fix: shop catalog always reflects latest data after admin changes

- Add force-dynamic to /api/catalog so Next.js never serves a
  stale cached route response to the shop
- Add invalidateCatalogCache() to catalog-cache lib to drop the
  30s in-process memory cache on demand
- Call invalidateCatalogCache() after every admin PATCH/DELETE on
  an item so override saves are reflected on the very next shop
  request (no 30s delay)

Refresh from Square already updated the shared disk + memory cache;
force-dynamic ensures the shop route handler actually runs each time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -1,49 +1,16 @@
-# ─── Square API ────────────────────────────────────────────────────────────────
-# Get these from https://developer.squareup.com/apps
-SQUARE_ACCESS_TOKEN=your_square_access_token_here
-SQUARE_LOCATION_ID=your_square_location_id_here
-# "sandbox" or "production"
-SQUARE_ENVIRONMENT=sandbox
-
-# These are exposed to the browser — use your Square Application ID (not access token)
-# and the same location ID as above.
-NEXT_PUBLIC_SQUARE_APP_ID=sandbox-sq0idb-your_app_id_here
-NEXT_PUBLIC_SQUARE_LOCATION_ID=your_square_location_id_here
-# "sandbox" or "production" — controls which Square JS SDK URL is loaded
-NEXT_PUBLIC_SQUARE_ENVIRONMENT=sandbox
-# Optional: ID of a Square category (Items > Categories) whose items appear in the shop.
-# If set, only items in this category are shown. Otherwise falls back to src/config/shop-items.json.
-SQUARE_SHOP_CATEGORY_ID=
-
-# ─── CalDAV (Nextcloud) ────────────────────────────────────────────────────────
-# Your Nextcloud CalDAV base URL — include trailing slash
-CALDAV_URL=https://your-nextcloud.example.com/remote.php/dav/calendars/username/
-CALDAV_USERNAME=your_nextcloud_username
-# Use an app password (Settings > Security > Devices & sessions > App passwords)
-CALDAV_PASSWORD=your_nextcloud_app_password
-# Display name of the calendar to check for Busy blocks
-CALDAV_CALENDAR_NAME=Deliveries
-
-# ─── Email (SMTP — your mail server) ──────────────────────────────────────────
-SMTP_HOST=mail.beachpartyballoons.com
-SMTP_PORT=587
-SMTP_USER=shop@beachpartyballoons.com
-SMTP_PASS=your_email_password_here
-# Address that receives new-order & slot-conflict alerts (you/staff)
-ALERT_EMAIL_TO=you@beachpartyballoons.com
-# Sender shown on outgoing emails
-ALERT_EMAIL_FROM=shop@beachpartyballoons.com
-
-# ─── Admin panel ───────────────────────────────────────────────────────────────
-# Password to access /admin — keep this secret
-ADMIN_PASSWORD=change_me_to_something_strong
-# Secret token for the cron cache-refresh endpoint (POST /api/cache/refresh)
-CACHE_REFRESH_SECRET=change_me_to_something_random
-
-# ─── OSRM (self-hosted routing) ────────────────────────────────────────────────
-# Leave blank to use the public demo server (unreliable). Self-host for production:
-# https://hub.docker.com/r/osrm/osrm-backend
-OSRM_URL=http://localhost:5000
-
-# ─── Site ──────────────────────────────────────────────────────────────────────
-NEXT_PUBLIC_SITE_URL=http://localhost:3000
+# ── Root .env (fallback for Docker Compose < v2.24) ───────────────────────────
+#
+# Docker Compose v2.24+ reads build env_file directly from estore/.env — you
+# should not need this file at all on a modern install.
+#
+# If your Compose is older and the shop shows "Online payment is not
+# configured", copy the four NEXT_PUBLIC_* lines from estore/.env into this
+# file so Compose can bake them into the Next.js build:
+#
+# NEXT_PUBLIC_SQUARE_APP_ID=
+# NEXT_PUBLIC_SQUARE_LOCATION_ID=
+# NEXT_PUBLIC_SQUARE_ENVIRONMENT=production
+# NEXT_PUBLIC_SITE_URL=https://shop.beachpartyballoons.com
+#
+# All other secrets (access tokens, passwords, etc.) belong only in estore/.env
+# — never put them here.

