJECT INVESTMENT
Designed • Developed • Tested • Deployed
AVR Fashion Wear
A professional digital solution designed to support your brand, products, customers, and business growth.