118
Route Registrations
22
Database Tables
44
Template Files
~2ms
Avg Response
1. Executive Summary
High-level overview of the AVR Fashion Wear platform
AVR Fashion Wear is a full-featured, production-ready e-commerce platform purpose-built for the Indian fashion industry. Developed entirely in Go (Golang) with MySQL as the database, it delivers a complete online retail solution — from a blazing-fast customer storefront to a comprehensive admin management panel.
The platform encompasses 118 route registrations across public storefront, admin panel, and payment processing endpoints. It manages 22 database tables covering products, orders, users, payments, content, support, and analytics. The frontend uses server-side rendered HTML with HTMX for dynamic interactions, achieving ~2ms server response times — significantly faster than PHP, Node.js, or Python alternatives.
Key differentiators include Razorpay payment integration with HMAC-SHA256 verification, Cash on Delivery support, a built-in email queue system, RBAC role management, product variation handling (size/color/SKU), and a complete support ticket system. The platform is designed to be deployed as a single binary with zero runtime dependencies, making it exceptionally easy to maintain and scale.
The platform encompasses 118 route registrations across public storefront, admin panel, and payment processing endpoints. It manages 22 database tables covering products, orders, users, payments, content, support, and analytics. The frontend uses server-side rendered HTML with HTMX for dynamic interactions, achieving ~2ms server response times — significantly faster than PHP, Node.js, or Python alternatives.
Key differentiators include Razorpay payment integration with HMAC-SHA256 verification, Cash on Delivery support, a built-in email queue system, RBAC role management, product variation handling (size/color/SKU), and a complete support ticket system. The platform is designed to be deployed as a single binary with zero runtime dependencies, making it exceptionally easy to maintain and scale.
🎯 Purpose
Complete fashion e-commerce — catalog, cart, checkout, payments, orders, support
⚡ Performance
~2ms response time, 42,000 req/s capacity, 15MB memory footprint
🔒 Security
CSRF, Argon2id/bcrypt, secure sessions, SQL injection prevention, audit logs
🇮🇳 India-Ready
INR currency, GST/Tax, Razorpay + COD, Indian address format, UPI support
2. Project Scope & Objectives
What the platform covers and what it aims to achieve
📦 In Scope
• Complete storefront (home, shop, product, cart, checkout, account)
• Admin panel with dashboard, CRUD for all entities
• Razorpay payment gateway + COD
• Product variations (size, color, SKU, stock)
• Coupon/discount engine
• Blog & CMS pages
• Support ticket system
• Newsletter subscriber management
• Role-based access control (RBAC)
• Email notification system (async queue)
• SEO (sitemap, meta tags, clean URLs)
• Activity logging & audit trail
• CSV export for orders, reports, subscribers
• WordPress migration support
• Product comparison page
• Admin panel with dashboard, CRUD for all entities
• Razorpay payment gateway + COD
• Product variations (size, color, SKU, stock)
• Coupon/discount engine
• Blog & CMS pages
• Support ticket system
• Newsletter subscriber management
• Role-based access control (RBAC)
• Email notification system (async queue)
• SEO (sitemap, meta tags, clean URLs)
• Activity logging & audit trail
• CSV export for orders, reports, subscribers
• WordPress migration support
• Product comparison page
🎯 Objectives
• Performance: Sub-5ms server response for all pages
• Security: OWASP-compliant protection on all endpoints
• Usability: Non-technical users can manage everything via admin panel
• Scalability: Handle thousands of concurrent users on modest hardware
• Cost: Zero recurring fees — one-time deployment, no vendor lock-in
• India Focus: INR, GST, COD, Indian addresses, UPI payments
• SEO: Server-side rendering for search engine crawlers
• Maintainability: Single binary, clean code, minimal dependencies
• Ownership: Full source code ownership — unlimited customization
• Security: OWASP-compliant protection on all endpoints
• Usability: Non-technical users can manage everything via admin panel
• Scalability: Handle thousands of concurrent users on modest hardware
• Cost: Zero recurring fees — one-time deployment, no vendor lock-in
• India Focus: INR, GST, COD, Indian addresses, UPI payments
• SEO: Server-side rendering for search engine crawlers
• Maintainability: Single binary, clean code, minimal dependencies
• Ownership: Full source code ownership — unlimited customization
3. Technology Stack
All versions, libraries, and dependencies
| Component | Technology | Details |
|---|---|---|
