Blurp Engine

Rust backend for SoraStore Commerce e-commerce platform.

Architecture

Cargo workspace with 11 domain crates:

• blurp-core — Shared types, config, error handling, response envelope
• blurp-auth — JWT + Redis revocation, magic link, password, OAuth
• blurp-catalog — Products, variants, categories, stock management
• blurp-media — R2/S3 upload, product/variant media
• blurp-cart — Shopping cart, wishlist
• blurp-order — Checkout, orders, guest tracking
• blurp-payment — Xendit integration (invoices, webhooks)
• blurp-shipping — RajaOngkir API, cost calculation, locations
• blurp-admin — Admin endpoints (settings, order management)
• blurp-worker — Background jobs (Redis ZSET delayed queue)
• blurp-server — HTTP server, route composition

Tech Stack

• Framework: Axum 0.8
• Database: PostgreSQL 16 (per-crate schemas)
• Cache: Redis 7
• Storage: Cloudflare R2 (S3-compatible)
• Payment: Xendit (sandbox/production)
• Shipping: RajaOngkir API

Quick Start

# Start Postgres + Redis
docker-compose up -d

# Run migrations
make migrate

# Start server
cargo run -p blurp-server

Server runs on http://localhost:8080

API Endpoints

All responses use standard envelope: { "data": ..., "error": null/obj, "meta": null/obj }

Auth

• POST /api/auth/register — Register with email/password
• POST /api/auth/login — Login, returns JWT
• POST /api/auth/logout — Revoke token
• POST /api/auth/refresh — Refresh access token
• POST /api/auth/magic-link — Request magic link email

Catalog

• GET /api/catalog/categories — List categories
• POST /api/catalog/categories — Create category (admin)
• GET /api/catalog/products — List products
• GET /api/catalog/products/{id} — Product detail with variants & media
• POST /api/catalog/products — Create product (admin)
• POST /api/catalog/products/{id}/variants — Create variant
• POST /api/catalog/products/{id}/media — Upload product media
• POST /api/catalog/products/{id}/variants/{vid}/media — Upload variant media

Cart

• GET /api/cart — Get cart
• POST /api/cart/items — Add to cart
• PUT /api/cart/items/{id} — Update quantity
• DELETE /api/cart/items/{id} — Remove item
• DELETE /api/cart — Clear cart

Orders

• POST /api/orders/shipping-quote — Get shipping options
• POST /api/orders/checkout — Create order with courier selection
• GET /api/orders — List user orders
• GET /api/orders/{id} — Order detail
• POST /api/orders/guest/lookup — Guest order lookup by token

Shipping

• GET /api/shipping/provinces — List provinces
• GET /api/shipping/cities — List cities
• GET /api/shipping/districts — List districts
• POST /api/shipping/cost — Calculate shipping cost

Payment

• POST /api/payment/create-invoice — Create Xendit invoice
• POST /api/payment/webhook — Handle payment callback
• GET /api/payment/orders/{id} — Get payment status

Admin (requires is_admin flag)

• GET /api/admin/settings/shipping — Shipping config
• GET /api/admin/settings/general — App settings
• GET /api/admin/orders — List all orders
• PUT /api/admin/orders/{id}/status — Update order status
• PUT /api/admin/orders/{id}/fulfillment — Update tracking

Stock Management

• Stock reserved at checkout (15-minute expiry)
• Reserved but not deducted until payment confirmed
• Automatic cleanup of expired reservations
• Insufficient stock error prevents overselling

Guest Order Tracking

Orders with email in shipping address generate signed JWT token:

• Token valid 30 days
• SHA256 hash stored in DB for verification
• Lookup via POST /api/orders/guest/lookup

Testing

# Unit tests
cargo test

# E2E tests (server must be running)
./target/debug/blurp-server &
cargo test -p blurp-server -- --test-threads=1

E2E test files:

• e2e_catalog_test.rs — Catalog listing
• e2e_cart_checkout_test.rs — Full checkout flow
• e2e_stock_test.rs — Stock reservation
• e2e_guest_tracking_test.rs — Guest token verification

Configuration

Environment variables (or .env.local):

DATABASE_URL=postgres://blurp:blurp@localhost:5433/blurp
REDIS_URL=redis://localhost:6380

BLURP__AUTH__JWT_SECRET=your-secret
BLURP__SHIPPING__RAJAONGKIR_API_KEY=your-key
BLURP__SHIPPING__ORIGIN_DISTRICT_ID=22
BLURP__PAYMENT__XENDIT_API_KEY=your-sandbox-key
BLURP__STORAGE__R2_BUCKET=blurp
BLURP__STORAGE__R2_ACCOUNT_ID=your-account
BLURP__STORAGE__R2_ACCESS_KEY_ID=your-key
BLURP__STORAGE__R2_SECRET_ACCESS_KEY=your-secret

License

Proprietary — SoraStore Commerce