create-ailk 0.2.0 → 0.3.0

package/templates/apps/web/app/[locale]/flows/[slug]/checkout.actions.ts

@@ -1,254 +0,0 @@
-"use server";
-
-/**
- * checkout.actions.ts — the recommender's two email-moment Server Actions
- * (#4842 D7), siblings of `flow.actions.ts` (ADR 0013 `*.actions.ts`):
- *
- *   - `startCheckoutAction` — Pay: validates with the shared
- *     `flowCheckoutInputSchema` (#4841 — a body with NO money field; the
- *     server recomputes `price()` from the register it served, PRD L104),
- *     calls `flows.checkout`, and on `ok` hands the visitor to Stripe's
- *     hosted page via `redirect(url)` (D1 — hosted Checkout, Sam 2026-09-05).
- *   - `saveRecommendationAction` — "Email me this plan": validates with
- *     `flowSaveInputSchema`, calls `flows.save`, returns the lead id.
- *
- * Both mirror `submitFlowStepAction`'s idiom exactly: shared-schema
- * validation, the visitor-IP forwarding helper (duplicated here — the
- * `flow.actions.ts` original is module-private and that file is this unit's
- * regression floor), a status → kind map, and NEVER a throw to the client.
- * Logging is PII-safe: slug + kind only — the email is never logged.
- *
- * `redirect()` throws `NEXT_REDIRECT` by design, so it is called OUTSIDE the
- * try/catch that maps a thrown api-client error to `network` — inside it,
- * the catch would swallow the very navigation the action exists to perform.
- *
- * The Stripe return URLs are BUILT HERE, never accepted from the client
- * (security review, #4875): a direct caller could otherwise mint a session
- * that redirects post-payment to an arbitrary host, since the shared
- * `flowRedirectUrlSchema` pins only `http(s)` + a host. The client hands over
- * the permalink `payload` it already has; the action decodes it, requires it
- * to name THIS flow, and composes `<site origin>/<safe locale>/flows/<slug>/
- * results/<payload>?checkout=success|cancelled` from the app's own configured
- * origin (`resolveBaseUrl()` — the same source `layout.tsx` / `sitemap.xml`
- * use for every absolute URL).
- */
-
-import { flows } from "@working-theory/api-client";
-import type { FlowCheckoutInputRaw, FlowSaveInput } from "@working-theory/validation";
-import {
-  decodePermalink,
-  flowCheckoutInputSchema,
-  flowSaveInputSchema,
-  flowSlugSchema,
-} from "@working-theory/validation";
-import { headers } from "next/headers";
-import { redirect } from "next/navigation";
-
-import { resolveBaseUrl } from "../../../../src/lib/routes";
-
-export type EmailMomentFailureKind =
-  | "invalid_input"
-  | "not_configured"
-  | "rate_limited"
-  | "unavailable"
-  | "network";
-
-export interface EmailMomentFailure {
-  ok: false;
-  kind: EmailMomentFailureKind;
-  retryAfterSeconds?: number;
-}
-
-/** `startCheckoutAction` never returns on success — it `redirect()`s. */
-export type CheckoutActionResult = EmailMomentFailure;
-
-/**
- * The client-supplied checkout input: the wire body MINUS the two return
- * URLs (server-built, above) PLUS the permalink `payload` they are built from.
- */
-export type StartCheckoutInput = Omit<FlowCheckoutInputRaw, "successUrl" | "cancelUrl"> & {
-  payload: string;
-};
-
-// Mirrors `FlowStepperClient.tsx:80–88` (#4707) — the locale segment of a
-// built URL is validated against the same build-time-baked allowlist, never
-// interpolated raw.
-const DEFAULT_LOCALE = "en";
-const ENABLED_LOCALES = (process.env.NEXT_PUBLIC_ENABLED_LOCALES ?? DEFAULT_LOCALE).split(",");
-
-/** Validate a candidate locale against the configured set; unknown → default. */
-function resolveSafeLocale(candidate: string): string {
-  return ENABLED_LOCALES.includes(candidate) ? candidate : DEFAULT_LOCALE;
-}
-
-/**
- * The permalink's absolute URL on THIS site, or `undefined` when the payload
- * is not a valid permalink of `slug` (never a URL to somewhere else).
- */
-function permalinkUrlFor(slug: string, locale: string, payload: string): string | undefined {
-  const decoded = decodePermalink(payload);
-  if (!decoded.ok || decoded.value.flowSlug !== slug) return undefined;
-  const origin = resolveBaseUrl().replace(/\/+$/, "");
-  return `${origin}/${resolveSafeLocale(locale)}/flows/${slug}/results/${payload}`;
-}
-
-export type SaveActionResult = { ok: true; leadId: string } | EmailMomentFailure;
-
-/**
- * Reads the visitor's real IP from THIS action's own incoming request —
- * never from the browser-supplied payload — preferring `x-forwarded-for`
- * and falling back to `x-real-ip`. Returns `undefined` rather than throwing
- * on any failure (a local copy of `flow.actions.ts`'s helper, #4730).