| Language | Go 1.23+ | Compiled native binary. Zero framework dependency — stdlib net/http |
| Database | MySQL 8.x | ACID-compliant, utf8mb4 charset, InnoDB engine. Connection pool: 25 open / 5 idle / 5min lifetime |
| DB Driver | go-sql-driver/mysql v1.8.1 | Native MySQL wire protocol driver |
| DB Helper | jmoiron/sqlx v1.4.0 | Extends database/sql with struct scanning and named queries |
| Templates | html/template (stdlib) | Compiled at startup, auto-escaping for XSS protection. 44 template files |
| Frontend JS | HTMX | Hypermedia-driven dynamic partials. Zero framework overhead |
| CSS | Vanilla CSS | 2 files: style.css (84KB storefront), admin.css (19KB). Zero build step |
| JavaScript | Vanilla JS | 1 file: app.js (11KB). AJAX cart, search, wishlist, coupons |
| Password Hash | golang.org/x/crypto v0.32.0 | bcrypt (DefaultCost) for password hashing |
| Config | joho/godotenv v1.5.1 | 12-factor app .env configuration loading |
| Payment | Razorpay | HMAC-SHA256 signature verification, webhooks, server-side confirmation |
| net/smtp (stdlib) | TLS/SSL support. Background queue worker: 30s interval, 3 max retries | |
| Security | Custom Middleware | CSRF double-submit cookie, HttpOnly sessions, SameSite=Lax |
| Transitive | filippo.io/edwards25519 v1.1.0 | Edwards curve cryptography (Go crypto dependency) |
Total Dependencies: Only 4 direct Go dependencies in
go.mod. No npm, no composer, no package managers. The entire application compiles to a single ~12MB binary.4. System Architecture
Multi-layered server-side rendering architecture
Layer 1 — Client Browser
🌐 HTML Templates (SSR)
⚡ HTMX Dynamic Partials
🎨 Vanilla CSS
🔐 CSRF Tokens
▼
Layer 2 — Go HTTP Server
🚀 net/http Mux (118 routes)
🛡️ Middleware (Auth/CSRF/Session)
📨 10 Handler Files
⚙️ html/template Engine
▼
Layer 3 — Business Logic
📦 22 Data Models
🛒 Cart & Order Logic
💳 Razorpay + HMAC
📧 Async Email Queue
▼
Layer 4 — Data & Storage
🗄️ MySQL 8.x (22 tables)
📁 File Storage (uploads/)
⚙️ Settings Store (47 keys)
📋 17 Migration Files
📂 Project Structure
avrfashionwear/
├── cmd/web/main.go # Entry point, routing
├── cmd/setup/main.go # DB setup & seed
├── internal/config/ # .env loader
├── internal/db/ # MySQL connection
├── internal/handlers/ # 10 handler files
├── internal/middleware/ # Auth, CSRF, session
├── internal/models/ # 22 model files
├── internal/email/ # SMTP + queue
├── internal/templates/ # 44 template files
├── migrations/ # 17 SQL files
├── static/css/ # 2 CSS files
├── static/js/ # 1 JS file
├── uploads/ # User uploads
├── .env # Configuration
├── go.mod # Dependencies
└── go.sum # Lock file
├── cmd/web/main.go # Entry point, routing
├── cmd/setup/main.go # DB setup & seed
├── internal/config/ # .env loader
├── internal/db/ # MySQL connection
├── internal/handlers/ # 10 handler files
├── internal/middleware/ # Auth, CSRF, session
├── internal/models/ # 22 model files
├── internal/email/ # SMTP + queue
├── internal/templates/ # 44 template files
├── migrations/ # 17 SQL files
├── static/css/ # 2 CSS files
├── static/js/ # 1 JS file
├── uploads/ # User uploads
├── .env # Configuration
├── go.mod # Dependencies
└── go.sum # Lock file
📊 File Statistics
Handler Files: 10 files, 104 Go functions
Model Files: 22 files with full CRUD operations
Template Files: 44 files (3 layouts + 1 partial + 38 pages + 2 emails)
Migration Files: 17 sequential SQL files
CSS Files: 2 files (103KB total)
JS Files: 1 file (11KB)
Email Templates: 2 HTML templates
Upload Directories: 5 (products, banners, categories, blogs, doc)
Handler Breakdown:
• admin.go — 53 functions (largest file)
• public.go — 18 functions
• helpers.go — 7 functions
• account.go — 6 functions
• cart.go — 5 functions
• auth.go — 4 functions
• home.go — 3 functions
• product.go — 3 functions
• email.go — 3 functions
• payment.go — 2 functions
Model Files: 22 files with full CRUD operations
Template Files: 44 files (3 layouts + 1 partial + 38 pages + 2 emails)
Migration Files: 17 sequential SQL files
CSS Files: 2 files (103KB total)
JS Files: 1 file (11KB)
Email Templates: 2 HTML templates
Upload Directories: 5 (products, banners, categories, blogs, doc)
Handler Breakdown:
• admin.go — 53 functions (largest file)
• public.go — 18 functions
• helpers.go — 7 functions
• account.go — 6 functions
• cart.go — 5 functions
• auth.go — 4 functions
• home.go — 3 functions
• product.go — 3 functions
• email.go — 3 functions
• payment.go — 2 functions
5. Features & Capabilities
All 12 modules with detailed functionality breakdown
🛍️
Module 1: Storefront
- ✓Home page with hero banners, featured products, categories, reviews
- ✓Product listing with category filter, search, sort, pagination (12/page)
- ✓Product detail with variations, gallery, reviews, related products
- ✓Real-time AJAX search suggestions (/api/search)
- ✓Product comparison page (/compare)
