create-ailk 0.22.0 → 0.24.0

package/templates/apps/web/app/[locale]/unsubscribe/unsubscribe-button.tsx

@@ -5,12 +5,13 @@
  * D17). Posts `unsubscribeAction(token)` on click only — never on render,
  * so a mail scanner's GET prefetch of the page writes nothing.
  *
- * Reads its own strings through `useTranslations` (the island idiom
- * `FlowStepperClient` uses) rather than taking them as props: the done line
- * needs the purpose's description formatted in, and a formatting FUNCTION
- * handed across from the page (a Server Component) cannot be serialized
- * into the Flight payload — the scaffold matrix's `GET /unsubscribe -> 500`
- * (`unsubscribe-rsc-boundary.test.tsx` holds the regression).
+ * The button label and the done message are the newsletter magnet's
+ * (#8847 D12), passed as STRINGS: a formatting FUNCTION handed across from the
+ * page (a Server Component) cannot be serialized into the Flight payload —
+ * the scaffold matrix's `GET /unsubscribe -> 500`
+ * (`unsubscribe-rsc-boundary.test.tsx` holds the regression). The token
+ * states (invalid, already, unavailable) read their own catalog lines
+ * through `useTranslations`.
  */
 
 import { Button, InlineMessage } from "@working-theory/ui/primitives";
@@ -19,7 +20,21 @@ import { useState, useTransition, type ReactElement } from "react";
 
 import { unsubscribeAction, type UnsubscribeResult } from "./unsubscribe.actions";
 
-export function UnsubscribeButton({ token }: { token: string | null }): ReactElement {
+interface UnsubscribeButtonProps {
+  token: string | null;
+  /** The button label (the magnet's `unsubscribe.cta`). */
+  cta: string;
+  /** The done message (the magnet's `unsubscribe.done`). */
+  doneHeadline: string;
+  doneBody?: string;
+}
+
+export function UnsubscribeButton({
+  token,
+  cta,
+  doneHeadline,
+  doneBody,
+}: UnsubscribeButtonProps): ReactElement {
   const t = useTranslations("unsubscribe");
   const [result, setResult] = useState<UnsubscribeResult | null>(null);
   const [pending, startTransition] = useTransition();
@@ -35,7 +50,13 @@ export function UnsubscribeButton({ token }: { token: string | null }): ReactEle
   if (result?.kind === "done") {
     return (
       <InlineMessage variant="success" role="status" data-testid="unsubscribe-done">
-        {t("done", { description: result.description })}
+        {/* Headline over body, as the /contact ending stacks them (#8847 D12). */}
+        <span className="flex flex-col">
+          <span className="font-semibold" data-testid="unsubscribe-done-headline">
+            {doneHeadline}
+          </span>
+          {doneBody !== undefined && <span className="mt-1">{doneBody}</span>}
+        </span>
       </InlineMessage>
     );
   }
@@ -67,7 +88,7 @@ export function UnsubscribeButton({ token }: { token: string | null }): ReactEle
       }}
       data-testid="unsubscribe-button"
     >
-      {t("button")}
+      {cta}
     </Button>
   );
 }

