@carrierllc/mcp 0.2.17 → 0.2.19

package/templates/storefront/src/app/sign-up/[[...sign-up]]/page.tsx

@@ -1,13 +1,28 @@
 export const dynamic = "force-dynamic";
-
-import { SignUp } from "@clerk/nextjs";
+/**
+ * /sign-up — Custom email + password sign-up flow for the storefront.
+ *
+ * MANGO-6/7: Phone number is never required here. It is collected optionally
+ * on /activate/[orderId] after purchase.
+ */
+import { Suspense } from "react";
+import { StorefrontSignUpClient } from "./StorefrontSignUpClient";
 
 export const metadata = { title: "Sign up" };
 
 export default function SignUpPage() {
   return (
     <div className="flex min-h-[calc(100vh-4rem)] items-center justify-center px-4">
-      <SignUp signInUrl="/sign-in" redirectUrl="/dashboard" />
+      <Suspense
+        fallback={
+          <div className="text-center space-y-3">
+            <div className="mx-auto size-8 animate-spin rounded-full border-2 border-[var(--brand-accent)] border-t-transparent" />
+            <p className="text-sm text-white/60">Loading…</p>
+          </div>
+        }
+      >
+        <StorefrontSignUpClient />
+      </Suspense>
     </div>
   );
 }