- ✓Dynamic XML sitemap (/sitemap.xml)
- ✓Responsive design — mobile, tablet, desktop
🛒
Module 2: Shopping Cart
- ✓Session-based persistent cart (survives page reloads)
- ✓Add product with size/color variation selection
- ✓Quantity update, item removal (AJAX-powered)
- ✓Real-time cart count badge in header
- ✓Guest-to-user cart merge on login
- ✓Automatic price calculation with sale prices
💳
Module 3: Checkout & Payments
- ✓Multi-step checkout: address → payment → confirmation
- ✓Razorpay integration: UPI, cards, net banking, wallets, EMI
- ✓Cash on Delivery (COD) option
- ✓Coupon code application with real-time discount
- ✓GST/Tax calculation (configurable rate, label, GSTIN)
- ✓Saved address selection for quick checkout
- ✓HMAC-SHA256 payment signature verification
- ✓Stock deduction on order placement
- ✓Order confirmation email (async queue)
👤
Module 4: User Accounts
- ✓Registration with name, email, password, phone
- ✓Login with session management (30-day expiry)
- ✓Profile dashboard: orders, addresses, wishlist, total spent
- ✓Profile update (name, phone, email)
- ✓Password change with current password verification
- ✓Multi-address management with labels (Home/Work)
- ✓Order cancellation (pending/processing only, restores stock)
📦
Module 5: Product Management
- ✓Full CRUD with image upload (10MB max, jpg/png/gif/webp)
- ✓Size/color variations with per-variant SKU, price, stock
- ✓Color hex values for frontend swatches
- ✓Product gallery with sort order
- ✓Featured product flag
- ✓Active/draft status toggle
- ✓One-click product duplication (copies variations + gallery)
- ✓Bulk actions: activate, draft, feature, unfeature, delete
- ✓SKU and stock tracking per variation
📋
Module 6: Order Management
- ✓Order list with status filter, search, pagination
- ✓Order detail with items, status history timeline
- ✓Status transitions: pending → processing → shipped → delivered / cancelled
- ✓Stock restoration on cancellation
- ✓CSV export with formula injection protection
- ✓Printable invoice view
- ✓Status history tracking with notes and timestamps
🎟️
Module 7: Coupons & Discounts
- ✓Percentage or fixed-amount discount types
- ✓Minimum order threshold
- ✓Maximum usage limits
- ✓Expiration dates
- ✓Active/inactive toggle
- ✓Real-time validation at checkout (AJAX)
⭐
Module 8: Reviews & Ratings
- ✓1-5 star rating with title and comment
- ✓Verified purchase reviews only
- ✓Admin moderation: approve, reject, hold
- ✓Average rating calculation on product pages
- ✓Rating distribution display
- ✓Duplicate review prevention
📰
Module 9: Content Management
- ✓Blog with title, slug, excerpt, content, image, author
- ✓Static CMS pages (About, Terms, Privacy, etc.)
- ✓Draft/published status
- ✓SEO-friendly slugs and meta descriptions
- ✓Homepage banner/slider management
- ✓FAQ management with sort order
🎫
Module 10: Support System
- ✓Customer ticket creation with subject, message
- ✓Ticket list with status/priority filters
- ✓Admin reply with email notification
- ✓Status transitions: new → open → replied → resolved
- ✓Priority levels: low, medium, high, urgent
- ✓Category classification
- ✓Ticket statistics dashboard
📧
Module 11: Email & Notifications
- ✓SMTP delivery with TLS/SSL support
- ✓Background queue worker (30s interval, batch of 10)
- ✓Retry logic (3 max attempts)
- ✓Order confirmation emails
- ✓Shipping update emails
- ✓Support ticket reply notifications
- ✓Newsletter subscriber management
- ✓CSV export of subscribers
📊
Module 12: Analytics & Reports
- ✓Dashboard: revenue, orders, products, customers stats
- ✓Revenue chart (6 months)
- ✓Top 5 selling products
- ✓Sales report: total orders, revenue, avg order value
- ✓Products report: top sellers, low stock alerts
- ✓Customers report: total/new, top by spend
- ✓Date range filtering for all reports
- ✓CSV export for all report types
- ✓Admin activity audit trail with IP logging
6. How It Works
Step-by-step workflows for key processes
Customer Purchase Flow
Landing
Home page SSR
→
Browse
Shop + Filter
→
Product
Detail + Variants
→
Cart
Session Persist
→
Coupon
Discount
→
Payment
Razorpay/COD
→
Confirm
Email + Track
Admin Order Processing Flow
New Order
Dashboard alert
→
Review
Order details
→
Process
Update status
→
Ship
Add tracking
→
Notify
Email customer
→
Delivered
Complete
Payment Verification Flow
Customer Pays
Razorpay modal
→
Razorpay
Returns signature
→
Verify HMAC
SHA256 check
→
Confirm
Update order
→
Email
Confirmation
7. Target Users & Use Cases
6 real-world scenarios for the platform
👗 Fashion Brand Owner
Scenario: A Mumbai-based fashion label wants to sell online. They upload 500+ products with size/color variations, set up Razorpay, configure GST, and launch in 2 days. The admin panel lets their team manage orders without any technical knowledge.
