thumbgate 1.28.0 → 1.28.2

package/src/api/server.js

@@ -10,6 +10,7 @@ const {
   createUnavailableAsyncOperation,
   loadOptionalModule,
 } = require('../../scripts/private-core-boundary');
+const { redactSecrets, redactSecretsDeep } = require('../../scripts/secret-redaction');
 
 const POSTHOG_API_PATHS = new Set(['/capture', '/batch', '/decide', '/e', '/engage']);
 const POSTHOG_INGEST_HOST = 'us.i.posthog.com';
@@ -24,8 +25,12 @@ const PRO_CHECKOUT_URL = 'https://buy.stripe.com/8x2dR91M84r4cSd9uj3sI3f';
 const FIRST_FAILURE_RULE_CHECKOUT_URL = 'https://buy.stripe.com/7sY6oHaiEbTw6tP5e33sI3e';
 const QUICK_READ_CHECKOUT_URL = 'https://buy.stripe.com/5kQ7sL76s1eSaK55e33sI2H';
 const WORKFLOW_TEARDOWN_CHECKOUT_URL = 'https://buy.stripe.com/8x214n2Qc4r44lHayn3sI2I';
-const SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/28E00j3Uge1E2dzgWL3sI2J';
-const WORKFLOW_SPRINT_CHECKOUT_URL = 'https://buy.stripe.com/6oU00j8aw2iWdWh9uj3sI2K';
+// Verified live amounts (2026-07-13): diagnostic Stripe page contains $499;
+// sprint code-default Stripe slug previously pointed at a $499 diagnostic product.
+// Production sprint rail is PayPal at $1500 — pin that as the code fallback so a
+// missing Railway env cannot silently charge $499 under a $1500 label.
+const SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/9B69ATbmI4r4aK5eOD3sI3k';
+const WORKFLOW_SPRINT_CHECKOUT_URL = 'https://www.paypal.com/ncp/payment/LTQFR7P9AR3QG';
 
 function getPosthogProxyPath(pathname) {
   return pathname.slice('/ingest'.length) || '/';
@@ -214,6 +219,7 @@ const {
 const { sendProblem, PROBLEM_TYPES } = require('../../scripts/problem-detail');
 const { TOOLS: MCP_TOOLS } = require('../../scripts/tool-registry');
 const mcpOauth = require('../../scripts/mcp-oauth');
+const { packCheckoutReference } = require('../../scripts/checkout-attribution-reference');
 // OAuth 2.1 (PKCE) authorization-server state for the remote MCP connector
 // (Claude Connectors Directory requires OAuth for authenticated services).
 const oauthStore = mcpOauth.createStore();
@@ -247,6 +253,7 @@ const FEDERAL_PAGE_PATH = path.resolve(__dirname, '../../public/federal.html');
 const PRICING_PAGE_PATH = path.resolve(__dirname, '../../public/pricing.html');
 const ABOUT_PAGE_PATH = path.resolve(__dirname, '../../public/about.html');
 const DIAGNOSTIC_PAGE_PATH = path.resolve(__dirname, '../../public/diagnostic.html');
+const PARTNER_INTAKE_PAGE_PATH = path.resolve(__dirname, '../../public/partner-intake.html');
 const INSTALL_PAGE_PATH = path.resolve(__dirname, '../../public/install.html');
 const LEARN_DIR = path.resolve(__dirname, '../../public/learn');
 const GUIDES_DIR = path.resolve(__dirname, '../../public/guides');
@@ -1431,7 +1438,6 @@ function buildCheckoutAttributionMetadata(body, req, traceId) {
     : 1;
 
   return {
-    ...rawMetadata,
     traceId,
     acquisitionId: pickFirstText(rawMetadata.acquisitionId, body.acquisitionId),
     visitorId: pickFirstText(rawMetadata.visitorId, body.visitorId),
@@ -2102,6 +2108,10 @@ function buildCheckoutFallbackUrl(baseUrl, metadata = {}) {
   appendQueryParam(url, 'seat_count', metadata.seatCount);
   appendQueryParam(url, 'landing_path', metadata.landingPath);
   appendQueryParam(url, 'referrer_host', metadata.referrerHost);
+  // External Stripe Payment Links drop utm_* query params but preserve
+  // client_reference_id — pack attribution into it so marketplace-attributed paid
+  // checkouts (e.g. utm_source=aiventyx) survive to the webhook and can be credited.
+  appendQueryParam(url, 'client_reference_id', packCheckoutReference(metadata));
   return restoreStripeCheckoutPlaceholder(url.toString());
 }
 