.gitignore

@@ -1,18 +1,28 @@
-# dependencies
+# Dependencies
 node_modules/
+.pnp
+.pnp.js
 
-# Next.js build output
-.next/
-out/
+# Next.js
+estore/.next/
+estore/out/
 
-# Runtime data — cache and item overrides change at runtime, don't track them
-data/catalog-cache.json
-data/item-overrides.json
+# Runtime data
+estore/data/catalog-cache.json
+estore/data/item-overrides.json
+estore/data/hours.json
+estore/data/delivery-rates.json
+main-site/photo-gallery-app/backend/uploads/
+mongodb_data/
+osrm/data/*
+!osrm/data/.gitkeep
 
-# Environment variables — never commit these
+# Environment variables — never commit
 .env
 .env.local
 .env*.local
+*/.env
+*/.env.local
 
 # OS / editor
 .DS_Store
@@ -26,7 +36,4 @@ npm-debug.log*
 
 # Misc
 .eslintcache
-
-# Raw/duplicate image files — use public/images/ directly
-public/images/pics/
 *.heic

docker-compose.yml

@@ -1,26 +1,116 @@
 services:
-  osrm:
-    image: osrm/osrm-backend
-    container_name: osrm
-    restart: unless-stopped
+
+  # ── Nginx reverse proxy ───────────────────────────────────────────────────────
+  nginx:
+    image: nginx:alpine
+    container_name: bpb-nginx
+    ports:
+      - "80:80"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - main-site
+      - estore
+    restart: always
+
+  # ── Main website ─────────────────────────────────────────────────────────────
+  main-site:
+    build: ./main-site
+    container_name: bpb-main
+    expose:
+      - "3050"
+    environment:
+      NODE_ENV: production
+      ADMIN_PASSWORD: ${MAIN_ADMIN_PASSWORD}
+    volumes:
+      - ./main-site/update.json:/usr/src/app/update.json
+    restart: always
+    depends_on:
+      - gallery-backend
+
+  # ── Photo gallery backend ─────────────────────────────────────────────────────
+  gallery-backend:
+    build: ./main-site/photo-gallery-app/backend
+    container_name: bpb-gallery
     ports:
       - "5002:5000"
+    environment:
+      MONGO_URI: mongodb://mongodb:27017/photogallery
+      WATERMARK_URL: http://watermarker:8000/watermark
     volumes:
-      - ./docker/osrm/data:/data
-    command: osrm-routed --algorithm mld /data/connecticut-latest.osrm
+      - ./main-site/photo-gallery-app/backend/uploads:/usr/src/app/uploads
+    depends_on:
+      - mongodb
+      - watermarker
+    restart: always
 
