How to Build a Subscription Box Service with Replit

1// After running /stripe, paste this into Replit Agent:
2// Build a subscription box service with Express, PostgreSQL (Drizzle ORM), and Stripe.
3// Schema: box_plans (id serial PK, name text, description text, price integer in cents,
4// interval text enum monthly/quarterly, stripe_price_id text unique, image_url text,
5// max_subscribers integer, is_active boolean default true),
6// subscribers (id serial PK, user_id text unique, stripe_customer_id text unique,
7// name text, email text, shipping_address jsonb, preferences jsonb, created_at),
8// subscriptions (id serial PK, subscriber_id int references subscribers,
9// box_plan_id int references box_plans, stripe_subscription_id text unique,
10// status text default active enum active/paused/cancelled/past_due,
11// current_period_end timestamp, skip_next boolean default false, created_at),
12// box_shipments (id serial PK, subscription_id int references subscriptions,
13// items jsonb, tracking_number text, status text default preparing
14// enum preparing/shipped/delivered, ship_date timestamp, delivered_date timestamp, created_at),
15// products (id serial PK, name text, category text, cost integer, image_url text, stock int default 0),
16// webhook_events (id serial PK, stripe_event_id text unique, event_type text, processed_at timestamp).
17// Routes: GET /api/plans, POST /api/subscribe (Stripe Checkout mode=subscription),
18// POST /api/subscriptions/:id/pause, POST /api/subscriptions/:id/skip,
19// PATCH /api/subscribers/preferences, PATCH /api/subscribers/address,
20// GET /api/subscribers/shipments, POST /api/admin/shipments/generate,
21// POST /api/webhooks/stripe (raw body, constructEvent sync).
22// Mount /api/webhooks/stripe BEFORE express.json() using express.raw().
23// React frontend: landing page with plan cards, subscriber dashboard with skip/pause toggles,
24// preference editor, address form, shipment history. Bind server to 0.0.0.0.

1// server/routes/subscribe.js
2const express = require('express');
3const stripe = require('../stripe');  // server/stripe.js singleton
4const { getBaseUrl } = require('../lib/baseUrl');
5const { db } = require('../db');
6const { boxPlans, subscribers } = require('../schema');
7const { eq } = require('drizzle-orm');
8
9const router = express.Router();
10
11router.post('/api/subscribe', express.json(), async (req, res) => {
12  const { planId, preferences, shippingAddress } = req.body;
13  const user = req.user;  // from Replit Auth
14  const baseUrl = getBaseUrl();
15
16  const [plan] = await db.select().from(boxPlans)
17    .where(eq(boxPlans.id, planId)).limit(1);
18
19  if (!plan || !plan.isActive) {
20    return res.status(400).json({ error: 'Plan not available' });
21  }
22
23  // Create or retrieve Stripe customer
24  let customer = await stripe.customers.create({
25    email: user.email,
26    name: user.name,
27    metadata: { user_id: user.id },
28  });
29
30  // Store subscriber record with preferences before checkout
31  await db.insert(subscribers).values({
32    userId: user.id,
33    stripeCustomerId: customer.id,
34    name: user.name,
35    email: user.email,
36    shippingAddress,
37    preferences,
38  }).onConflictDoNothing();
39
40  const session = await stripe.checkout.sessions.create({
41    mode: 'subscription',
42    customer: customer.id,
43    line_items: [{ price: plan.stripePriceId, quantity: 1 }],
44    success_url: `${baseUrl}/dashboard?subscribed=1&session_id={CHECKOUT_SESSION_ID}`,
45    cancel_url: `${baseUrl}/plans?canceled=1`,
46    subscription_data: {
47      trial_period_days: 7,
48      metadata: { user_id: user.id, plan_id: String(planId) },
49    },
50    metadata: { user_id: user.id, plan_id: String(planId) },
51  });
52
53  res.json({ url: session.url });
54});
55
56module.exports = router;

