v2.4.0 · Current Distribution · Envato Submission

CodeCanyon
reviewer guide

This page is written for Envato marketplace reviewers. It explains what ships in the submission ZIP, how to install and evaluate Sellio quickly, and where to find dated QA evidence (PHPUnit, Playwright, dependency audits, and image provenance).

Item type: Laravel 12 multi-vertical marketplace (Blade storefront + React seller/buyer panels). License: proprietary / CodeCanyon commercial terms — see root LICENSE, not MIT/GPL.

~15 min smoke path

Web installer → admin login → one listing per vertical → partner/buyer panel login. Details in Manual smoke test.

Automated evidence

259 PHPUnit tests, 48 Playwright admin E2E specs — reproducible commands in Reproduce tests.

Security fixes

HTML sanitization, installer lock, API rate limits, dependency bumps — summarized in Security posture and QA review.

Package map

After extracting the CodeCanyon ZIP, the layout is a monorepo-style tree. Production deploys use apps/backend as the Laravel document root (point the web server at public/).

Path	Role
`apps/backend/`	Laravel 12 core — API, admin panel, Blade storefront, web installer (`public/install/`), migrations, seeders, PHPUnit + Playwright tests.
`apps/seller/dist/`	Pre-built React partner dashboard (static files; configure `public/config.js`).
`apps/buyer/dist/`	Pre-built React buyer dashboard (static files; configure `public/config.js`).
`Documentation/`	Buyer HTML docs (`index.html`) and this reviewer pack.
`CHANGELOG.md`	Version history for marketplace updates.
`LICENSE`	Envato / CodeCanyon commercial license notice.

Distribution builds include vendor/, public/build/, and public/vendor/ so shared hosting can skip Composer when those folders are present. Node.js is not required on the server for seller/buyer panels — only pre-built dist/ is deployed.

Excluded from the submission ZIP

Internal development artifacts are stripped by npm run prepare:distribution and are not part of the buyer item:

_development/ — audits, TODOs, theme reference storefront, planning notes
.cursor/ — editor/agent configuration
packages/ — shared TypeScript types for local monorepo dev only (not used at runtime)
node_modules/, .env, dev uploads under storage/app/public/ (except brand settings/ logo/favicon)

Curated QA summaries from internal passes are copied into Documentation/reviewer/ (this folder) before each submission.

Environment requirements

Component	Minimum	Notes
PHP	8.2+	Extensions: mbstring, openssl, pdo, tokenizer, xml, ctype, json, fileinfo, gd or imagick (media).
Database	MySQL 8.0+	PostgreSQL and SQLite supported; installer targets MySQL. PHPUnit uses SQLite in-memory.
Web server	Apache / Nginx	Document root must be `apps/backend/public`. `mod_rewrite` or equivalent required.
Composer	Optional on host	Pre-bundled `vendor/` in distribution ZIP for cPanel/FTP installs.
Node.js	20.x (dev/tests only)	Required only to run Playwright E2E locally — not for production panel hosting.

Installation & demo data

1

Upload & browse to installer

Extract the ZIP so public/index.php is web-accessible. Open https://your-domain.test/install. If no lock file exists, Laravel redirects root requests to the installer automatically.

2

Complete wizard steps

Requirements check → database credentials → APP_KEY generation → optional mail fields → run migrations → import demo seed (recommended for review) → create admin account.

3

Post-install lock

Successful install writes storage/installed.lock. Subsequent visits to /install are blocked at runtime. The finished step documents removing public/install/ on production servers.

Installer browser error output is gated: disabled when installed.lock exists; during active install, remote hosts default INSTALLER_DEBUG=false (local dev may show errors when INSTALLER_DEBUG=true).

cd apps/backend
cp .env.example .env
php artisan key:generate
# Set DB_* in .env, then:
php artisan migrate --seed --force
php artisan storage:link

Creates the same golden demo dataset as the installer seed step. See apps/backend/README.md for cron, queue, and cache guidance.

Demo accounts

After demo seeding, these accounts exist for evaluation. They are intentional for local/demo use and must be rotated or removed before production (documented in README and installer finished step).

Role	Email	Password	URL
Admin	`admin@sellio.buzz`	`admin123`	`/admin`
Partner (seller)	`partner@sellio.buzz`	`partner123`	`/dashboard/partner` (React panel or impersonate from admin)
Buyer	`buyer@sellio.buzz`	`buyer123`	`/dashboard/user` (React panel or impersonate from admin)

If the web installer created a custom admin on the final step, that account may replace user ID 1; partner and buyer demo rows from seeding remain available. Additional seeded buyers: user1@sellio.buzz … user20@sellio.buzz with password password.