-  balloons-shop:
-    build: .
-    container_name: balloons-shop
+  # ── Watermarker ───────────────────────────────────────────────────────────────
+  watermarker:
+    build: ./main-site/photo-gallery-app/watermarker
+    container_name: bpb-watermarker
+    restart: always
+
+  # ── MongoDB ───────────────────────────────────────────────────────────────────
+  mongodb:
+    image: mongo:latest
+    container_name: bpb-mongodb
     ports:
-      - "3000:3000"
-    env_file:
-      - .env
+      - "27017:27017"
+    volumes:
+      - ./mongodb_data:/data/db
+    restart: always
+
+  # ── eStore (Next.js / Square) ─────────────────────────────────────────────────
+  # NEXT_PUBLIC_* vars are baked into the JS bundle at build time.
+  # They are resolved from the root .env file (same dir as this compose file).
+  estore:
+    build:
+      context: ./estore
+      args:
+        NEXT_PUBLIC_SQUARE_APP_ID: ${NEXT_PUBLIC_SQUARE_APP_ID}
+        NEXT_PUBLIC_SQUARE_LOCATION_ID: ${NEXT_PUBLIC_SQUARE_LOCATION_ID}
+        NEXT_PUBLIC_SQUARE_ENVIRONMENT: ${NEXT_PUBLIC_SQUARE_ENVIRONMENT}
+        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
+    container_name: bpb-estore
+    expose:
+      - "3000"
+    env_file: ./estore/.env
+    volumes:
+      - ./estore/data:/app/data
     restart: unless-stopped
     depends_on:
       - osrm
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/catalog"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:3000/shop/api/catalog').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
+
+  # ── OSRM download (runs once, exits) ─────────────────────────────────────────
+  # Downloads the PBF map file into the shared volume if not already present.
+  osrm-download:
+    build:
+      context: ./osrm
+      dockerfile: Dockerfile.download
+    container_name: bpb-osrm-download
+    volumes:
+      - ./osrm/data:/data
+    environment:
+      OSRM_REGION: connecticut-latest
+    restart: "no"
+
+  # ── OSRM (routing engine) ─────────────────────────────────────────────────────
+  osrm:
+    build: ./osrm
+    container_name: bpb-osrm
+    expose:
+      - "5000"
+    volumes:
+      - ./osrm/data:/data
+    environment:
+      OSRM_REGION: connecticut-latest
+      OSRM_PROFILE: /opt/car.lua
+    depends_on:
+      osrm-download:
+        condition: service_completed_successfully
+    restart: unless-stopped

estore/.env.example

@@ -0,0 +1,49 @@
+# ─── Square API ────────────────────────────────────────────────────────────────
+# Get these from https://developer.squareup.com/apps
+SQUARE_ACCESS_TOKEN=your_square_access_token_here
+SQUARE_LOCATION_ID=your_square_location_id_here
+# "sandbox" or "production"
+SQUARE_ENVIRONMENT=sandbox
+
+# These are exposed to the browser — use your Square Application ID (not access token)
+# and the same location ID as above.
+NEXT_PUBLIC_SQUARE_APP_ID=sandbox-sq0idb-your_app_id_here
+NEXT_PUBLIC_SQUARE_LOCATION_ID=your_square_location_id_here
+# "sandbox" or "production" — controls which Square JS SDK URL is loaded
+NEXT_PUBLIC_SQUARE_ENVIRONMENT=sandbox
+# Optional: ID of a Square category (Items > Categories) whose items appear in the shop.
+# If set, only items in this category are shown. Otherwise falls back to src/config/shop-items.json.
+SQUARE_SHOP_CATEGORY_ID=
+
+# ─── CalDAV (Nextcloud) ────────────────────────────────────────────────────────
+# Your Nextcloud CalDAV base URL — include trailing slash
+CALDAV_URL=https://your-nextcloud.example.com/remote.php/dav/calendars/username/
+CALDAV_USERNAME=your_nextcloud_username
+# Use an app password (Settings > Security > Devices & sessions > App passwords)
+CALDAV_PASSWORD=your_nextcloud_app_password
+# Display name of the calendar to check for Busy blocks
+CALDAV_CALENDAR_NAME=Deliveries
+
+# ─── Email (SMTP — your mail server) ──────────────────────────────────────────
+SMTP_HOST=mail.beachpartyballoons.com
+SMTP_PORT=587
+SMTP_USER=shop@beachpartyballoons.com
+SMTP_PASS=your_email_password_here
+# Address that receives new-order & slot-conflict alerts (you/staff)
+ALERT_EMAIL_TO=you@beachpartyballoons.com
+# Sender shown on outgoing emails
+ALERT_EMAIL_FROM=shop@beachpartyballoons.com
+
+# ─── Admin panel ───────────────────────────────────────────────────────────────
+# Password to access /admin — keep this secret
+ADMIN_PASSWORD=change_me_to_something_strong
+# Secret token for the cron cache-refresh endpoint (POST /api/cache/refresh)
+CACHE_REFRESH_SECRET=change_me_to_something_random
+
+# ─── OSRM (self-hosted routing) ────────────────────────────────────────────────
+# Leave blank to use the public demo server (unreliable). Self-host for production:
+# https://hub.docker.com/r/osrm/osrm-backend
+OSRM_URL=http://localhost:5000
+
+# ─── Site ──────────────────────────────────────────────────────────────────────
+NEXT_PUBLIC_SITE_URL=http://localhost:3000

