How to Build a Marketplace with Replit

1// Type this into Replit Agent:
2// Build a multi-vendor marketplace with Express and PostgreSQL using Drizzle ORM.
3// DO NOT use the /stripe command — install stripe SDK manually: npm install stripe.
4// Tables:
5// - sellers: id serial pk, user_id text unique not null, store_name text not null,
6//   store_description text, logo_url text, stripe_account_id text, payout_status text default 'pending'
7//   (enum: pending/active/disabled), commission_rate numeric default 0.10, created_at timestamp
8// - categories: id serial, name text unique not null, slug text unique not null, position integer default 0
9// - listings: id serial, seller_id integer FK sellers, category_id integer FK categories,
10//   title text not null, description text not null, price integer not null (cents),
11//   images jsonb default '[]', status text default 'draft'
12//   (enum: draft/pending_review/active/sold_out/suspended), stock integer default 1,
13//   tags text[], created_at timestamp, updated_at timestamp
14// - orders: id serial, buyer_id text not null, listing_id integer FK listings,
15//   seller_id integer FK sellers, quantity integer default 1, total_amount integer not null,
16//   platform_fee integer not null, seller_payout integer not null, status text default 'pending'
17//   (enum: pending/paid/shipped/delivered/disputed/refunded),
18//   stripe_payment_intent_id text, shipping_address jsonb, created_at timestamp
19// - reviews: id serial, order_id integer FK orders unique, buyer_id text not null,
20//   seller_id integer FK sellers, rating integer not null, comment text, created_at timestamp
21// - webhook_events: id serial, stripe_event_id text unique not null, event_type text,
22//   processed_at timestamp default now()
23// Routes: POST /api/sellers/register, POST /api/sellers/onboard (Stripe Connect Express),
24// GET /api/sellers/dashboard, POST /api/listings, GET /api/listings (public browse),
25// GET /api/listings/:id, POST /api/orders (create Stripe Checkout Session with Connect),
26// POST /api/orders/:id/ship, POST /api/reviews, POST /api/webhooks/stripe (raw body).
27// Use Replit Auth. Bind server to 0.0.0.0.

1const Stripe = require('stripe');
2const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
3const { sellers } = require('../../shared/schema');
4const { eq } = require('drizzle-orm');
5
6// POST /api/sellers/register — create seller profile
7router.post('/sellers/register', async (req, res) => {
8  const userId = req.user?.id;
9  if (!userId) return res.status(401).json({ error: 'Login required' });
10
11  const { storeName, storeDescription } = req.body;
12  try {
13    const [seller] = await db.insert(sellers).values({
14      userId,
15      storeName,
16      storeDescription,
17      payoutStatus: 'pending',
18    }).returning();
19    res.status(201).json(seller);
20  } catch (err) {
21    if (err.code === '23505') return res.status(409).json({ error: 'Already registered as seller' });
22    res.status(500).json({ error: err.message });
23  }
24});
25
26// POST /api/sellers/onboard — initiate Stripe Connect Express onboarding
27router.post('/sellers/onboard', async (req, res) => {
28  const userId = req.user?.id;
29  const [seller] = await db.select().from(sellers).where(eq(sellers.userId, userId));
30  if (!seller) return res.status(404).json({ error: 'Register as seller first' });
31
32  let accountId = seller.stripeAccountId;
33
34  // Create Stripe Express account if none exists
35  if (!accountId) {
36    const account = await stripe.accounts.create({
37      type: 'express',
38      capabilities: { card_payments: { requested: true }, transfers: { requested: true } },
39    });
40    accountId = account.id;
41    await db.update(sellers).set({ stripeAccountId: accountId }).where(eq(sellers.id, seller.id));
42  }
43
44  // Create an Account Link for onboarding redirect
45  const accountLink = await stripe.accountLinks.create({
46    account: accountId,
47    refresh_url: `${process.env.REPLIT_DEPLOYMENT_URL}/seller/onboard`,
48    return_url: `${process.env.REPLIT_DEPLOYMENT_URL}/seller/dashboard`,
49    type: 'account_onboarding',
50  });
51
52  res.json({ url: accountLink.url });
53});