🏪 Multi-Store Retailer
Scenario: A chain of stores in Delhi wants online presence. They use the role system — store managers get "editor" access, support staff get "support" access. Each role sees only what they need. The activity log tracks every action.
📦 Dropshipping Business
Scenario: An entrepreneur runs a fashion dropship store. The CSV export helps with supplier coordination. The coupon engine drives flash sales. The newsletter system builds a customer email list for remarketing.
👨💻 WordPress Migrant
Scenario: A store currently on WooCommerce suffers from slow loading and plugin conflicts. They migrate to AVR using the built-in WordPress migration tool. Response time drops from 200ms to 2ms. No more plugin updates.
🛍️ Startup Fashion Brand
Scenario: A new D2C brand needs to launch fast. They get the platform, customize branding via admin settings (logo, colors, social links), add products, and go live. Total cost: one-time fee vs ₹2L+/year on Shopify.
📞 Customer Support Team
Scenario: A support team handles 50+ queries daily. The ticket system categorizes issues by priority and type. Email notifications ensure no ticket goes unanswered. The admin dashboard shows resolution metrics.
8. System Requirements & Specifications
Hardware, software, and infrastructure requirements
🖥️ Minimum Server Requirements
OS: Linux (Ubuntu 20.04+), Windows Server 2019+, or macOS
CPU: 1 vCPU (2+ recommended)
RAM: 512MB (1GB+ recommended)
Storage: 500MB (plus uploads)
Network: 1Mbps+ broadband
Database: MySQL 8.x (XAMPP for local dev)
For Production:
• 2+ vCPU, 2GB+ RAM recommended
• SSD storage for database
• SSL certificate (Let's Encrypt free)
• Domain name pointing to server IP
CPU: 1 vCPU (2+ recommended)
RAM: 512MB (1GB+ recommended)
Storage: 500MB (plus uploads)
Network: 1Mbps+ broadband
Database: MySQL 8.x (XAMPP for local dev)
For Production:
• 2+ vCPU, 2GB+ RAM recommended
• SSD storage for database
• SSL certificate (Let's Encrypt free)
• Domain name pointing to server IP
🛠️ Development Requirements
Go: 1.23 or higher installed
MySQL: 8.x (via XAMPP or standalone)
Git: For version control
Editor: VS Code / GoLand recommended
Local Setup:
• XAMPP for MySQL on Windows
• MySQL Workbench for DB management
• Browser (Chrome/Firefox) for testing
• Razorpay test account for payment testing
No build tools required:
• No npm, no webpack, no vite
• No node_modules folder
• No compilation step for frontend
• Just
MySQL: 8.x (via XAMPP or standalone)
Git: For version control
Editor: VS Code / GoLand recommended
Local Setup:
• XAMPP for MySQL on Windows
• MySQL Workbench for DB management
• Browser (Chrome/Firefox) for testing
• Razorpay test account for payment testing
No build tools required:
• No npm, no webpack, no vite
• No node_modules folder
• No compilation step for frontend
• Just
go run cmd/web/main.go
Minimal Footprint: The entire application — binary + static files + templates — fits under 150MB. The running process uses ~15MB RAM. Compare this to a typical WordPress install (500MB+) or Node.js app (80MB+).
