Selvik

Selvik is a full fashion storefront built to mirror a real commercial app end to end: a catalogue with colour and size variants and live stock, a cart, Stripe Checkout, customer accounts with order history, and a role-gated admin back-office for orders, inventory, products and coupons. On top of that it ships verified-purchase reviews, discount codes, AI-written review summaries, a unit and end-to-end test suite, CI, and a Dockerised Postgres deployment. It runs on Next.js 16 and TypeScript with Prisma, and is live on Vercel.

I wanted one project that shows the full surface of a real e-commerce build rather than a toy shop: money handling, authentication and authorization, an admin surface, and the testing and deployment discipline around it. The parts that matter are the ones easy to fake: prices that can't be tampered with from the client, an admin that visitors genuinely can't reach, and a checkout that stays consistent even if the customer never lands back on the success page.

The storefront is Next.js 16 with server actions, Tailwind 4 and Prisma, with SQLite in development and Postgres in production. Auth is Auth.js with credentials, JWT sessions and bcrypt, with an ADMIN role gating the back-office. Checkout reprices the bag server-side from the database and hands off to Stripe Checkout, and coupons are validated server-side. A cached, Anthropic-powered review summary is the one AI feature, and the whole thing is covered by Vitest unit tests and Playwright end-to-end tests, wired into GitHub Actions CI and containerised with a multi-stage Dockerfile and a docker-compose Postgres stack.

The rule throughout was to keep anything that touches money or trust on the server. Prices, shipping and coupon discounts are recomputed at checkout from the database, so the client's bag is never trusted, and every admin action re-checks the role rather than relying on the page guard alone, so a direct request can't slip through. The AI summary is cached in the database and only regenerated when the review count changes, so the model is called at most once per new review instead of on every page view.

As much as the features, this was about the discipline around them: unit-testing the money path, driving the real flows with Playwright, and getting a Prisma and Postgres app onto Vercel with a self-seeding build. It reinforced a security-first instinct for commerce: assume the client is hostile, keep pricing and authorization server-authoritative, and lock the admin behind a secret so a public demo stays safe. Adding one well-scoped, cached LLM feature also showed how to bring AI into a product without it becoming a cost or latency liability.