1// server/routes/webhook.js
2const express = require('express');
3const stripe = require('../stripe');
4const { db } = require('../db');
5const { eq, and } = require('drizzle-orm');
6const { subscriptions, subscribers, boxShipments, webhookEvents } = require('../schema');
7
8const router = express.Router();
9
10// IMPORTANT: mounted with express.raw() in server/index.js BEFORE express.json()
11router.post('/', async (req, res) => {
12  const sig = req.headers['stripe-signature'];
13  let event;
14
15  try {
16    // constructEvent is SYNCHRONOUS in Node.js — do NOT use constructEventAsync
17    event = stripe.webhooks.constructEvent(
18      req.body, sig, process.env.STRIPE_WEBHOOK_SECRET
19    );
20  } catch (err) {
21    console.error('[webhook] signature failed:', err.message);
22    return res.status(400).send(`Webhook Error: ${err.message}`);
23  }
24
25  // Idempotency check
26  const inserted = await db.insert(webhookEvents)
27    .values({ id: event.id, eventType: event.type })
28    .onConflictDoNothing()
29    .returning({ id: webhookEvents.id });
30
31  if (inserted.length === 0) {
32    return res.json({ received: true, duplicate: true });
33  }
34
35  try {
36    switch (event.type) {
37      case 'customer.subscription.created':
38      case 'customer.subscription.updated':
39        await upsertSubscription(event.data.object);
40        break;
41      case 'customer.subscription.deleted':
42        await db.update(subscriptions)
43          .set({ status: 'cancelled' })
44          .where(eq(subscriptions.stripeSubscriptionId, event.data.object.id));
45        break;
46      case 'invoice.paid':
47        await handleInvoicePaid(event.data.object);
48        break;
49      case 'invoice.payment_failed':
50        await db.update(subscriptions)
51          .set({ status: 'past_due' })
52          .where(eq(subscriptions.stripeSubscriptionId, event.data.object.subscription));
53        break;
54    }
55    res.json({ received: true });
56  } catch (err) {
57    console.error('[webhook] handler error:', err);
58    res.status(500).send('handler error');
59  }
60});
61
62async function upsertSubscription(sub) {
63  const item = sub.items.data[0];
64  await db.insert(subscriptions).values({
65    stripeSubscriptionId: sub.id,
66    status: sub.status,
67    currentPeriodEnd: new Date(sub.current_period_end * 1000),
68    skipNext: false,
69  }).onConflictDoUpdate({
70    target: subscriptions.stripeSubscriptionId,
71    set: { status: sub.status, currentPeriodEnd: new Date(sub.current_period_end * 1000) },
72  });
73}
74
75async function handleInvoicePaid(invoice) {
76  const [sub] = await db.select().from(subscriptions)
77    .where(eq(subscriptions.stripeSubscriptionId, invoice.subscription)).limit(1);
78
79  if (!sub) return;
80
81  await db.update(subscriptions)
82    .set({ status: 'active' })
83    .where(eq(subscriptions.id, sub.id));
84
85  if (!sub.skipNext) {
86    await db.insert(boxShipments).values({
87      subscriptionId: sub.id,
88      items: [],  // populated by admin shipment generation job
89      status: 'preparing',
90    });
91  } else {
92    // Reset skip flag for next cycle
93    await db.update(subscriptions)
94      .set({ skipNext: false })
95      .where(eq(subscriptions.id, sub.id));
96  }
97}
98
99module.exports = router;

1// server/routes/subscription-controls.js
2const express = require('express');
3const stripe = require('../stripe');
4const { db } = require('../db');
5const { eq } = require('drizzle-orm');
6const { subscriptions } = require('../schema');
7
8const router = express.Router();
9
10// POST /api/subscriptions/:id/skip — skip next billing cycle box
11router.post('/api/subscriptions/:id/skip', express.json(), async (req, res) => {
12  const subId = parseInt(req.params.id);
13  const userId = req.user.id;
14
15  const [sub] = await db.select().from(subscriptions)
16    .where(eq(subscriptions.id, subId)).limit(1);
17
18  if (!sub) return res.status(404).json({ error: 'Subscription not found' });
19
20  await db.update(subscriptions)
21    .set({ skipNext: !sub.skipNext })  // toggle
22    .where(eq(subscriptions.id, subId));
23
24  res.json({ skipNext: !sub.skipNext });
25});
26
27// POST /api/subscriptions/:id/pause — pause via Stripe pause_collection
28router.post('/api/subscriptions/:id/pause', express.json(), async (req, res) => {
29  const subId = parseInt(req.params.id);
30
31  const [sub] = await db.select().from(subscriptions)
32    .where(eq(subscriptions.id, subId)).limit(1);
33
34  if (!sub) return res.status(404).json({ error: 'Not found' });
35
36  if (sub.status === 'active') {
37    await stripe.subscriptions.update(sub.stripeSubscriptionId, {
38      pause_collection: { behavior: 'mark_uncollectible' },
39    });
40    await db.update(subscriptions).set({ status: 'paused' })
41      .where(eq(subscriptions.id, subId));
42  } else if (sub.status === 'paused') {
43    await stripe.subscriptions.update(sub.stripeSubscriptionId, {
44      pause_collection: '',  // empty string removes the pause
45    });
46    await db.update(subscriptions).set({ status: 'active' })
47      .where(eq(subscriptions.id, subId));
48  }
49
50  res.json({ status: sub.status === 'active' ? 'paused' : 'active' });
51});
52
53module.exports = router;

1// server/index.js — correct middleware ordering for webhooks
2const express = require('express');
3const app = express();
4
5// 1. Webhook route FIRST with raw body parser
6const webhookRouter = require('./routes/webhook');
7app.use('/api/webhooks/stripe',
8  express.raw({ type: 'application/json' }),
9  webhookRouter
10);
11
12// 2. JSON parser for all other routes
13app.use(express.json());
14
15// 3. API routes
16app.use(require('./routes/subscribe'));
17app.use(require('./routes/subscription-controls'));
18
19const PORT = process.env.PORT || 3000;
20app.listen(PORT, '0.0.0.0', () => {
21  console.log(`Subscription box server running on port ${PORT}`);
22});