9. API Credentials & Setup Guide
Step-by-step configuration for each external service
💳 Razorpay Payment Gateway
Step 1: Sign up at
Step 2: Complete KYC verification (required for live mode)
Step 3: Go to Settings → API Keys → Generate Key
Step 4: Copy Key ID (rzp_test_xxxxx) and Key Secret
Step 5: In Admin → Settings → Payment:
• Set
• Paste
• Paste
Step 6: Configure webhook URL:
Step 7: Test with Razorpay test keys first, then switch to live
razorpay.comStep 2: Complete KYC verification (required for live mode)
Step 3: Go to Settings → API Keys → Generate Key
Step 4: Copy Key ID (rzp_test_xxxxx) and Key Secret
Step 5: In Admin → Settings → Payment:
• Set
razorpay_enabled = 1• Paste
razorpay_key_id• Paste
razorpay_key_secretStep 6: Configure webhook URL:
yourdomain.com/payment/webhook/razorpayStep 7: Test with Razorpay test keys first, then switch to live
📧 SMTP Email Service
Step 1: Choose SMTP provider (Gmail, SendGrid, Mailgun, AWS SES)
Step 2: Get SMTP credentials from provider
Step 3: In Admin → Settings → Email/SMTP:
•
•
•
•
•
•
•
Step 4: Enable queue:
Step 5: Test by placing a test order
Step 2: Get SMTP credentials from provider
Step 3: In Admin → Settings → Email/SMTP:
•
smtp_host = smtp.gmail.com (or provider host)•
smtp_port = 587 (TLS) or 465 (SSL)•
smtp_encryption = TLS or SSL•
smtp_username = your-email@gmail.com•
smtp_password = app-specific password•
email_from = noreply@yourdomain.com•
email_from_name = AVR Fashion WearStep 4: Enable queue:
mail_using_queue = 1Step 5: Test by placing a test order
🔍 Google Services
Google Analytics:
1. Create GA4 property at analytics.google.com
2. Copy Measurement ID (G-XXXXXXXXXX)
3. Admin → Settings →
4. Enable:
Google reCAPTCHA:
1. Register at google.com/recaptcha
2. Choose reCAPTCHA v2 Checkbox
3. Copy Site Key and Secret Key
4. Admin → Settings →
5. Admin → Settings →
6. Enable:
1. Create GA4 property at analytics.google.com
2. Copy Measurement ID (G-XXXXXXXXXX)
3. Admin → Settings →
google_analytics_id4. Enable:
google_analytics_enabled = 1Google reCAPTCHA:
1. Register at google.com/recaptcha
2. Choose reCAPTCHA v2 Checkbox
3. Copy Site Key and Secret Key
4. Admin → Settings →
google_recaptcha_site_key5. Admin → Settings →
google_recaptcha_secret_key6. Enable:
google_recaptcha_enabled = 1
📘 Facebook Services
Facebook Pixel:
1. Create Pixel at business.facebook.com
2. Copy Pixel ID
3. Admin → Settings →
4. Enable:
Facebook Messenger:
1. Set up Messenger in Facebook Business
2. Copy Page ID
3. Admin → Settings →
4. Enable:
1. Create Pixel at business.facebook.com
2. Copy Pixel ID
3. Admin → Settings →
facebook_pixel_id4. Enable:
facebook_pixel_enabled = 1Facebook Messenger:
1. Set up Messenger in Facebook Business
2. Copy Page ID
3. Admin → Settings →
facebook_messenger_page_id4. Enable:
facebook_messenger_enabled = 1
.env — Core Configuration
# Application APP_NAME=AVR Fashion Wear APP_PORT=3000 APP_URL=http://localhost:3000 # Database (XAMPP MySQL) DB_HOST=127.0.0.1 DB_PORT=3306 DB_USER=root DB_PASS= DB_NAME=avrfashionwear # Session Security SESSION_KEY=your-random-secret-key-here
10. Database Schema
All 22 tables with complete column definitions
Core E-Commerce (7 tables)
| Table | Columns | Purpose |
|---|---|---|
| categories | id, wp_id, name, slug, description, image, created_at | Product categories |
| products | id, wp_id, category_id, name, slug, description, price, sale_price, sku, stock, image, gallery, has_variations, featured, status, created_at, updated_at | Product catalog (17 cols) |
| product_variations | id, product_id, size, color, color_hex, sku, price, stock, status, created_at | Size/color variants |
| product_images | id, product_id, image, sort_order, created_at | Gallery images |
| cart_items | id, session_id, user_id, product_id, variation_id, quantity, created_at | Shopping cart |
| orders | id, user_id, full_name, email, phone, address, city, state, zip, total, status, payment_method, coupon_code, discount, payment_id, payment_status, tax_amount, notes, created_at, updated_at | Orders (20 cols) |
| order_items | id, order_id, product_id, variation_id, quantity, price | Order line items |
Users & Auth (4 tables)
| Table | Columns | Purpose |
|---|---|---|
| users | id, name, email, password_hash, phone, address, city, state, zip, role, role_id, last_login, created_at | All user accounts |
| addresses | id, user_id, label, full_name, phone, address_line1, address_line2, city, state, zip, is_default, created_at | Saved addresses |
| roles | id, name, description, permissions (JSON), created_at | RBAC roles |
| wishlist | id, user_id, product_id, created_at | User wishlists |
Content & Engagement (5 tables)
| Table | Columns | Purpose |
|---|---|---|