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/route.ts

@@ -0,0 +1,316 @@
+// The Offerings buy route (#9051, spec
+// docs/specs/9051-the-offerings-buy-route-api-spec.md). Every Stripe card on
+// /pricing links `/api/offerings/checkout/<lookup_key>` (#8927); this route
+// starts the hosted Checkout for that key and answers a 303 to it.
+//
+// Only a buyer's page load starts anything: a prefetch, a crawler, a
+// cross-site load or an ungrammatical key is refused before any call. The
+// route then confirms, from a shown-set read shared for 15 seconds, that the
+// site is connected and shows the key — an unconnected site's POST would take
+// the API's env path (#8931 A9) — and POSTs `/v1/checkout/sessions` with
+// success and cancel URLs on the site's configured origin, never the
+// request's. Every refusal is a 303 to `/pricing` with no body and one fixed
+// log line; no response or log line carries the key.
+import { checkout, offerings } from "@working-theory/api-client";
+import { parseLookupKey } from "@working-theory/validation";
+
+import { isShownLookupKey } from "../../../../../lib/offerings-pricing";
+import { FALLBACK_BASE_URL } from "../../../../../lib/site-brand";
+import { resolveCommerceClaim } from "../../../../../src/lib/commerce-claim";
+import { resolveBaseUrl } from "../../../../../src/lib/routes";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+type RefusalReason =
+  | "unintended"
+  | "ungrammatical"
+  | "no_claim"
+  | "unconnected"
+  | "not_shown"
+  | "no_origin"
+  | "rate_limited"
+  | "unreachable"
+  | "bad_answer"
+  | `api_${number}`;
+
+/** D6 — relative, so a misconfigured base URL can never send a buyer off-site. */
+function refuse(reason: RefusalReason): Response {
+  console.warn(`[offerings-checkout] refused reason=${reason}`);
+  return new Response(null, {
+    status: 303,
+    headers: { Location: "/pricing", "Cache-Control": "no-store" },
+  });
+}
+
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1"]);
+const PLACEHOLDER_ORIGIN = new URL(FALLBACK_BASE_URL).origin;
+
+/**
+ * D2 step 1 — a top-level browser navigation, and not a prefetch, an RSC
+ * fetch or a cross-site load: the spoke buy route's refusal set plus the
+ * navigation requirement, so no crawler, unfurler, `<img>` or `fetch` opens a
+ * Stripe session.
+ */
+function isBuyerNavigation(request: Request): boolean {
+  const headers = request.headers;
+  if (request.method === "HEAD") return false;
+  if (headers.get("sec-fetch-mode") !== "navigate") return false;
+  if (headers.get("sec-fetch-dest") !== "document") return false;
+  if (headers.get("sec-fetch-site") === "cross-site") return false;
+  const secPurpose = (headers.get("sec-purpose") ?? "").toLowerCase();
+  const purpose = (headers.get("purpose") ?? "").toLowerCase();
+  if (secPurpose.includes("prefetch") || purpose.includes("prefetch"))
+    return false;
+  if ((headers.get("x-moz") ?? "").toLowerCase() === "prefetch") return false;
+  if (headers.get("next-router-prefetch") !== null) return false;
+  if (headers.get("rsc") !== null) return false;
+  return true;
+}
+
+/**
+ * The API origin, in the order `getApiBase()` in
+ * packages/api-client/src/http.ts reads it.
+ */
+function configuredApiBase(): string | undefined {
+  return (
+    process.env.AILK_API_URL ||
+    process.env.NEXT_PUBLIC_AILK_API_URL ||
+    process.env.NEXT_PUBLIC_API_URL ||
+    undefined
+  );
+}
+
+/** `work`'s answer, or `late` once `ms` pass first. */
+function settleWithin<T>(work: Promise<T>, ms: number, late: T): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const bound = new Promise<T>((resolve) => {
+    timer = setTimeout(() => resolve(late), ms);
+  });
+  return Promise.race([work, bound]).finally(() => clearTimeout(timer));
+}
+
+// ─── D3 — the shared shown-set read ─────────────────────────────────────────
+
+type ShownRead =
+  | { kind: "unconnected" }
+  | { kind: "shown"; shownSet: unknown }
+  | { kind: "other" };
+
+const OTHER: ShownRead = { kind: "other" };
+
+/** `/pricing`'s window: a product switched off stops being bought within it. */
+const READ_TTL_MS = 15_000;
+const READ_TIMEOUT_MS = 5_000;
+
+const reads = new Map<string, { at: number; read: Promise<ShownRead> }>();
+
+/** The shown set as the page reads it; the body is untrusted. */
+async function readShown(): Promise<ShownRead> {
+  try {
+    const res = await offerings.shown();
+    if (!res.ok) return OTHER;
+    const body: unknown = res.body;
+    if (body === null || typeof body !== "object") return OTHER;
+    const { status, shownSet } = body as {
+      status?: unknown;
+      shownSet?: unknown;
+    };
+    if (status === "unconnected") return { kind: "unconnected" };
+    if (status === "shown") return { kind: "shown", shownSet };
+    return OTHER;
+  } catch {
+    return OTHER;
+  }
+}
+
+/**
+ * One read per instance per READ_TTL_MS: `offerings.shown()` forwards no
+ * visitor header, so a read per click would count every buyer against this
+ * server's one per-IP limit at the API. Concurrent and failed reads are
+ * shared too, and the shared promise settles within READ_TIMEOUT_MS.
+ */
+function sharedShownRead(): Promise<ShownRead> {
+  const now = Date.now();
+  const hit = reads.get("shown-offerings");
+  if (hit && now - hit.at < READ_TTL_MS) return hit.read;
+  const read = settleWithin(readShown(), READ_TIMEOUT_MS, OTHER);
+  reads.set("shown-offerings", { at: now, read });
+  return read;
+}
+
+// ─── D2 steps 6 and 7 — the site origin and the per-visitor budget ──────────
