How to Build a Shopping Cart with Replit

1// Type this into Replit Agent:
2// Build a shopping cart system with Express and PostgreSQL using Drizzle ORM.
3// Install express-session for cookie-based session management.
4// Tables:
5// - products: id serial pk, name text not null, description text,
6//   price integer not null (in cents), compare_at_price integer (original price for sale display),
7//   image_url text, category text, stock_quantity integer not null default 0,
8//   is_active boolean default true, created_at timestamp default now()
9// - product_categories: id serial, name text not null unique,
10//   slug text not null unique, description text, position integer default 0
11// - carts: id serial pk, session_id text unique (guest carts),
12//   user_id text (authenticated user carts), created_at timestamp default now(),
13//   updated_at timestamp default now()
14// - cart_items: id serial, cart_id integer FK carts not null,
15//   product_id integer FK products not null, quantity integer not null default 1,
16//   unit_price integer not null (snapshot price at time of adding),
17//   created_at timestamp default now()
18//   UNIQUE constraint on (cart_id, product_id)
19// Routes:
20// GET /api/products — list with optional category, search, min_price, max_price query params
21// GET /api/products/:id — detail
22// POST /api/cart/add — add item, create cart if needed, snapshot unit_price
23// GET /api/cart — list items with product details joined
24// PATCH /api/cart/items/:id — update quantity (validate against stock_quantity)
25// DELETE /api/cart/items/:id — remove item
26// POST /api/cart/merge — merge guest cart into authenticated user cart on login
27// GET /api/cart/count — total item count for header badge
28// Use Replit Auth. Set session_id cookie as HTTP-only UUID on first visit. Bind to 0.0.0.0.

1const { v4: uuidv4 } = require('uuid');
2const { carts } = require('../../shared/schema');
3const { eq, or } = require('drizzle-orm');
4
5// Middleware: ensure every request has a session_id cookie
6async function ensureSession(req, res, next) {
7  if (!req.cookies.session_id) {
8    const sessionId = uuidv4();
9    res.cookie('session_id', sessionId, {
10      httpOnly: true,
11      secure: true,       // Replit deployments are always HTTPS
12      maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
13      sameSite: 'lax',
14    });
15    req.sessionId = sessionId;
16  } else {
17    req.sessionId = req.cookies.session_id;
18  }
19  next();
20}
21
22// Helper: get or create a cart for the current visitor
23async function getOrCreateCart(sessionId, userId) {
24  // Prefer authenticated user cart if logged in
25  if (userId) {
26    const [existing] = await db.select().from(carts).where(eq(carts.userId, userId));
27    if (existing) return existing;
28    const [created] = await db.insert(carts).values({ userId }).returning();
29    return created;
30  }
31
32  // Guest cart by session_id
33  const [existing] = await db.select().from(carts).where(eq(carts.sessionId, sessionId));
34  if (existing) return existing;
35  const [created] = await db.insert(carts).values({ sessionId }).returning();
36  return created;
37}
38
39module.exports = { ensureSession, getOrCreateCart };