| reviews | id, user_id, product_id, rating, title, comment, status, created_at | Product reviews |
| coupons | id, code, type, value, min_order, max_uses, used_count, expires_at, active, created_at | Discount codes |
| banners | id, title, subtitle, image, link, sort_order, active, created_at | Homepage sliders |
| blog_posts | id, title, slug, excerpt, content, image, author, status, created_at, updated_at | Blog articles |
| pages | id, title, slug, content, meta_description, status, created_at, updated_at | CMS static pages |
Support & System (6 tables)
| Table | Columns | Purpose |
|---|---|---|
| contact_submissions | id, user_id, name, email, phone, subject, message, status, priority, category, created_at, updated_at, assigned_to | Tickets & contacts |
| ticket_replies | id, ticket_id, sender_type, sender_id, message, created_at | Ticket conversations |
| order_status_history | id, order_id, status, note, created_at | Status change log |
| admin_activity_logs | id, admin_id, admin_email, action, entity_type, entity_id, details, ip_address, created_at | Admin audit trail |
| email_queue | id, recipient_email, subject, body, status, attempts, max_attempts, created_at, sent_at | Async email delivery |
| settings | id, setting_key, setting_value, created_at, updated_at | Key-value config (47 keys) |
| newsletter_subscribers | id, email, active, created_at | Email subscribers |
| faqs | id, question, answer, sort_order, active, created_at | FAQ entries |
11. API Endpoints Reference
All 118 route registrations across 5 groups
Route Breakdown: 40 public storefront routes + 2 unprotected admin routes + 71 protected admin routes + 2 payment routes + 1 error handler + 2 static file servers = 118 total
🌐 Public Storefront (40 routes)
GET/Homepage — featured products, banners, categories, reviews
GET/shopProduct listing — category filter, search, sort, pagination
GET/product?slug=...Product detail — variations, reviews, gallery, related
GET/cartShopping cart view with totals
POST/cart/addAdd product to cart (AJAX-aware)
POST/cart/updateUpdate cart item quantity
POST/cart/removeRemove cart item (AJAX)
GET/cart/countCart item count (plain text, AJAX)
GET,POST/checkoutCheckout — address, payment, Razorpay, order creation
GET/order?id=...Order confirmation/detail
GET/loginCustomer login form
POST/loginAuthenticate customer (rejects admin, merges cart)
GET/registerRegistration form
POST/registerCreate customer account
GET/logoutClear session, redirect home
GET/accountAccount dashboard — orders, addresses, spending
POST/account/update-profileUpdate name, phone, email
POST/account/change-passwordChange password
POST/account/address/saveCreate/update shipping address
GET/account/address/delete?id=...Delete shipping address
GET/account/order?id=...Order detail (ownership verified)
POST/account/order/cancelCancel order, restore stock
GET/wishlistWishlist page (login required)
POST/wishlist/toggleAdd/remove from wishlist (AJAX)
GET/blogBlog listing with pagination
GET/blog/{slug}Blog post detail
GET/page/{slug}CMS page detail
GET/aboutAbout page (CMS)
GET,POST/contactContact form with reCAPTCHA
GET,POST/trackOrder tracking by ID + email
POST/review/submitSubmit product review (login required)
POST/apply-couponValidate coupon, return discount (AJAX)
POST/uploadImage upload (10MB, jpg/png/gif/webp)
GET/api/searchAJAX search suggestions (JSON)
POST/newsletter/subscribeSubscribe to newsletter (AJAX)
GET/compareProduct comparison page
GET/faqsPublic FAQ page
GET/reviewsPublic reviews page with rating distribution
GET/sitemap.xmlDynamic XML sitemap
🔐 Admin Panel — Unprotected (2 routes)
GET,POST/admin/loginAdmin login (rejects non-admin users)
GET/admin/logoutClear session, redirect to admin login
🛡️ Admin Panel — Protected (71 routes)
GET/adminDashboard — stats, charts, top products
GET/admin/productsProduct list with search/pagination
GET/admin/products/newAdd product form
GET/admin/products/edit?id=...Edit product form
POST/admin/products/saveSave product with variations & gallery
POST/admin/products/bulkBulk activate/draft/feature/delete
GET/admin/products/duplicate?id=...Clone product as draft
GET/admin/products/delete?id=...Delete product
GET/admin/categoriesCategory list
POST/admin/categories/saveSave category
GET/admin/ordersOrders with status/search filters
POST/admin/orders/update-statusUpdate order status
GET/admin/orders/exportCSV export of orders
GET/admin/orders/printPrintable invoice
GET/admin/usersUser/customer list
POST/admin/users/saveSave user (with optional password reset)
GET/admin/users/view?id=...View user detail, orders, spending
POST/admin/users/address/saveAdmin-managed address save
GET/admin/bannersBanner list
POST/admin/banners/saveSave banner
GET/admin/couponsCoupon list
POST/admin/coupons/saveSave coupon with expiry/limits