1// POST /api/orders — create order and Stripe Checkout Session
2router.post('/orders', async (req, res) => {
3  const buyerId = req.user?.id;
4  if (!buyerId) return res.status(401).json({ error: 'Login required' });
5
6  const { listingId, quantity = 1, shippingAddress } = req.body;
7
8  const [listing] = await db.select().from(listings)
9    .innerJoin(sellers, eq(listings.sellerId, sellers.id))
10    .where(eq(listings.id, listingId));
11
12  if (!listing) return res.status(404).json({ error: 'Listing not found' });
13  if (listing.listings.status !== 'active') return res.status(400).json({ error: 'Listing not available' });
14  if (listing.sellers.payoutStatus !== 'active') return res.status(400).json({ error: 'Seller not yet verified' });
15
16  const totalAmount = listing.listings.price * quantity;
17  const commissionRate = parseFloat(listing.sellers.commissionRate);
18  const platformFee = Math.round(totalAmount * commissionRate);
19  const sellerPayout = totalAmount - platformFee;
20
21  // Create order record first (pending payment)
22  const [order] = await db.insert(orders).values({
23    buyerId,
24    listingId,
25    sellerId: listing.sellers.id,
26    quantity,
27    totalAmount,
28    platformFee,
29    sellerPayout,
30    shippingAddress: shippingAddress || null,
31    status: 'pending',
32  }).returning();
33
34  // Create Stripe Checkout Session with Connect destination charge
35  const session = await stripe.checkout.sessions.create({
36    payment_method_types: ['card'],
37    line_items: [{
38      price_data: {
39        currency: 'usd',
40        product_data: { name: listing.listings.title },
41        unit_amount: listing.listings.price,
42      },
43      quantity,
44    }],
45    mode: 'payment',
46    success_url: `${process.env.REPLIT_DEPLOYMENT_URL}/orders/${order.id}/success`,
47    cancel_url: `${process.env.REPLIT_DEPLOYMENT_URL}/listings/${listingId}`,
48    payment_intent_data: {
49      application_fee_amount: platformFee,
50      transfer_data: { destination: listing.sellers.stripeAccountId },
51    },
52    metadata: { orderId: order.id.toString() },
53  });
54
55  res.json({ checkoutUrl: session.url, orderId: order.id });
56});

1const express = require('express');
2const Stripe = require('stripe');
3const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
4const { webhookEvents, orders, listings, sellers } = require('../../shared/schema');
5const { eq } = require('drizzle-orm');
6
7const router = express.Router();
8
9// POST /api/webhooks/stripe — raw body required for signature verification
10router.post('/webhooks/stripe', express.raw({ type: 'application/json' }), async (req, res) => {
11  const sig = req.headers['stripe-signature'];
12  let event;
13
14  try {
15    // constructEvent is SYNC — not async
16    event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
17  } catch (err) {
18    return res.status(400).json({ error: `Webhook signature verification failed: ${err.message}` });
19  }
20
21  // Deduplication: skip already-processed events
22  const existing = await db.select().from(webhookEvents)
23    .where(eq(webhookEvents.stripeEventId, event.id));
24  if (existing.length > 0) {
25    return res.json({ received: true, duplicate: true });
26  }
27
28  // Record event before processing
29  await db.insert(webhookEvents).values({
30    stripeEventId: event.id,
31    eventType: event.type,
32  });
33
34  // Process events
35  if (event.type === 'checkout.session.completed') {
36    const session = event.data.object;
37    const orderId = parseInt(session.metadata.orderId);
38
39    await db.update(orders)
40      .set({
41        status: 'paid',
42        stripePaymentIntentId: session.payment_intent,
43      })
44      .where(eq(orders.id, orderId));
45
46    // Decrement listing stock
47    const [order] = await db.select().from(orders).where(eq(orders.id, orderId));
48    if (order) {
49      await db.update(listings)
50        .set({ stock: sql`stock - ${order.quantity}` })
51        .where(eq(listings.id, order.listingId));
52    }
53  }
54
55  if (event.type === 'account.updated') {
56    const account = event.data.object;
57    if (account.charges_enabled && account.payouts_enabled) {
58      await db.update(sellers)
59        .set({ payoutStatus: 'active' })
60        .where(eq(sellers.stripeAccountId, account.id));
61    }
62  }
63
64  res.json({ received: true });
65});
66
67module.exports = router;

1// server/index.js — critical middleware order for webhook signature verification
2const express = require('express');
3const path = require('path');
4
5const webhooksRouter = require('./routes/webhooks');
6const apiRouter = require('./routes/api');
7
8const app = express();
9
10// IMPORTANT: Register webhook route BEFORE express.json()
11// Stripe requires raw body for signature verification
12app.use('/api/webhooks', webhooksRouter);
13
14// Then add JSON parsing for all other routes
15app.use(express.json());
16app.use('/api', apiRouter);
17
18// Serve React frontend
19app.use(express.static(path.join(__dirname, '../client/dist')));
20app.get('*', (req, res) => {
21  res.sendFile(path.join(__dirname, '../client/dist/index.html'));
22});
23
24// Bind to 0.0.0.0 — required for Replit
25app.listen(5000, '0.0.0.0', () => console.log('Marketplace running on port 5000'));
26
27// After deploying to Reserved VM:
28// 1. Go to Stripe Dashboard → Developers → Webhooks → Add endpoint
29// 2. Enter your Replit URL: https://your-repl.replit.app/api/webhooks/stripe
30// 3. Select events: checkout.session.completed, account.updated
31// 4. Copy the Signing Secret
32// 5. Add it to Replit Secrets as STRIPE_WEBHOOK_SECRET