Impersonation: Admin → Users → Impersonate routes to the correct React portal URLs (url_partner / url_user). Covered by AdminImpersonateTest in PHPUnit.

Manual smoke test

Suggested reviewer path after install + demo seed:

1

Admin core

Login at /admin → dashboard widgets show non-zero metrics → open Settings (logo, payment gateways) → Users & roles → Partner applications queue.

2

Storefront (Blade)

Homepage CMS content → property search with date validation → product detail → cart → checkout UI (Stripe test keys optional) → blog list/detail (sanitized HTML).

3

Vertical coverage

Spot-check detail pages: autos, events, jobs, services, classifieds — no HTTP 500, images load from local/bundled paths (no third-party hotlinks in shipped code).

4

React panels

Deploy or open pre-built apps/seller/dist and apps/buyer/dist; set public/config.js apiUrl to your Laravel host + /api. Login as partner/buyer demo accounts or use admin impersonation.

5

API docs

OpenAPI via Scramble at /docs/api (when enabled). Public/partner JSON resources use whenLoaded() to avoid N+1 leakage in list endpoints.

Reproduce automated tests

All commands run from the extracted package. Latest pass: 2026-06-07 — full log in TEST_PASS_2026-06-07.md.

PHPUnit — 259 tests (SQLite, no MySQL)

cd apps/backend
php artisan test

Uses in-memory SQLite per test case. No external services required.

Playwright — 48 admin E2E specs (MySQL)

cd apps/backend
php scripts/create-testing-db.php   # first time: creates sellio_testing
npm install
npx playwright install chromium
npm run test:browser

Requires MySQL on 127.0.0.1, database sellio_testing, port 8000 free. Uses .env.testing with SESSION_DRIVER=cookie for CSRF persistence.

Installer E2E (isolated DB)

cd apps/backend
npm run test:browser:installer:setup
npm run test:browser:installer

Uses sellio_install_test database; backs up and restores .env and installed.lock.

Dependency audits

cd apps/backend && composer audit
cd apps/seller && npm audit
cd apps/buyer && npm audit

See PACKAGE_AUDIT and NPM_AUDIT for resolved advisories and one residual low-severity JWT transitive note.

Audit report index

Dated markdown reports in this folder (also listed in README.md):

Report	Scope	Result (2026-06-07)
QA_REVIEW_2026-06-07.md	15-area CodeCanyon checklist (security, install, API, marketplace)	Needs work 0 critical, 0 high open
TEST_PASS_2026-06-07.md	PHPUnit + Playwright commands and fixes applied	259 + 48 pass
PACKAGE_AUDIT_2026-06-07.md	Composer audit, license compatibility, CHANGELOG	Pass (1 low residual)
NPM_AUDIT_2026-06-07.md	npm audit — seller and buyer React apps	Pass
DEMO_IMAGE_AUDIT_2026-06-07.md	Demo image provenance, Unsplash removal from `apps/`	Pass

Security posture summary

Key controls verified in the 2026-06-07 QA pass:

Rich HTML output — Blog, product descriptions, CMS page_content(), and page-builder HTML/CSS pass through sanitize_rich_html() / dedicated CSS sanitizer on save and render.
Page builder access — GrapesJS routes restricted to super-admin role.
Installer exposure — installed.lock blocks re-entry; README and installer UI instruct removal of public/install/ on production.
API throttling — Rate limiters on public and partner API route groups (see bootstrap/app.php / route middleware).
Webhooks — Stripe/PayPal webhook routes excluded from CSRF; fulfillment handled server-side.
Demo credentials — Documented with explicit production rotation warning (not hidden defaults).
Debug surface — No dd()/dump() in app/; production expects APP_DEBUG=false.

Trust model: Admin-editable CMS HTML is sanitized but still intended for trusted staff only. Buyers are advised to limit admin accounts and enable RBAC — see apps/backend/README.md §5.

License & redistributable assets

Item license: Proprietary CodeCanyon / Envato commercial terms — root LICENSE and apps/backend/LICENSE.
PHP dependencies: Production Composer packages are MIT/BSD/Apache/ISC compatible — see PACKAGE_AUDIT.
Demo photos: Seeded from database/seeders/images/; include only royalty-free assets in distribution. Theme preview WebP under public/themes/.
Third-party hotlinks: unsplash.com references removed from apps/backend, apps/seller, and apps/buyer shipping code (re-grep before release).