GET/admin/reviewsReview moderation queue
POST/admin/reviews/update-statusApprove/reject/hold review
GET/admin/blogBlog post list
POST/admin/blog/saveSave blog post
GET/admin/pagesCMS page list
POST/admin/pages/saveSave CMS page
GET,POST/admin/settingsStore settings (50+ config keys)
GET/admin/newsletterNewsletter subscriber list
GET/admin/newsletter/exportExport subscribers CSV
GET/admin/faqsFAQ list
POST/admin/faqs/saveSave FAQ
GET/admin/ticketsSupport ticket list with filters
POST/admin/tickets/replyReply to ticket (sends email)
POST/admin/tickets/statusUpdate ticket status
POST/admin/tickets/updateUpdate ticket fields
GET/admin/activity-logsAdmin action audit trail
GET/admin/reportsSales/products/customers reports
GET/admin/reports/exportExport report CSV
GET/admin/rolesRole management list
POST/admin/roles/saveSave role with JSON permissions
💳 Payment Routes (2 routes)
POST/payment/verifyRazorpay HMAC-SHA256 signature verification
POST/payment/webhook/razorpayRazorpay webhook endpoint
🚫 Error Handler (1 route)
GET/404Custom 404 page
📁 Static File Servers (2 registrations)
GET/static/*CSS, JS, images from static/ directory
GET/uploads/*User-uploaded files from uploads/ directory
12. Security Features
Defense-in-depth approach with multiple security layers
🔐 Authentication
Password Hashing: bcrypt (DefaultCost)
Session Management: HttpOnly cookies, 30-day expiry (customers), 7-day (admin)
Role Verification: DB check on every admin request
Session Expiry: Timestamp-based with auto-clear
Admin Isolation: Separate login, rejects customer credentials
Session Management: HttpOnly cookies, 30-day expiry (customers), 7-day (admin)
Role Verification: DB check on every admin request
Session Expiry: Timestamp-based with auto-clear
Admin Isolation: Separate login, rejects customer credentials
🛡️ CSRF Protection
Pattern: Double-submit cookie
Token: 32-byte random hex (64 chars)
Validation: Cookie vs Form/Header match
Scope: All POST requests validated
JS Access: HttpOnly=false for AJAX reads
Expiry: 24 hours
Token: 32-byte random hex (64 chars)
Validation: Cookie vs Form/Header match
Scope: All POST requests validated
JS Access: HttpOnly=false for AJAX reads
Expiry: 24 hours
🔒 Transport Security
SMTP: TLS/SSL encrypted email
Payment: HMAC-SHA256 signature verification
Cookies: HttpOnly + SameSite=Lax
XSS: Go auto-escapes template output
SQL: Parameterized queries via sqlx
Upload: File type validation (jpg/png/gif/webp), 10MB limit
Payment: HMAC-SHA256 signature verification
Cookies: HttpOnly + SameSite=Lax
XSS: Go auto-escapes template output
SQL: Parameterized queries via sqlx
Upload: File type validation (jpg/png/gif/webp), 10MB limit
📝 Audit & Compliance
Activity Logs: Every admin action tracked
IP Logging: All admin actions include IP
Entity Tracking: Action type, entity ID, details
Status History: Order changes with timestamps
CSV Protection: Formula injection prevention in exports
IP Logging: All admin actions include IP
Entity Tracking: Action type, entity ID, details
Status History: Order changes with timestamps
CSV Protection: Formula injection prevention in exports
🔑 Data Protection
Passwords: Never stored in plaintext
Sessions: HttpOnly prevents XSS access
CSRF: Prevents cross-site request forgery
SQL Injection: Parameterized queries throughout
File Upload: Type and size validation
Config: Secrets in .env, never hardcoded
Sessions: HttpOnly prevents XSS access
CSRF: Prevents cross-site request forgery
SQL Injection: Parameterized queries throughout
File Upload: Type and size validation
Config: Secrets in .env, never hardcoded
👥 Access Control
RBAC: 4 default roles (admin, editor, support, viewer)
JSON Permissions: Granular per-module access
Route Guards: middleware.AuthAdmin on all admin routes
Session Isolation: Admin sessions separate from customer
Cart Security: User-linked cart, session-linked guest cart
JSON Permissions: Granular per-module access
Route Guards: middleware.AuthAdmin on all admin routes
Session Isolation: Admin sessions separate from customer
Cart Security: User-linked cart, session-linked guest cart
internal/middleware/middleware.go — CSRF Validation
func ValidateCSRF(r *http.Request) bool { if r.Method != "POST" { return true } tokenCookie := GetCSRFToken(r) tokenForm := r.FormValue("csrf_token") tokenHeader := r.Header.Get("X-CSRF-Token") if tokenCookie == "" { return false } submitted := tokenForm if submitted == "" { submitted = tokenHeader } return submitted != "" && submitted == tokenCookie }
13. Installation & Deployment Guide
From development to production — complete setup instructions
Development Setup
Terminal — Local Development
