How to Build a Auction Platform with Replit

1// Prompt to type into Replit Agent:
2// Build a Node.js Express auction platform with Replit Auth and built-in PostgreSQL using Drizzle ORM.
3// Schema in shared/schema.ts:
4// * sellers: id serial pk, user_id text not null unique, display_name text not null,
5//   stripe_customer_id text, verified boolean default false, created_at timestamp default now()
6// * auctions: id serial pk, seller_id integer references sellers(id) not null,
7//   title text not null, description text, images jsonb, starting_price integer not null,
8//   reserve_price integer, current_bid integer default 0, bid_count integer default 0,
9//   status text default 'draft', start_time timestamp not null, end_time timestamp not null,
10//   category text, created_at timestamp default now()
11// * bids: id serial pk, auction_id integer references auctions(id) not null,
12//   bidder_id text not null, amount integer not null, created_at timestamp default now()
13// * watchlist: id serial pk, user_id text not null, auction_id integer references auctions(id) not null,
14//   unique constraint on (user_id, auction_id)
15// * webhook_events: id serial pk, stripe_event_id text unique not null, event_type text,
16//   processed_at timestamp default now()
17// Routes: POST /api/auctions, GET /api/auctions, GET /api/auctions/:id,
18// POST /api/auctions/:id/bids, POST /api/auctions/:id/watch,
19// POST /api/auctions/:id/pay, POST /api/webhooks/stripe
20// React frontend with auction card grid, countdown timers, bid history table, bid input form

1// In the Replit Agent chat or Shell, type: /stripe
2// This automatically:
3// 1. Installs the stripe npm package
4// 2. Sets up STRIPE_SECRET_KEY and STRIPE_PUBLISHABLE_KEY in your workspace
5// 3. Creates a basic webhook handler at POST /api/webhooks/stripe
6// 4. Adds stripe.webhooks.constructEvent() verification
7//
8// IMPORTANT: After running /stripe, open the Secrets panel (lock icon 🔒)
9// and verify these are set:
10// STRIPE_SECRET_KEY=sk_test_...
11// STRIPE_PUBLISHABLE_KEY=pk_test_...
12// STRIPE_WEBHOOK_SECRET=whsec_...  (you'll get this from Stripe Dashboard after deploying)
13//
14// The webhook secret is only available after deployment.
15// Deploy first, then register your deployed URL in Stripe Dashboard:
16// Stripe Dashboard → Developers → Webhooks → Add endpoint
17// URL: https://your-repl.replit.app/api/webhooks/stripe
18// Events: checkout.session.completed
19// Copy the signing secret → add as STRIPE_WEBHOOK_SECRET in Deployment Secrets

1import { db } from '../db.js';
2import { auctions, bids } from '../../shared/schema.js';
3import { eq, sql } from 'drizzle-orm';
4
5const MIN_BID_INCREMENT = 100; // $1.00 minimum increment
6const ANTI_SNIPE_WINDOW_MS = 2 * 60 * 1000; // 2 minutes
7const ANTI_SNIPE_EXTENSION_MS = 2 * 60 * 1000; // extend by 2 minutes
8
9export async function placeBid(req, res) {
10  const auctionId = parseInt(req.params.id);
11  const bidderId = req.get('X-Replit-User-Id');
12  const amount = parseInt(req.body.amount); // in cents
13
14  if (!bidderId) return res.status(401).json({ error: 'Not authenticated' });
15  if (!amount || amount <= 0) return res.status(400).json({ error: 'Invalid bid amount' });
16
17  // Use raw SQL transaction for SELECT FOR UPDATE (Drizzle doesn't support it natively)
18  const client = await db.$client.connect();
19  try {
20    await client.query('BEGIN');
21
22    // Lock the auction row to prevent concurrent bid races
23    const { rows: [auction] } = await client.query(
24      'SELECT * FROM auctions WHERE id = $1 FOR UPDATE',
25      [auctionId]
26    );
27
28    if (!auction) { await client.query('ROLLBACK'); return res.status(404).json({ error: 'Auction not found' }); }
29    if (auction.status !== 'active') { await client.query('ROLLBACK'); return res.status(400).json({ error: 'Auction is not active' }); }
30    if (new Date(auction.end_time) <= new Date()) { await client.query('ROLLBACK'); return res.status(400).json({ error: 'Auction has ended' }); }
31    if (auction.seller_id === bidderId) { await client.query('ROLLBACK'); return res.status(400).json({ error: 'Sellers cannot bid on their own auctions' }); }
32
33    const minBid = Math.max(auction.starting_price, auction.current_bid + MIN_BID_INCREMENT);
34    if (amount < minBid) {
35      await client.query('ROLLBACK');
36      return res.status(400).json({ error: `Minimum bid is $${(minBid / 100).toFixed(2)}` });
37    }
38
39    // Insert the bid
40    await client.query(
41      'INSERT INTO bids (auction_id, bidder_id, amount) VALUES ($1, $2, $3)',
42      [auctionId, bidderId, amount]
43    );
44
45    // Anti-sniping: extend end_time if bid is within 2 minutes of end
46    const now = new Date();
47    const endTime = new Date(auction.end_time);
48    let newEndTime = endTime;
49    if (endTime - now < ANTI_SNIPE_WINDOW_MS) {
50      newEndTime = new Date(now.getTime() + ANTI_SNIPE_EXTENSION_MS);
51    }
52
53    // Update current_bid, bid_count, and optionally end_time
54    await client.query(
55      'UPDATE auctions SET current_bid = $1, bid_count = bid_count + 1, end_time = $2 WHERE id = $3',
56      [amount, newEndTime, auctionId]
57    );
58
59    await client.query('COMMIT');
60    res.json({ success: true, newBid: amount, newEndTime, antiSniped: newEndTime > endTime });
61  } catch (err) {
62    await client.query('ROLLBACK');
63    console.error('Bid placement error:', err);
64    res.status(500).json({ error: 'Bid placement failed' });
65  } finally {
66    client.release();
67  }
68}