+
+/**
+ * The configured site origin: `https:`, or `http:` on loopback, and never
+ * the placeholder `resolveBaseUrl()` answers when no base URL is set.
+ */
+function siteOrigin(): string | null {
+  let url: URL;
+  try {
+    url = new URL(resolveBaseUrl());
+  } catch {
+    return null;
+  }
+  const secure =
+    url.protocol === "https:" ||
+    (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname));
+  if (!secure || url.origin === PLACEHOLDER_ORIGIN) return null;
+  return url.origin;
+}
+
+const BUDGET_STARTS = 5;
+const BUDGET_WINDOW_MS = 10 * 60_000;
+const BUDGET_MAX_ADDRESSES = 10_000;
+/** An address key is cut to this length, so the Map cannot grow by key size. */
+const BUDGET_ADDRESS_LENGTH = 64;
+
+const starts = new Map<string, { windowStart: number; count: number }>();
+
+function visitorAddress(headers: Headers): string | null {
+  const address =
+    headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+    headers.get("x-real-ip")?.trim();
+  return address ? address.slice(0, BUDGET_ADDRESS_LENGTH) : null;
+}
+
+/**
+ * Charges one start to `address`, or answers false when its window is spent.
+ * The oldest-inserted address is evicted at BUDGET_MAX_ADDRESSES.
+ */
+function spendStart(address: string, now: number): boolean {
+  const entry = starts.get(address);
+  if (entry && now - entry.windowStart < BUDGET_WINDOW_MS) {
+    if (entry.count >= BUDGET_STARTS) return false;
+    entry.count += 1;
+    return true;
+  }
+  if (entry) {
+    starts.delete(address);
+  } else if (starts.size >= BUDGET_MAX_ADDRESSES) {
+    const oldest = starts.keys().next().value;
+    if (oldest !== undefined) starts.delete(oldest);
+  }
+  starts.set(address, { windowStart: now, count: 1 });
+  return true;
+}
+
+// ─── D2 steps 8 and 9 — the start and its answer ────────────────────────────
+
+const START_TIMEOUT_MS = 10_000;
+
+/**
+ * D5 — the visitor's forwarded address, so the API's per-IP bucket counts
+ * buyers, and the internal secret only from a site that is not a spoke and
+ * only to an `https:` or loopback API. Nothing else of the request is sent.
+ */
+function startHeaders(incoming: Headers): Record<string, string> {
+  const headers: Record<string, string> = {};
+  const visitor = incoming.get("x-forwarded-for") || incoming.get("x-real-ip");
+  if (visitor) headers["x-forwarded-for"] = visitor;
+
+  const secret = process.env.OSS_API_INTERNAL_SECRET;
+  if (secret && !process.env.AILK_SPOKE_KEY?.trim() && isSafeApiTransport()) {
+    headers["x-internal-auth"] = secret;
+  }
+  return headers;
+}
+
+function isSafeApiTransport(): boolean {
+  try {
+    const url = new URL(configuredApiBase() ?? "http://localhost:3001");
+    return url.protocol === "https:" || LOOPBACK_HOSTS.has(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The answer's Checkout URL: `https:`, no credentials, and exactly its own
+ * canonical form, so `Location` never carries a string the parser would
+ * rewrite (a CR, LF or tab, a non-ASCII character, a missing slash).
+ */
+function checkoutUrl(body: unknown): string | null {
+  if (body === null || typeof body !== "object") return null;
+  const { url } = body as { url?: unknown };
+  if (typeof url !== "string") return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:") return null;
+  if (parsed.username || parsed.password) return null;
+  return parsed.href === url ? url : null;
+}
+
+// ─── The ladder (D2) ────────────────────────────────────────────────────────
+
+interface BuyContext {
+  params: Promise<{ lookupKey: string }>;
+}
+
+async function startCheckout(
+  request: Request,
+  ctx: BuyContext,
+): Promise<Response> {
+  const { lookupKey } = await ctx.params;
+
+  if (!isBuyerNavigation(request)) return refuse("unintended");
+  if (!parseLookupKey(lookupKey)) return refuse("ungrammatical");
+  if (!(await resolveCommerceClaim())) return refuse("no_claim");
+  if (process.env.NODE_ENV === "production" && !configuredApiBase()) {
+    return refuse("unconnected");
+  }
+
+  const shown = await sharedShownRead();
+  if (shown.kind === "unconnected") return refuse("unconnected");
+  if (shown.kind !== "shown" || !isShownLookupKey(shown.shownSet, lookupKey)) {
+    return refuse("not_shown");
+  }
+
+  const origin = siteOrigin();
+  if (!origin) return refuse("no_origin");
+
+  const address = visitorAddress(request.headers);
+  if (address && !spendStart(address, Date.now())) {
+    return refuse("rate_limited");
+  }
+
+  const started = await settleWithin(
+    checkout
+      .createSession(
+        {
+          productCode: lookupKey,
+          successUrl: `${origin}/purchase/success?session_id={CHECKOUT_SESSION_ID}`,
+          cancelUrl: `${origin}/pricing`,
+        },
+        { headers: startHeaders(request.headers) },
+      )
+      .catch(() => null),
+    START_TIMEOUT_MS,
+    null,
+  );
+  if (!started) return refuse("unreachable");
+  if (!started.ok) return refuse(`api_${started.status}`);
+
+  const url = checkoutUrl(started.body);
+  if (!url) return refuse("bad_answer");
+  return new Response(null, {
+    status: 303,
+    headers: { Location: url, "Cache-Control": "no-store" },
+  });
+}
+
+// platform-decisions-waiver: api-versioning — a browser buy link that redirects to Stripe Checkout, not a versioned API contract (spec 9051 D1)
+export async function GET(
+  request: Request,
+  ctx: BuyContext,
+): Promise<Response> {
+  try {
+    return await startCheckout(request, ctx);
+  } catch {
+    return refuse("unreachable");
+  }
+}