Built by 
About this software
About Ember & Oak: Coffee Store with Customer Accounts and Admin Panel
Ember & Oak is a complete online store for a specialty coffee roaster, built with React 19 + Vite on the front end, a dependency-free Node.js 22 API and a SQLite database. Customers can browse the catalogue, fill a bag, check out as guests or registered users, and view their order history. An admin signs in to manage products, stock and orders and to see a sales overview. Prices, totals, stock and roles are decided on the server, and the repo ships with 16 automated API tests, Docker files and setup docs. There is no payment gateway: the card form is validated in the browser and discarded, so a payment provider must be added before taking real payments.
Why Ember & Oak: Coffee Store with Customer Accounts and Admin Panel
What makes it better
than the alternatives
- 01
No npm dependencies on the server
The API uses only built-in node:http, node:sqlite and node:crypto, so there is little third-party code to maintain on the back end.
- 02
Server-side pricing and stock
Checkout sends only product ids and quantities, and the server prices the order from database values and decrements stock atomically in a transaction.
- 03
Guarded order access
Order confirmation links use a random access token, and signed-in customers see only their own orders while admins see all.
- 04
Security basics built in
Scrypt password hashing, hashed session tokens in HttpOnly SameSite cookies, login rate limiting, an Origin (CSRF) check and security headers.
- 05
Ready to deploy and rebrand
Dockerfile, docker-compose, render.yaml and vercel.json are included, plus docs for API, database, ERD and customisation, and a CLAUDE.md for AI coding tools.
Storefront
- Home page with hero
- featured roasts
- brewing gear and starter-kit banner
- Shop with category
- taste
- origin and roast filters
- search
- sorting and in-stock toggle
- Product pages with size
- grind and colour options
- tasting notes and related products
- Wishlist kept in the browser's localStorage
- Delivery and contact info pages
Cart and Checkout
- Slide-in bag with free-shipping progress bar
- Checkout form with validation
- shipping methods and tax
- Payment choice of card (demo form
- not sent to server) or cash on delivery
- Guest checkout
- switchable off with ALLOW_GUEST_CHECKOUT
- Order confirmation page reachable by token link
Customer Accounts
- Register
- sign in and sign out
- My account page with order history
- Customers can only view their own orders
Admin
- Products and Stock: Add
- edit and delete products
- Manage stock levels and product details
- Product image or built-in SVG illustration fallback
Admin
- Orders: Filter orders by status and open details
- Change status: Processing
- Roasting
- Shipped
- Delivered
- Cancelled
- Cancelling returns stock; reopening takes it again if available
Admin
- Overview: Revenue
- order count and average order value
- 14-day chart
- best sellers and low-stock alerts
- Demo-mode Restore demo data button
Security and Access
- Two roles: customer and admin
- Role checks on every write endpoint
- Rate limits on login
- registration and orders
Data and Deployment
- SQLite schema with tables for users
- sessions
- categories
- products
- orders and order items
- Seed data for demo mode
- or admin created from environment variables
- Docker
- Render and Vercel (demo) configuration
- 16 automated API tests via node --test
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| JavaScript (React) | — | — | Front-end | 57.8% |
| JavaScript | — | — | Front-end | 22.1% |
| CSS | — | — | Styling | 12.3% |
| SQL | — | — | Database | 4% |
| HTML | — | — | Front-end | 3.7% |
- Primary language
- JavaScript (ES modules) on Node.js 22.13+
- Framework
- React 19.2 + Vite 7 (plain node:http API, no framework)
- Database
- SQLite via built-in node:sqlite (Node 22.13+)
- Authentication
- Email and password (scrypt hashes), random session tokens stored hashed, HttpOnly SameSite=Lax cookie, role check (customer/admin)
- Licence
- Single-site
- Screens
- 14
- Database tables
- 6
- Supported languages
- English only; no translation layer in the code. No RTL support.
- Browser support
- Modern evergreen browsers (Vite default build targets); no explicit browser list in the code
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 1 GB (estimate, not benchmarked) | 2 GB (estimate, not benchmarked) |
| OS | Linux with Node.js 22.13+ (Docker image uses node:22.14.0-alpine3.21) | Linux with Node.js 22.13+ (Docker image uses node:22.14.0-alpine3.21) |
| Est. monthly hosting | $6 | $6 |
From the repository root: ```bash docker compose up -d --build ``` Open http://localhost:3000. Set DEMO_MODE to false and fill ADMIN_EMAIL and ADMIN_PASSWORD in docker-compose.yml for a real store.
```bash cd "React Web" && npm ci && npm run build && cd .. cd "Node API" && npm start ``` The app listens on http://localhost:3000. Put it behind an HTTPS reverse proxy, set COOKIE_SECURE=true and TRUST_PROXY=true, and keep DATABASE_PATH on persistent disk. Full steps are in HowToSetup.md.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (2 minor)
No real credentials found; demo accounts are exposed publicly via /api/config and an unsigned-session fallback exists; queries are parameterized and scoped; schema and n+1 patterns could not be fully verified. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