1import Stripe from 'stripe';
2const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
3
4// POST /api/auctions/:id/pay — winner initiates payment
5export async function initiatePayment(req, res) {
6  const auctionId = parseInt(req.params.id);
7  const userId = req.get('X-Replit-User-Id');
8
9  const [auction] = await db.select().from(auctions).where(eq(auctions.id, auctionId));
10  if (!auction || auction.status !== 'ended') {
11    return res.status(400).json({ error: 'Auction is not in ended status' });
12  }
13
14  // Verify the requesting user is the highest bidder
15  const [winningBid] = await db
16    .select()
17    .from(bids)
18    .where(eq(bids.auctionId, auctionId))
19    .orderBy(sql`amount DESC`)
20    .limit(1);
21
22  if (!winningBid || winningBid.bidderId !== userId) {
23    return res.status(403).json({ error: 'Only the winning bidder can pay' });
24  }
25
26  // Check reserve price
27  if (auction.reservePrice && auction.currentBid < auction.reservePrice) {
28    return res.status(400).json({ error: 'Reserve price was not met — auction is unsold' });
29  }
30
31  const session = await stripe.checkout.sessions.create({
32    payment_method_types: ['card'],
33    mode: 'payment',
34    line_items: [{
35      price_data: {
36        currency: 'usd',
37        unit_amount: auction.currentBid,
38        product_data: { name: auction.title, description: `Winning bid for auction #${auctionId}` },
39      },
40      quantity: 1,
41    }],
42    success_url: `${process.env.APP_URL}/auctions/${auctionId}/confirmation?session_id={CHECKOUT_SESSION_ID}`,
43    cancel_url: `${process.env.APP_URL}/auctions/${auctionId}`,
44    metadata: { auctionId: String(auctionId), bidderId: userId },
45  });
46
47  res.json({ url: session.url });
48}
49
50// POST /api/webhooks/stripe — handle payment confirmation
51// MUST use express.raw({ type: 'application/json' }) — register BEFORE express.json()
52export function stripeWebhook(req, res) {
53  const sig = req.headers['stripe-signature'];
54  let event;
55
56  try {
57    // constructEvent is synchronous (Node.js) — NOT constructEventAsync (Deno-only)
58    event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
59  } catch (err) {
60    return res.status(400).json({ error: `Webhook signature failed: ${err.message}` });
61  }
62
63  if (event.type === 'checkout.session.completed') {
64    const session = event.data.object;
65    const { auctionId } = session.metadata;
66    db.update(auctions)
67      .set({ status: 'sold' })
68      .where(eq(auctions.id, parseInt(auctionId)))
69      .catch(console.error);
70  }
71
72  res.json({ received: true });
73}

1// Deploy steps:
2// 1. Click Deploy in Replit top-right → choose Reserved VM (not Autoscale)
3// 2. Select the $10/month tier for low-traffic auctions
4//
5// In Deployment Secrets (separate from workspace Secrets), add:
6// STRIPE_SECRET_KEY=sk_test_...  (or sk_live_... for production)
7// STRIPE_WEBHOOK_SECRET=whsec_... (get this from Stripe Dashboard)
8// APP_URL=https://your-deployed-url.replit.app
9//
10// Register webhook in Stripe Dashboard:
11// Developers → Webhooks → Add endpoint
12// URL: https://your-deployed-url.replit.app/api/webhooks/stripe
13// Events to listen for: checkout.session.completed
14//
15// Test the full flow in Stripe test mode:
16// - Create an auction (status = active, end_time = 5 minutes from now)
17// - Place a bid from a second account (private browser)
18// - After end_time, click Pay Now as the winner
19// - Use Stripe test card: 4242 4242 4242 4242, any future expiry, any CVC
20// - Check that auction status changes to 'sold' after payment