@@ -2546,10 +2556,18 @@ function serveTrackedLinkRedirect({ req, res, parsed, hostedConfig, isHeadReques
   const { FEEDBACK_DIR } = getFeedbackPaths();
   const journeyState = resolveJourneyState(req, parsed);
   const destinationUrl = buildTrackedLinkDestination(target, hostedConfig, parsed);
+  const attribution = buildTrackedLinkAttribution(target, parsed, req, journeyState, destinationUrl);
+  if (target.external) {
+    appendQueryParam(
+      destinationUrl,
+      'client_reference_id',
+      packCheckoutReference(attribution)
+    );
+  }
   if (!isHeadRequest) {
     appendBestEffortTelemetry(
       FEEDBACK_DIR,
-      buildTrackedLinkAttribution(target, parsed, req, journeyState, destinationUrl),
+      attribution,
       req.headers,
       `tracked_link_redirect:${target.slug}`
     );
@@ -2877,6 +2895,11 @@ function loadPublicMarketingTemplateHtml(templatePath, runtimeConfig, pageContex
     '__SERVER_SESSION_ID__': pageContext.serverSessionId || '',
     '__SERVER_ACQUISITION_ID__': pageContext.serverAcquisitionId || '',
     '__SERVER_TELEMETRY_CAPTURED__': pageContext.serverTelemetryCaptured ? 'true' : 'false',
+    '__SERVER_ATTRIBUTION_SOURCE__': escapeHtmlAttribute(pageContext.serverAttributionSource || 'partner'),
+    '__SERVER_UTM_SOURCE__': escapeHtmlAttribute(pageContext.serverUtmSource || 'partner'),
+    '__SERVER_UTM_MEDIUM__': escapeHtmlAttribute(pageContext.serverUtmMedium || 'partner'),
+    '__SERVER_UTM_CAMPAIGN__': escapeHtmlAttribute(pageContext.serverUtmCampaign || 'hosted_listing'),
+    '__SERVER_UTM_CONTENT__': escapeHtmlAttribute(pageContext.serverUtmContent || 'partner_intake'),
     '__VERIFICATION_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
     '__COMPATIBILITY_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
     '__AUTOMATION_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
@@ -2898,6 +2921,10 @@ function loadDiagnosticPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(DIAGNOSTIC_PAGE_PATH, runtimeConfig, pageContext);
 }
 
+function loadPartnerIntakePageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(PARTNER_INTAKE_PAGE_PATH, runtimeConfig, pageContext);
+}
+
 function loadInstallPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(INSTALL_PAGE_PATH, runtimeConfig, pageContext);
 }
@@ -3717,6 +3744,11 @@ function servePublicMarketingPage({
     serverSessionId: journeyState.sessionId,
     serverAcquisitionId: journeyState.acquisitionId,
     serverTelemetryCaptured: landingTelemetryCaptured,
+    serverAttributionSource: landingAttribution.source,
+    serverUtmSource: landingAttribution.utmSource,
+    serverUtmMedium: landingAttribution.utmMedium,
+    serverUtmCampaign: landingAttribution.utmCampaign,
+    serverUtmContent: landingAttribution.utmContent,
     requestHost,
   });
 
@@ -4521,6 +4553,19 @@ function normalizeLeadEmail(value) {
   return email.toLowerCase();
 }
 
+function buildIntakeAlertRateLimitKey(req, env = process.env) {
+  const transportPeer = String(req.socket?.remoteAddress || 'unknown');
+  const railwayRealIp = String(req.headers['x-real-ip'] || '').trim();
+  const runningBehindRailway = Boolean(env.RAILWAY_ENVIRONMENT_ID || env.RAILWAY_PROJECT_ID);
+  const hasValidRailwayIp = /^[0-9a-f:.]{3,64}$/i.test(railwayRealIp);
+  // Railway overwrites X-Real-IP at its ingress. Outside that explicit trust
+  // boundary, forwarding headers remain caller-controlled and are ignored.
+  const clientAddress = runningBehindRailway && hasValidRailwayIp
+    ? railwayRealIp
+    : transportPeer;
+  return crypto.createHash('sha256').update(clientAddress).digest('hex');
+}
+
 function normalizeHttpUrl(value, fieldName) {
   const raw = normalizeNullableText(value);
   if (!raw) throw createHttpError(400, `${fieldName} is required`);
@@ -5629,6 +5674,16 @@ async function addContext(){
       return;
     }
 
