Full-Stack App · Beauty retail · 2026
SHEGLAM PK
An online shop for an independent SHEGLAM stockist in Pakistan — pre-rendered product pages, a server-priced cash-on-delivery checkout and a Postgres-backed admin portal.
- Role
- Full-stack development
- Built with
- HTML · CSS · JavaScript · Node.js · PostgreSQL (Neon) · Vercel Functions
Screens
4 screenshots · 1920 × 1080
Overview
SHEGLAM PK is an online shop for an independent stockist selling SHEGLAM makeup in Pakistan, with cash on delivery as the only payment method. It is not affiliated with SHEGLAM, and the footer of every storefront page says so. I built the storefront and the admin portal behind it: the shop’s pages are generated from a Postgres catalogue, orders are written to the database, and the shop’s admins manage products, stock and orders from a signed-in portal.
Objective
Let the shop’s admins change products, prices, stock and the homepage themselves, without editing code, while customers are still served pre-rendered pages.
The solution
A Node build script pre-renders the storefront from the Postgres catalogue, Vercel serverless functions handle checkout and the admin API, and a save in the portal requests a rebuild of the live shop through a Vercel Deploy Hook, folding a burst of saves into one build.
What I built
Database-driven catalogue
Products and shades live in Postgres, along with photos uploaded through the portal; a Node build script turns them into category, collection and product pages with Product and breadcrumb structured data, plus a sitemap.
Server-priced checkout
The browser sends only what was ordered; prices, totals and stock are re-read from the database, cash on delivery is enforced on the server, and an idempotency key stops a retry from creating a second order.
Admin portal with roles
Behind sign-in: orders, products, inventory, customers, analytics, the homepage hero, admin accounts and an audit log, with Super Admin and Admin permissions checked on the server for every request.
Image uploads & CSV import
Uploaded images are type-checked from their bytes, stored in Postgres and served with a sandboxing security policy; a CSV import previews every row as create, update or error before anything is written.
Order emails with retry
Each order queues an email to the shop — and a confirmation to the customer when they give an email address — through a configurable mail provider; a failed email never fails the order, and a job scheduled every 15 minutes retries it.
Shop analytics
TikTok Pixel with standard shop events — product views, add to cart, checkout and orders. The shop’s own event calls pass products and order value only, not the customer’s name, phone, email or address.
How it’s built
- Admin sign-in with scrypt password hashing, session tokens stored only as SHA-256 hashes, CSRF tokens on every state-changing admin request, and throttling after 5 failed attempts per username or 20 per IP within 15 minutes.
- 19 Postgres tables across five SQL migrations, queried through the Neon serverless driver with bound parameters.
- The deploy step copies only allow-listed files into the output and fails the build if a credential or local data file reaches it.
- Six Node test suites covering authentication, permissions, uploads, CSV import, orders and the catalogue.