# 1. Install Go 1.23+ from go.dev go version # Verify installation # 2. Start MySQL (XAMPP Control Panel) # Ensure MySQL is running on port 3306 # 3. Create database mysql -u root -e "CREATE DATABASE avrfashionwear CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" # 4. Navigate to project cd avrfashionwear # 5. Install dependencies go mod download # 6. Configure environment copy .env.example .env # Windows cp .env.example .env # Linux/Mac # Edit .env with your settings # 7. Setup database (creates tables + seed data) go run cmd/setup/main.go # 8. Run development server go run cmd/web/main.go # 9. Open browser # Storefront: http://localhost:3000 # Admin Panel: http://localhost:3000/admin/login # Admin Credentials: admin@avrfashionwear.com / admin123
Production Deployment
Terminal — Production Build & Deploy
# Build production binary (Windows) go build -o avrfashionwear.exe cmd/web/main.go # Build for Linux (cross-compile) GOOS=linux GOARCH=amd64 go build -o avrfashionwear cmd/web/main.go # Deploy to server scp avrfashionwear user@server:/opt/avrfashionwear/ scp -r static/ uploads/ migrations/ .env user@server:/opt/avrfashionwear/ # On server: setup MySQL and run migrations mysql -u root -e "CREATE DATABASE avrfashionwear CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" ./avrfashionwear # Runs setup + starts server # Run as background service (systemd) sudo systemctl enable avrfashionwear sudo systemctl start avrfashionwear
Post-Deployment Checklist
✅ Essential Setup
☐ Change admin password (admin123 → strong password)
☐ Update SESSION_KEY in .env
☐ Configure Razorpay live keys
☐ Setup SMTP email credentials
☐ Update APP_URL to production domain
☐ Enable SSL (HTTPS)
☐ Update SESSION_KEY in .env
☐ Configure Razorpay live keys
☐ Setup SMTP email credentials
☐ Update APP_URL to production domain
☐ Enable SSL (HTTPS)
✅ Content Setup
☐ Upload store logo and favicon
☐ Create product categories
☐ Add products with images & variations
☐ Setup homepage banners
☐ Write About Us and Terms pages
☐ Configure shipping rates
☐ Create product categories
☐ Add products with images & variations
☐ Setup homepage banners
☐ Write About Us and Terms pages
☐ Configure shipping rates
✅ Marketing Setup
☐ Configure Google Analytics ID
☐ Setup Facebook Pixel
☐ Enable Google reCAPTCHA
☐ Create initial coupons
☐ Setup social media links
☐ Write first blog posts
☐ Setup Facebook Pixel
☐ Enable Google reCAPTCHA
☐ Create initial coupons
☐ Setup social media links
☐ Write first blog posts
Ready to Launch: After completing the checklist above, your AVR Fashion Wear store is live. Monitor the admin dashboard for orders, respond to support tickets, and grow your fashion business with a platform that scales with you.
Project Investment
One-Time Development Cost
One-Time Project Investment
₹75,000/-
Seventy-Five Thousand Rupees Only
✦ One-Time Development Cost ✦
Investment Includes
| Scope | Status |
|---|---|
| UI/UX Design & Design Implementation | ✅ Included |
| Responsive Website Development | ✅ Included |
| Product / Catalog Management | ✅ Included |
| Admin Panel | ✅ Included |
| Customer Management | ✅ Included |
| Order Management | ✅ Included |
| Required Form & Enquiry Modules | ✅ Included |
| WhatsApp / Contact Integration | ✅ Included |
| Mobile, Tablet & Desktop Optimization | ✅ Included |
| Basic SEO & Technical Setup | ✅ Included |
| Testing & Quality Assurance | ✅ Included |
| Production Deployment | ✅ Included |
| Initial Technical Support | ✅ Included |
Payment Structure
| Milestone | Payment | Amount |
|---|---|---|
| Project Confirmation | 40% | ₹30,000/- |
| Development & Demo Completion | 40% | ₹30,000/- |
| Final Delivery & Deployment | 20% | ₹15,000/- |
| Total Project Investment | 100% | ₹75,000/- |
Commercial Terms
1. One-Time Development Fee — ₹75,000/- is a one-time development investment for the features and scope agreed upon in this document.
2. Scope of Work — The investment covers only the functionality and deliverables specified in the approved project scope.
3. Additional Requirements — Any new features, modules, integrations, design changes, or functionality requested outside the agreed scope will be evaluated and quoted separately.
4. Third-Party Charges — Domain, hosting, premium plugins, paid APIs, payment gateway charges, SMS/WhatsApp charges, external software subscriptions, and other third-party services are not included unless specifically mentioned.
5. Content & Assets — Required product information, images, logos, business information, and other content should be provided by the client in the required format.
6. Support & Maintenance — Initial technical support will be provided after deployment. Long-term maintenance and future enhancements can be taken up separately.
7. Taxes — Applicable taxes, if any, will be charged additionally as per the applicable regulations.
