# Store Product Demo

A full-stack product storefront with account-tied, per-product, 48-hour storefront and admin panel demo environments.

## Stack

- Node.js and Express API
- Prisma ORM with SQLite for local development
- React, Vite, Tailwind CSS
- JWT auth through bearer tokens and http-only cookies
- One-time forgot-password links with hashed reset tokens
- Masked demo iframe stream endpoints

## Quick Start

```bash
npm.cmd install
Copy-Item .env.example .env
npm.cmd run prepare:db
npm.cmd run dev
```

Open `http://localhost:5173`.

Forgot-password links are logged by the API in development and are also returned in the reset request response outside production. Configure `PASSWORD_RESET_URL_ORIGIN` when the client is not served from `CLIENT_ORIGIN`.

Seeded users:

- Buyer: `buyer@scriptmarket.dev` / `BuyerPass123!`
- Admin: `hahnm@signalhg.com` / `Newteam7944@`

Seeded product admin demo:

- Email: `store.admin@example.com`
- Password: `StoreAdmin#48`
- Username: `store-demo-admin`

## Key Demo Rules

- A demo session is unique to a `userId` and `productId`.
- Activating Product A does not start Product B's trial.
- Expired sessions are denied by both the activation endpoint and stream middleware.
- Product listing and detail responses never include `demoConfig`.
- Iframes load only `/api/demo/stream/:sessionId/:type`, never the secret target URL.
- Open a product, activate its demo, then choose **View Admin Panel** to see the product admin preview and credentials.