estore/.gitignore

@@ -0,0 +1,32 @@
+# dependencies
+node_modules/
+
+# Next.js build output
+.next/
+out/
+
+# Runtime data — cache and item overrides change at runtime, don't track them
+data/catalog-cache.json
+data/item-overrides.json
+
+# Environment variables — never commit these
+.env
+.env.local
+.env*.local
+
+# OS / editor
+.DS_Store
+Thumbs.db
+.vscode/
+.idea/
+
+# Logs
+*.log
+npm-debug.log*
+
+# Misc
+.eslintcache
+
+# Raw/duplicate image files — use public/images/ directly
+public/images/pics/
+*.heic

estore/Dockerfile

@@ -10,6 +10,18 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 ENV NEXT_TELEMETRY_DISABLED=1
+
+# NEXT_PUBLIC_* vars are baked into the JS bundle at build time.
+# Pass them as build args from your .env so they're available here.
+ARG NEXT_PUBLIC_SQUARE_APP_ID
+ARG NEXT_PUBLIC_SQUARE_LOCATION_ID
+ARG NEXT_PUBLIC_SQUARE_ENVIRONMENT
+ARG NEXT_PUBLIC_SITE_URL
+ENV NEXT_PUBLIC_SQUARE_APP_ID=$NEXT_PUBLIC_SQUARE_APP_ID
+ENV NEXT_PUBLIC_SQUARE_LOCATION_ID=$NEXT_PUBLIC_SQUARE_LOCATION_ID
+ENV NEXT_PUBLIC_SQUARE_ENVIRONMENT=$NEXT_PUBLIC_SQUARE_ENVIRONMENT
+ENV NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
+
 RUN npm run build
 
 # ── Stage 3: Production runner ────────────────────────────────────────────────
@@ -26,6 +38,11 @@ COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static     ./.next/static
 
+# Ensure the data directory exists and is writable by the nextjs user.
+# For bind-mount deployments, the host directory must also be owned by uid 1001:
+#   sudo chown -R 1001:1001 estore/data
+RUN mkdir -p /app/data && chown nextjs:nodejs /app/data
+
 USER nextjs
 EXPOSE 3000
 ENV PORT=3000

estore/data/categories-display.json

@@ -0,0 +1,11 @@
+{
+  "order": [
+    "latex",
+    "birthday",
+    "mylar-bouquets",
+    "graduation",
+    "letters-and-numbers",
+    "other"
+  ],
+  "hidden": []
+}

estore/data/occasions.json

@@ -0,0 +1,8 @@
+{
+  "mothers-day": {
+    "windowStart": "04-10"
+  },
+  "graduation": {
+    "windowStart": "04-01"
+  }
+}

estore/docker-compose.yml

@@ -0,0 +1,26 @@
+services:
+  osrm:
+    image: osrm/osrm-backend
+    container_name: osrm
+    restart: unless-stopped
+    ports:
+      - "5002:5000"
+    volumes:
+      - ./docker/osrm/data:/data
+    command: osrm-routed --algorithm mld /data/connecticut-latest.osrm
+
+  balloons-shop:
+    build: .
+    container_name: balloons-shop
+    ports:
+      - "3000:3000"
+    env_file:
+      - .env
+    restart: unless-stopped
+    depends_on:
+      - osrm
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/catalog"]
+      interval: 30s
+      timeout: 10s
+      retries: 3

estore/next.config.mjs

@@ -3,6 +3,10 @@ const isDev = process.env.NODE_ENV === 'development'
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: 'standalone',
+  basePath: '/shop',
+  env: {
+    NEXT_PUBLIC_BASE_PATH: '/shop',
+  },
   images: {
     remotePatterns: [
       { protocol: 'https', hostname: 'items-images-production.s3.us-west-2.amazonaws.com' },