Dashforge Checkout Kit

A self-hosted, source-available Stripe store you own catalog, cart, SCA-ready checkout, orders, and field-level RBAC.

Comment

Inspiration

Every checkout tutorial stops at "redirect to Stripe." The part that actually hurts in production is always left as an exercise: the webhook that confirms the order, SCA, refunds, and an admin panel that isn't a security hole. I wanted a checkout you can ship and own, not one you rent.

What it does

Dashforge Checkout Kit is a complete, self-hosted e-commerce app you own as source code. It has a product catalog with an admin that creates, edits and deletes products (drag-and-drop image upload to S3), a shopping cart, an SCA-ready Stripe Elements checkout, and per-customer order history. Authorization is enforced by field-level RBAC across three roles (customer, sales and admin) on the backend, not just hidden in the UI.

How I built it

Two interchangeable backends, Go + Gin and Node + Express, behind one Zod-typed API contract, plus two frontends: React + MUI and React + Tailwind. MongoDB for data, S3 for product images, Stripe Elements for payments, and 314 tests across the stack. The demo runs the real backend against a Stripe sandbox. It's the same code that ships, nothing faked.

Challenges I ran into

Idempotent webhooks: the webhook, not the redirect, confirms the order, so a duplicate delivery must never double-charge or double-fulfill. Real RBAC: the UI hiding a button means nothing if the server still accepts the request, so every mutation is checked server-side, and "sales" sees the same screens as admin with each input locked. Keeping one contract honest across two backends and two frontends, so a stack combo you didn't hand-test still behaves.

Accomplishments that I'm proud of

RBAC that's enforced on the server, not cosmetic: delete every UI check and the app is still secure. A checkout that survives duplicate webhooks. Any-combo stacks (Go or Node, MUI or Tailwind) generated from a single typed contract, all green under 314 tests.

What I learned

The "last 10%" (webhooks, SCA, refunds, backend-enforced authorization) is 90% of the risk. A hidden button is not access control. And a demo that runs the real backend against a Stripe sandbox is worth more than any polished screenshot.

What's next for Dashforge Checkout Kit

You buy once and receive the complete source by email or a download link. From there the roadmap is yours: the code is unlocked, so you extend it, rebrand it and deploy it however your project needs, with no lock-in and nothing to renew. Alongside it, Dashforge keeps shipping other self-hosted domain kits built the same way, like booking and registration.

Share this project:

Updates