package/templates/storefront/src/lib/checkout-order-claim.ts

@@ -0,0 +1,141 @@
+import { clerkClient } from "@clerk/nextjs/server";
+import { verifyCheckoutSession } from "@/lib/verify-checkout-session";
+
+type StripeSession = {
+  metadata?: Record<string, string>;
+  customer_email?: string | null;
+  customer_details?: { email?: string | null };
+};
+
+/** See verify-checkout-session.ts — same charset gate for path interpolation. */
+const STRIPE_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,256}$/;
+
+function safeStripeSessionId(sessionId: string): string | null {
+  if (typeof sessionId !== "string" || !STRIPE_SESSION_ID_RE.test(sessionId)) {
+    return null;
+  }
+  return encodeURIComponent(sessionId);
+}
+
+async function fetchStripeSession(sessionId: string): Promise<StripeSession | null> {
+  const stripeKey = process.env.STRIPE_SECRET_KEY;
+  if (!stripeKey) return null;
+  const safeSessionId = safeStripeSessionId(sessionId);
+  if (!safeSessionId) return null;
+
+  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
+    headers: { Authorization: `Bearer ${stripeKey}` },
+  });
+  if (!resp.ok) return null;
+  return (await resp.json()) as StripeSession;
+}
+
+async function setStripeClaimedBy(sessionId: string, userId: string): Promise<boolean> {
+  const stripeKey = process.env.STRIPE_SECRET_KEY;
+  if (!stripeKey) return false;
+  const safeSessionId = safeStripeSessionId(sessionId);
+  if (!safeSessionId) return false;
+
+  const formBody = new URLSearchParams({
+    "metadata[claimedByUserId]": userId,
+  });
+
+  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${stripeKey}`,
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body: formBody.toString(),
+  });
+
+  return resp.ok;
+}
+
+function claimedOrderIds(metadata: Record<string, unknown> | undefined): string[] {
+  const value = metadata?.claimedOrderIds;
+  return Array.isArray(value) ? value.filter((id): id is string => typeof id === "string") : [];
+}
+
+function sessionPurchaserEmail(session: StripeSession): string | null {
+  return session.customer_details?.email ?? session.customer_email ?? null;
+}
+
+async function userMatchesSessionPurchaser(session: StripeSession, userId: string): Promise<boolean> {
+  const purchaserEmail = sessionPurchaserEmail(session);
+  if (!purchaserEmail) return true;
+
+  const client = await clerkClient();
+  const user = await client.users.getUser(userId);
+  const normalizedPurchaserEmail = purchaserEmail.toLowerCase();
+  return user.emailAddresses.some(
+    (address) => address.emailAddress.toLowerCase() === normalizedPurchaserEmail,
+  );
+}
+
+async function addClaimedOrderToUser(userId: string, orderId: string): Promise<void> {
+  const client = await clerkClient();
+  const user = await client.users.getUser(userId);
+  const existing = claimedOrderIds(user.privateMetadata as Record<string, unknown> | undefined);
+  if (existing.includes(orderId)) return;
+
+  await client.users.updateUserMetadata(userId, {
+    privateMetadata: { claimedOrderIds: [...existing, orderId] },
+  });
+}
+
+export async function claimCheckoutOrder(
+  userId: string,
+  sessionId: string,
+  templateId: string,
+): Promise<{ ok: true; orderId: string } | { ok: false; status: number; error: string }> {
+  const verification = await verifyCheckoutSession(sessionId, templateId);
+  if (!verification.ok) {
+    return { ok: false, status: 400, error: "Invalid or unpaid checkout session" };
+  }
+
+  const orderId = verification.orderId;
+
+  if (sessionId !== "mock" && process.env.STRIPE_SECRET_KEY) {
+    const session = await fetchStripeSession(sessionId);
+    if (!session) {
+      return { ok: false, status: 400, error: "Invalid or unpaid checkout session" };
+    }
+
+    if (!(await userMatchesSessionPurchaser(session, userId))) {
+      return { ok: false, status: 403, error: "This order is linked to another account" };
+    }
+
+    const claimedBy = session.metadata?.claimedByUserId;
+    if (claimedBy && claimedBy !== userId) {
+      return { ok: false, status: 403, error: "This order is linked to another account" };
+    }
+    if (!claimedBy) {
+      const updated = await setStripeClaimedBy(sessionId, userId);
+      if (!updated) {
+        return { ok: false, status: 502, error: "Failed to claim order" };
+      }
+
+      const afterClaim = await fetchStripeSession(sessionId);
+      if (afterClaim?.metadata?.claimedByUserId !== userId) {
+        return { ok: false, status: 403, error: "This order is linked to another account" };
+      }
+    }
+  }
+
+  await addClaimedOrderToUser(userId, orderId);
+  return { ok: true, orderId };
+}
+
+export async function userOwnsOrder(userId: string, orderId: string): Promise<boolean> {
+  if (process.env.STRIPE_SECRET_KEY && orderId.startsWith("cs_")) {
+    const session = await fetchStripeSession(orderId);
+    return session?.metadata?.claimedByUserId === userId;
+  }
+
+  const client = await clerkClient();
+  const user = await client.users.getUser(userId);
+  return claimedOrderIds(user.privateMetadata as Record<string, unknown> | undefined).includes(
+    orderId,
+  );
+}

package/templates/storefront/src/lib/complete-email-sign-up.ts

@@ -0,0 +1,50 @@
+type SignUpVerificationResult = {
+  status: string;
+  createdSessionId: string | null;
+};
+
+type SignUpForEmailVerify = {
+  missingFields?: string[];
+  unverifiedFields?: string[];
+  update: (params: Record<string, never>) => Promise<SignUpVerificationResult>;
+};
+
+export type EmailSignUpCompletion =
+  | { status: "complete"; sessionId: string }
+  | { status: "incomplete"; message: string };
+
+export async function completeEmailSignUpAfterVerify(
+  signUp: SignUpForEmailVerify,
+  result: SignUpVerificationResult,
+): Promise<EmailSignUpCompletion> {
+  if (result.status === "complete" && result.createdSessionId) {
+    return { status: "complete", sessionId: result.createdSessionId };
+  }
+
+  if (result.status === "missing_requirements") {
+    const missingFields = signUp.missingFields ?? [];
+    const unverifiedFields = signUp.unverifiedFields ?? [];
+    const onlyPhoneMissing =
+      missingFields.length === 1 &&
+      missingFields[0] === "phone_number" &&
+      unverifiedFields.length === 0;
+
+    if (onlyPhoneMissing) {
+      try {
+        const updated = await signUp.update({});
+        if (updated.status === "complete" && updated.createdSessionId) {
+          return { status: "complete", sessionId: updated.createdSessionId };
+        }
+      } catch {
+        // Fall through to generic incomplete message.
+      }
+    }
+
+    return {
+      status: "incomplete",
+      message: "One more step required. Please complete your profile to continue.",
+    };
+  }
+
+  return { status: "incomplete", message: "Verification incomplete. Please try again." };
+}

