How to Build a Customer Portal with Replit

1// Prompt to type into Replit Agent:
2// Build a Node.js Express customer portal with DUAL authentication:
3// - Replit Auth for admin routes (/api/admin/*)
4// - Passport.js local strategy for customer portal routes (/api/portal/*)
5// Built-in PostgreSQL with Drizzle ORM.
6// Schema in shared/schema.ts:
7// * customers: id serial pk, email text not null unique, name text not null,
8//   company text, password_hash text not null, magic_link_token text,
9//   magic_link_expires_at timestamp, created_at timestamp default now()
10// * orders: id serial pk, customer_id integer references customers not null,
11//   order_number text unique not null, items jsonb not null,
12//   total integer not null, status text default 'processing',
13//   tracking_number text, created_at timestamp default now()
14// * invoices: id serial pk, customer_id integer references customers not null,
15//   invoice_number text unique, amount integer not null, status text default 'unpaid',
16//   due_date timestamp, paid_at timestamp, pdf_url text
17// * tickets: id serial pk, customer_id integer references customers not null,
18//   subject text not null, status text default 'open', priority text default 'medium',
19//   created_at timestamp default now()
20// * ticket_messages: id serial pk, ticket_id integer references tickets not null,
21//   sender_type text not null, message text not null, created_at timestamp default now()
22// * documents: id serial pk, customer_id integer references customers not null,
23//   title text not null, file_url text not null, category text, uploaded_at timestamp default now()
24// Install: passport, passport-local, bcrypt, express-jwt, jsonwebtoken

1import passport from 'passport';
2import { Strategy as LocalStrategy } from 'passport-local';
3import bcrypt from 'bcrypt';
4import jwt from 'jsonwebtoken';
5import { db } from '../db.js';
6import { customers } from '../../shared/schema.js';
7import { eq } from 'drizzle-orm';
8
9// Configure Passport local strategy
10passport.use(new LocalStrategy(
11  { usernameField: 'email' },
12  async (email, password, done) => {
13    try {
14      const [customer] = await db.select().from(customers).where(eq(customers.email, email.toLowerCase()));
15      if (!customer) return done(null, false, { message: 'Invalid email or password' });
16
17      const isValid = await bcrypt.compare(password, customer.passwordHash);
18      if (!isValid) return done(null, false, { message: 'Invalid email or password' });
19
20      return done(null, customer);
21    } catch (err) {
22      return done(err);
23    }
24  }
25));
26
27// POST /api/auth/login
28export async function customerLogin(req, res, next) {
29  passport.authenticate('local', { session: false }, (err, customer, info) => {
30    if (err) return next(err);
31    if (!customer) return res.status(401).json({ error: info?.message || 'Authentication failed' });
32
33    const token = jwt.sign(
34      { customerId: customer.id, email: customer.email },
35      process.env.JWT_SECRET,
36      { expiresIn: '7d' }
37    );
38
39    res.json({ token, customer: { id: customer.id, name: customer.name, email: customer.email } });
40  })(req, res, next);
41}
42
43// JWT middleware for portal routes
44export function requireCustomer(req, res, next) {
45  const auth = req.headers.authorization;
46  if (!auth?.startsWith('Bearer ')) return res.status(401).json({ error: 'No token provided' });
47
48  try {
49    const payload = jwt.verify(auth.slice(7), process.env.JWT_SECRET);
50    req.customerId = payload.customerId;
51    next();
52  } catch {
53    res.status(401).json({ error: 'Invalid or expired token' });
54  }
55}

1import { db } from '../db.js';
2import { orders, invoices, tickets, ticketMessages, documents } from '../../shared/schema.js';
3import { eq, and, desc } from 'drizzle-orm';
4
5// GET /api/portal/orders — customer sees only THEIR orders
6export async function getMyOrders(req, res) {
7  const customerOrders = await db
8    .select()
9    .from(orders)
10    .where(eq(orders.customerId, req.customerId)) // MANDATORY: scope to authenticated customer
11    .orderBy(desc(orders.createdAt));
12  res.json(customerOrders);
13}
14
15// GET /api/portal/orders/:id — with customer_id guard
16export async function getMyOrder(req, res) {
17  const [order] = await db
18    .select()
19    .from(orders)
20    .where(and(
21      eq(orders.id, parseInt(req.params.id)),
22      eq(orders.customerId, req.customerId) // prevents customer A accessing customer B's order
23    ));
24  if (!order) return res.status(404).json({ error: 'Order not found' });
25  res.json(order);
26}
27
28// POST /api/portal/tickets — open a support ticket
29export async function createTicket(req, res) {
30  const { subject, message, priority } = req.body;
31  const [ticket] = await db.insert(tickets).values({
32    customerId: req.customerId,
33    subject, priority: priority || 'medium', status: 'open',
34  }).returning();
35
36  // First message is the issue description
37  await db.insert(ticketMessages).values({
38    ticketId: ticket.id, senderType: 'customer', message,
39  });
40
41  res.status(201).json(ticket);
42}
43
44// GET /api/portal/tickets/:id/messages — get conversation thread
45export async function getTicketMessages(req, res) {
46  const [ticket] = await db.select().from(tickets).where(
47    and(eq(tickets.id, parseInt(req.params.id)), eq(tickets.customerId, req.customerId))
48  );
49  if (!ticket) return res.status(404).json({ error: 'Ticket not found' });
50
51  const messages = await db.select().from(ticketMessages)
52    .where(eq(ticketMessages.ticketId, ticket.id))
53    .orderBy(ticketMessages.createdAt);
54  res.json(messages);
55}

1// Admin reply to a ticket (protected by Replit Auth)
2app.post('/api/admin/tickets/:id/reply', async (req, res) => {
3  const adminId = req.get('X-Replit-User-Id');
4  if (!adminId) return res.status(401).json({ error: 'Not authenticated' });
5  // TODO: add role check if you have multiple admin users
6
7  const { message } = req.body;
8  const [msg] = await db.insert(ticketMessages).values({
9    ticketId: parseInt(req.params.id),
10    senderType: 'agent',
11    message,
12  }).returning();
13
14  // Update ticket status to in_progress on first reply
15  await db.update(tickets)
16    .set({ status: 'in_progress' })
17    .where(and(eq(tickets.id, parseInt(req.params.id)), eq(tickets.status, 'open')));
18
19  res.json(msg);
20});
21
22// Deployment notes:
23// 1. Add to Replit Secrets (lock icon 🔒):
24//    JWT_SECRET=<64-byte-hex-string>
25// 2. After deploying, add SAME keys to Deployment Secrets
26// 3. Deploy on Autoscale — customer portals have unpredictable traffic
27//    and cold starts are masked by the portal login page
28//
29// Pre-load customers:
30// Either create a POST /api/admin/customers route that bcrypt-hashes the password
31// and creates the row, or manually insert test customers via Drizzle Studio
32// using: INSERT INTO customers (email, name, company, password_hash) VALUES
33// ('customer@example.com', 'Jane Doe', 'ACME Corp', '<bcrypt_hash>');