1const { products, cartItems, carts } = require('../../shared/schema');
2const { eq, and, sql } = require('drizzle-orm');
3const { getOrCreateCart } = require('../middleware/session');
4
5// POST /api/cart/add — add item to cart
6router.post('/cart/add', async (req, res) => {
7  const { productId, quantity = 1 } = req.body;
8  const userId = req.user?.id || null;
9  const sessionId = req.sessionId;
10
11  // Fetch product and validate stock
12  const [product] = await db.select().from(products)
13    .where(and(eq(products.id, parseInt(productId)), eq(products.isActive, true)));
14
15  if (!product) return res.status(404).json({ error: 'Product not found' });
16  if (product.stockQuantity < quantity) {
17    return res.status(400).json({ error: `Only ${product.stockQuantity} in stock` });
18  }
19
20  const cart = await getOrCreateCart(sessionId, userId);
21
22  // Check if item already in cart
23  const [existing] = await db.select().from(cartItems)
24    .where(and(eq(cartItems.cartId, cart.id), eq(cartItems.productId, product.id)));
25
26  if (existing) {
27    const newQty = existing.quantity + quantity;
28    if (newQty > product.stockQuantity) {
29      return res.status(400).json({ error: `Cannot add more than ${product.stockQuantity} total` });
30    }
31    const [updated] = await db.update(cartItems)
32      .set({ quantity: newQty })
33      .where(eq(cartItems.id, existing.id))
34      .returning();
35    return res.json(updated);
36  }
37
38  // Snapshot current price at time of adding
39  const [item] = await db.insert(cartItems).values({
40    cartId: cart.id,
41    productId: product.id,
42    quantity,
43    unitPrice: product.price,  // price snapshot
44  }).returning();
45
46  res.status(201).json(item);
47});
48
49// PATCH /api/cart/items/:id — update quantity
50router.patch('/cart/items/:id', async (req, res) => {
51  const { quantity } = req.body;
52  if (!quantity || quantity < 1) {
53    return res.status(400).json({ error: 'Quantity must be at least 1' });
54  }
55
56  const [item] = await db.select().from(cartItems)
57    .where(eq(cartItems.id, parseInt(req.params.id)));
58  if (!item) return res.status(404).json({ error: 'Cart item not found' });
59
60  const [product] = await db.select().from(products).where(eq(products.id, item.productId));
61  if (quantity > product.stockQuantity) {
62    return res.status(400).json({ error: `Only ${product.stockQuantity} in stock` });
63  }
64
65  const [updated] = await db.update(cartItems)
66    .set({ quantity })
67    .where(eq(cartItems.id, item.id))
68    .returning();
69
70  res.json(updated);
71});

1const { carts, cartItems, products } = require('../../shared/schema');
2const { eq, and } = require('drizzle-orm');
3
4// POST /api/cart/merge — called immediately after Replit Auth login
5router.post('/cart/merge', async (req, res) => {
6  const userId = req.user?.id;
7  if (!userId) return res.status(401).json({ error: 'Login required' });
8
9  const sessionId = req.sessionId;
10
11  // Find the guest cart
12  const [guestCart] = await db.select().from(carts).where(eq(carts.sessionId, sessionId));
13  if (!guestCart) return res.json({ merged: 0, message: 'No guest cart to merge' });
14
15  // Get or create the authenticated user's cart
16  let [userCart] = await db.select().from(carts).where(eq(carts.userId, userId));
17  if (!userCart) {
18    [userCart] = await db.insert(carts).values({ userId }).returning();
19  }
20
21  // Get all items from both carts
22  const guestItems = await db.select().from(cartItems).where(eq(cartItems.cartId, guestCart.id));
23  const userItems = await db.select().from(cartItems).where(eq(cartItems.cartId, userCart.id));
24
25  let mergedCount = 0;
26
27  for (const guestItem of guestItems) {
28    const [product] = await db.select().from(products).where(eq(products.id, guestItem.productId));
29    const existing = userItems.find(i => i.productId === guestItem.productId);
30
31    if (existing) {
32      // Sum quantities up to stock limit
33      const mergedQty = Math.min(existing.quantity + guestItem.quantity, product.stockQuantity);
34      await db.update(cartItems)
35        .set({ quantity: mergedQty })
36        .where(eq(cartItems.id, existing.id));
37    } else {
38      // Move item to user cart with stock-capped quantity
39      const cappedQty = Math.min(guestItem.quantity, product.stockQuantity);
40      await db.insert(cartItems).values({
41        cartId: userCart.id,
42        productId: guestItem.productId,
43        quantity: cappedQty,
44        unitPrice: guestItem.unitPrice,  // preserve original price snapshot
45      });
46    }
47    mergedCount++;
48  }
49
50  // Delete guest cart and all its items
51  await db.delete(cartItems).where(eq(cartItems.cartId, guestCart.id));
52  await db.delete(carts).where(eq(carts.id, guestCart.id));
53
54  res.json({ merged: mergedCount, cartId: userCart.id });
55});