package/templates/storefront/src/lib/verify-checkout-session.ts

@@ -0,0 +1,70 @@
+type StripeCheckoutSession = {
+  payment_status?: string;
+  customer_email?: string | null;
+  customer_details?: { email?: string | null };
+};
+
+function sessionPurchaserEmail(session: StripeCheckoutSession): string | null {
+  return session.customer_details?.email ?? session.customer_email ?? null;
+}
+
+type VerifyResult =
+  | { ok: true; orderId: string; purchaserEmail: string | null }
+  | { ok: false };
+
+/**
+ * Stripe Checkout session ids are opaque tokens (`cs_test_…` / `cs_live_…`).
+ * They are interpolated into the Stripe API URL, so an unvalidated value can
+ * inject `?`/`#`/`../` and retarget the request *with the Stripe secret key
+ * attached* (CodeQL js/request-forgery). Restrict to an explicit charset and
+ * encode before interpolation.
+ */
+const STRIPE_SESSION_ID_RE = /^[A-Za-z0-9_-]{1,256}$/;
+
+function safeStripeSessionId(sessionId: string): string | null {
+  if (typeof sessionId !== "string" || !STRIPE_SESSION_ID_RE.test(sessionId)) {
+    return null;
+  }
+  return encodeURIComponent(sessionId);
+}
+
+/**
+ * Confirms a Stripe Checkout session is paid before allowing post-payment flows.
+ * Mock sessions are only accepted when Stripe is not configured (local/dev builds).
+ */
+export async function verifyCheckoutSession(
+  sessionId: string,
+  templateId: string,
+): Promise<VerifyResult> {
+  if (sessionId === "mock") {
+    if (process.env.STRIPE_SECRET_KEY || !templateId) {
+      return { ok: false };
+    }
+    return { ok: true, orderId: templateId, purchaserEmail: null };
+  }
+
+  const safeSessionId = safeStripeSessionId(sessionId);
+  if (!safeSessionId) {
+    return { ok: false };
+  }
+
+  const stripeKey = process.env.STRIPE_SECRET_KEY;
+  if (!stripeKey) {
+    return { ok: false };
+  }
+
+  const resp = await fetch(`https://api.stripe.com/v1/checkout/sessions/${safeSessionId}`, {
+    headers: { Authorization: `Bearer ${stripeKey}` },
+  });
+
+  if (!resp.ok) {
+    return { ok: false };
+  }
+
+  const session = (await resp.json()) as StripeCheckoutSession;
+  if (session.payment_status !== "paid") {
+    return { ok: false };
+  }
+
+  return { ok: true, orderId: sessionId, purchaserEmail: sessionPurchaserEmail(session) };
+}

package/templates/storefront/src/middleware.ts

@@ -9,6 +9,12 @@ const isPublicRoute = createRouteMatcher([
   "/sign-in(.*)",
   "/sign-up(.*)",
   "/api/health",
+  // MANGO-8/9: guest checkout API and post-payment success page are public
+  // (user has not yet created an account at this point in the purchase flow)
+  "/api/checkout/guest",
+  "/checkout/success(.*)",
+  // The checkout page itself is public — unauthenticated users can initiate payment
+  "/checkout/(.*)",
 ]);
 
 export default clerkMiddleware(async (auth, req) => {