Ecommerce API

Routes: backend-main/ecommerce/urls.py (+ public design paths from designcatalog/urls.py (backend-main/designcatalog/urls.py) public_urlpatterns). Auth: Authentication. Views: ecommerce/views.py (backend-main/ecommerce/views.py).

Public storefront

Most catalog endpoints: permission_classes = [AllowAny]. Disabled store returns an error from _check_ecommerce_enabled().

Method	Path	Notes
GET	/api/ecommerce/home/	Home payload
GET	/api/ecommerce/categories/	Categories
GET	/api/ecommerce/custom-categories/	Custom categories
GET	/api/ecommerce/custom-categories/<name>/products/	Products in custom category
GET	/api/ecommerce/products/	Product list
GET	/api/ecommerce/products/<product_ref>/	Detail
GET/POST	/api/ecommerce/products/<product_ref>/reviews/	GET public; POST needs customer JWT
GET	/api/ecommerce/addons/	Addons
POST	/api/ecommerce/upload-image/	Public image upload
GET	/api/ecommerce/pages/<slug>/	Static page
GET	/api/ecommerce/seo/	Public SEO
GET	/api/ecommerce/orders/track/	Track order (public)

Public design catalog (ecommerce-mounted)

Method	Path
GET	/api/ecommerce/design-collections/, …/<slug>/
GET	/api/ecommerce/designs/, …/<slug>/, …/<slug>/options/, …/<slug>/reviews/

Admin design CRUD lives under /api/design-catalog/ (separate JWT-managed router in designcatalog/urls.py).

Customer account

Tokens from ecommerce/auth.py (backend-main/ecommerce/auth.py) (auth_type=ecommerce_customer).

Method	Path	Auth
POST	/api/ecommerce/auth/register/	Public → access + refresh
POST	/api/ecommerce/auth/login/	Public → tokens
GET	/api/ecommerce/auth/me/	Customer JWT
POST	/api/ecommerce/auth/forgot-password/	Public
POST	/api/ecommerce/auth/reset-password/	Public
GET/POST	/api/ecommerce/addresses/	Customer JWT
…	/api/ecommerce/addresses/<id>/	Customer JWT
GET	/api/ecommerce/orders/	Customer JWT (account order list)

There is no dedicated /api/ecommerce/auth/refresh/ route in ecommerce/urls.py; refresh tokens are issued at login/register (staff uses /api/token/refresh/).

Checkout and Razorpay

Method	Path	Auth
POST	/api/ecommerce/checkout/	AllowAny
POST	/api/ecommerce/payments/razorpay/verify/	AllowAny
POST	/api/ecommerce/payments/razorpay/webhook/	AllowAny, authentication_classes = []

Checkout (EcommerceCheckoutView)

• Body validated by EcommerceCheckoutSerializer (items, shipping, email, payment method).
• Uses ecommerce settings POS (get_settings().pos).
• COD (paymentMethod default / COD): allocate stock → create_cod_order → 201 serialized order.
• Razorpay: start_razorpay_checkout → creates PendingRazorpayCheckout → 201 Razorpay payload (no final order yet). Failures: 502 on create error.

Implementation: ecommerce/checkout_orders.py (backend-main/ecommerce/checkout_orders.py), env secrets in settings (RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET, RAZORPAY_WEBHOOK_SECRET).

Verify (RazorpayPaymentVerifyView)

Body fields: razorpay_order_id, razorpay_payment_id, razorpay_signature.

1. verify_checkout_signature (ecommerce/payments.py (backend-main/ecommerce/payments.py)).
2. complete_razorpay_payment(…) → fulfills pending checkout / creates order.
3. Errors: 400 missing/invalid signature, 503 misconfigured, 404 order/pending not found.

Webhook (RazorpayWebhookView)

1. Header X-Razorpay-Signature vs raw body (verify_webhook_signature).
2. Parse event; only payment.captured and order.paid call complete_razorpay_payment.
3. Other events → { "status": "ignored" }; success → { "status": "ok" }.

Verify and webhook are idempotent completion paths for the same pending Razorpay checkout.

Admin manage (JWT + IsStockUser)

Method	Path
…	/api/ecommerce/manage/settings/
…	/api/ecommerce/manage/warehouses/, …/<pk>/
…	/api/ecommerce/manage/products/, …/bulk/
…	/api/ecommerce/manage/customers/, …/export/
…	/api/ecommerce/manage/banners/
…	/api/ecommerce/manage/seo/, …/seo/products/, …/seo/products/<product_id>/
…	/api/ecommerce/manage/pages/, …/pages/<slug>/