Apex Auto Group 

A dealership website lives or dies on one thing: can a buyer find the right car and get in touch without friction. Apex Auto Group is a complete, production-shaped storefront built around exactly that flow — browse, compare, calculate, inquire.

Behind the public storefront sits a full admin area, so the whole thing is a real two-sided product rather than a static brochure: staff manage inventory, photos, and the lead inbox; buyers never see any of it.

Inventory search has a lot of moving parts — make, model, price, year, mileage, body type, fuel, transmission — and it all has to stay shareable and back-button friendly. State that lives only in component memory breaks the moment someone copies a URL.

On the back of the house, lead capture has to resist spam without punishing real buyers, and the admin area has to be genuinely protected, not just hidden behind an unlinked page.

Every facet of the search — filters, sort, keyword, pagination — lives in the URL and runs server-side, so results are fast, shareable, and indexable. Vehicle pages get a photo gallery with lightbox, full specs, tap-to-call, and tabbed inquiry / test-drive / trade-in forms.

Leads are validated on both client and server with Zod, stored, and emailed to the dealership, with a honeypot and per-IP rate limiting holding back spam. The admin area is locked behind JWT cookie auth with bcrypt-hashed passwords, enforced in middleware.

The showroom now runs live on real data: an import pipeline pulls around 120 genuine used-car listings from the auto.dev API — real dealer photos, VIN-decoded engine, transmission, and drivetrain specs — across sixteen makes. On top of that inventory sit featured vehicles, browse-by-body-type, a clearly-labeled payment estimator, side-by-side compare of up to three cars, and saved favorites.

Admins get full vehicle CRUD with available/pending/sold and featured toggles, multi-image upload with reorder and set-primary, and a lead inbox with a new → contacted → closed workflow. SEO is wired throughout — per-vehicle metadata, schema.org Car data, sitemap, and robots.

Next.js 16 (App Router) with TypeScript and Tailwind CSS v4, backed by Prisma 7 through driver adapters — zero-config SQLite locally, a hosted Turso (libSQL) database in production — so the deployed site runs the same code against a serverless-friendly store. External services — Resend for email, Cloudinary for images, maps — are wired with real integrations that fall back to sensible local behavior when no keys are set.

Auth is hand-rolled on `jose` JWTs in httpOnly cookies with bcrypt hashing, and every admin route is gated in middleware so protection doesn't depend on the UI hiding a link.