- */
-async function resolveVisitorIpInit(): Promise<
-  { headers: Record<string, string> } | undefined
-> {
-  try {
-    const incoming = await headers();
-    const visitorIp =
-      incoming.get("x-forwarded-for") ?? incoming.get("x-real-ip");
-    return visitorIp
-      ? { headers: { "x-forwarded-for": visitorIp } }
-      : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-/** PII-safe error identity for logs — the `recommender.ts` idiom (`err.name` only). */
-function errorName(err: unknown): string {
-  return err instanceof Error ? err.name : "unknown";
-}
-
-/** The shared `status → kind` map (D7). Never throws. */
-function failureFor(res: { status: number; body: unknown }): EmailMomentFailure {
-  if (res.status === 400) return { ok: false, kind: "invalid_input" };
-  if (res.status === 409) return { ok: false, kind: "not_configured" };
-  if (res.status === 429) {
-    const body = res.body as { retryAfterSeconds?: number } | null;
-    return {
-      ok: false,
-      kind: "rate_limited",
-      ...(typeof body?.retryAfterSeconds === "number"
-        ? { retryAfterSeconds: body.retryAfterSeconds }
-        : {}),
-    };
-  }
-  return { ok: false, kind: "unavailable" };
-}
-
-/**
- * exactOptionalPropertyTypes-safe rebuild of the parsed body: Zod's inferred
- * optional fields type as `T | undefined`, which does not structurally match
- * the api-client's `sessionId?: string` / `locale?: string` — so an absent
- * optional key is OMITTED rather than sent as an explicit `undefined`.
- */
-function emailMomentFields(parsed: FlowSaveInput): FlowSaveInput {
-  const { answers, email, locale, sessionId } = parsed;
-  return {
-    answers,
-    email,
-    ...(locale !== undefined ? { locale } : {}),
-    ...(sessionId !== undefined ? { sessionId } : {}),
-  };
-}
-
-export async function startCheckoutAction(
-  slug: string,
-  input: StartCheckoutInput,
-): Promise<CheckoutActionResult> {
-  const parsedSlug = flowSlugSchema.safeParse(slug);
-  if (!parsedSlug.success) return { ok: false, kind: "invalid_input" };
-
-  // Only the named fields cross into the wire body — a caller-supplied
-  // `successUrl` / `cancelUrl` (or any other stray key) is dropped here.
-  const { answers, email, locale, sessionId, offerKey, seats, period, creditStop, payload } =
-    input;
-  if (typeof payload !== "string" || payload.length === 0 || payload.length > 4096) {
-    return { ok: false, kind: "invalid_input" };
-  }
-  const permalinkUrl = permalinkUrlFor(parsedSlug.data, locale ?? DEFAULT_LOCALE, payload);
-  if (permalinkUrl === undefined) return { ok: false, kind: "invalid_input" };
-
-  const parsed = flowCheckoutInputSchema.safeParse({
-    answers,
-    email,
-    ...(locale !== undefined ? { locale } : {}),
-    ...(sessionId !== undefined ? { sessionId } : {}),
-    offerKey,
-    seats,
-    period,
-    ...(creditStop !== undefined ? { creditStop } : {}),
-    successUrl: `${permalinkUrl}?checkout=success`,
-    cancelUrl: `${permalinkUrl}?checkout=cancelled`,
-  });
-  if (!parsed.success) return { ok: false, kind: "invalid_input" };
-
-  const wireBody: FlowCheckoutInputRaw = {
-    ...emailMomentFields(parsed.data),
-    offerKey: parsed.data.offerKey,
-    seats: parsed.data.seats,
-    period: parsed.data.period,
-    creditStop: parsed.data.creditStop,
-    successUrl: parsed.data.successUrl,
-    cancelUrl: parsed.data.cancelUrl,
-  };
-
-  let url: string;
-  try {
-    const visitorIpInit = await resolveVisitorIpInit();
-    const res = visitorIpInit
-      ? await flows.checkout(parsedSlug.data, wireBody, visitorIpInit)
-      : await flows.checkout(parsedSlug.data, wireBody);
-    if (!res.ok) {
-      const failure = failureFor(res);
-      console.error(
-        `[startCheckoutAction] slug=${parsedSlug.data} kind=${failure.kind} status=${res.status}`,
-      );
-      return failure;
-    }
-    url = res.body.url;
-  } catch (err) {
-    // Name only — never the error object (it can carry the request payload).
-    console.error(
-      `[startCheckoutAction] slug=${parsedSlug.data} kind=network errName=${errorName(err)}`,
-    );
-    return { ok: false, kind: "network" };
-  }
-
-  // Outside the try/catch on purpose — see the file header.
-  redirect(url);
-}
-
-export async function saveRecommendationAction(
-  slug: string,
-  body: FlowSaveInput,
-): Promise<SaveActionResult> {
-  const parsedSlug = flowSlugSchema.safeParse(slug);
-  if (!parsedSlug.success) return { ok: false, kind: "invalid_input" };
-
-  const parsed = flowSaveInputSchema.safeParse(body);
-  if (!parsed.success) return { ok: false, kind: "invalid_input" };
-
-  const payload = emailMomentFields(parsed.data);
-
-  try {
-    const visitorIpInit = await resolveVisitorIpInit();
-    const res = visitorIpInit
-      ? await flows.save(parsedSlug.data, payload, visitorIpInit)
-      : await flows.save(parsedSlug.data, payload);
-    if (!res.ok) {
-      const failure = failureFor(res);
-      console.error(
-        `[saveRecommendationAction] slug=${parsedSlug.data} kind=${failure.kind} status=${res.status}`,
-      );
-      return failure;
-    }
-    return { ok: true, leadId: res.body.leadId };
-  } catch (err) {
-    console.error(
-      `[saveRecommendationAction] slug=${parsedSlug.data} kind=network errName=${errorName(err)}`,
-    );
-    return { ok: false, kind: "network" };
-  }
-}