+    // /docs is a common buyer URL; route to the public setup guide instead of 404.
+    if (isGetLikeRequest && (pathname === '/docs' || pathname === '/docs/' || pathname === '/documentation' || pathname === '/documentation/')) {
+      res.writeHead(302, {
+        Location: '/guide',
+        'Cache-Control': 'public, max-age=300',
+      });
+      res.end();
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/guide' || pathname === '/guide.html')) {
       try {
         servePublicMarketingPage({
@@ -5764,6 +5819,25 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/partner-intake' || pathname === '/partner-intake.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadPartnerIntakePageHtml,
+          extraTelemetry: {
+            pageType: 'partner_intake',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Partner intake page unavailable');
+      }
+      return;
+    }
+
     // Natural marketing URLs for the Workflow Hardening Diagnostic/Sprint.
     // High-intent outreach refers to "the diagnostic", "the sprint", or
     // "workflow hardening"; serve a focused buyer page instead of sending
@@ -7437,7 +7511,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           ? await parseFormBody(req, 24 * 1024)
           : await parseJsonBody(req, 24 * 1024);
         const workflowSprintIntake = requirePrivateApiModule('workflowSprintIntake', 'Workflow sprint intake');
-        const lead = workflowSprintIntake.appendWorkflowSprintLead({
+        const leadPayload = {
           ...body,
           traceId: body.traceId || traceId,
           acquisitionId: body.acquisitionId || journeyState.acquisitionId,
@@ -7462,7 +7536,17 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           offerCode: body.offerCode || referrerAttribution.offerCode || null,
           referrerHost: body.referrerHost || referrerAttribution.referrerHost || null,
           referrer: body.referrer || referrerAttribution.referrer || null,
-        }, { feedbackDir: FEEDBACK_DIR });
+        };
+        const intakeReservation = workflowSprintIntake.reserveWorkflowSprintIntake(leadPayload, {
+          feedbackDir: FEEDBACK_DIR,
+          rateLimitKey: buildIntakeAlertRateLimitKey(req),
+        });
+        if (!intakeReservation.allowed) {
+          const error = new Error('Too many workflow-intake submissions. Try again later.');
+          error.statusCode = intakeReservation.statusCode || 429;
+          throw error;
+        }
+        const lead = workflowSprintIntake.appendWorkflowSprintLead(leadPayload, { feedbackDir: FEEDBACK_DIR });
 
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType: 'workflow_sprint_lead_submitted',
@@ -7493,6 +7577,11 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           referrer: lead.attribution.referrer,
         }, req.headers, 'workflow_sprint_lead_submitted');
 
+        const leadNotification = await workflowSprintIntake.notifyWorkflowSprintLead(lead, {
+          sendEmailImpl: resendMailer.sendEmail,
+          rateLimitKey: buildIntakeAlertRateLimitKey(req),
+        });
+
         if (isFormSubmission && !wantsJson(req, parsed)) {
           sendHtml(
             res,
@@ -7513,6 +7602,8 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           status: lead.status,
           offer: lead.offer,
           nextStep: 'review_proof_pack',
+          operatorAlertSent: leadNotification.sent === true,
+          operatorAlertReason: leadNotification.reason || null,
           proofPackUrl: 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
           sprintBriefUrl: 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/WORKFLOW_HARDENING_SPRINT.md',
         }, {
@@ -7520,7 +7611,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           ...(journeyState.setCookieHeaders.length ? { 'Set-Cookie': journeyState.setCookieHeaders } : {}),
         });
       } catch (err) {
-        appendBestEffortTelemetry(FEEDBACK_DIR, {
+        appendBestEffortTelemetry(FEEDBACK_DIR, redactSecretsDeep({
           eventType: 'workflow_sprint_lead_failed',
           clientType: 'web',
           traceId,
@@ -7543,10 +7634,10 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           page: referrerAttribution.page || '/#workflow-sprint-intake',
           landingPath: referrerAttribution.landingPath || '/',
           referrerHost: referrerAttribution.referrerHost,
-          referrer: referrerAttribution.referrer,
-          failureCode: err?.message ? err.message : 'workflow_sprint_lead_failed',
+          referrer: redactSecrets(referrerAttribution.referrer),
+          failureCode: redactSecrets(err?.message ? err.message : 'workflow_sprint_lead_failed'),
           httpStatus: err && err.statusCode ? err.statusCode : null,
-        }, req.headers, 'workflow_sprint_lead_failed');
+        }), redactSecretsDeep(req.headers), 'workflow_sprint_lead_failed');
         if (isFormSubmission && !wantsJson(req, parsed)) {
           sendHtml(
             res,
@@ -7832,6 +7923,15 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           });
           return;
         }
+        if (result && result.retryable === true) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.INTERNAL,
+            title: 'Fulfillment temporarily unavailable',
+            status: 503,
+            detail: 'The payment was received but fulfillment did not complete. Stripe should retry this event.',
+          });
+          return;
+        }
         sendJson(res, 200, result);
 
       } catch (err) {
@@ -7964,16 +8064,24 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         }
 
         const resolvedTraceId = result.traceId || requestedTraceId;
+        const nextSteps = result.apiKey
+          ? {
+            env: `THUMBGATE_API_KEY=${result.apiKey}\nTHUMBGATE_API_BASE_URL=${hostedConfig.billingApiBaseUrl}`,
+            curl: `curl -X POST ${hostedConfig.billingApiBaseUrl}/v1/feedback/capture \\\n+  -H 'Authorization: Bearer ${result.apiKey}' \\\n+  -H 'Content-Type: application/json' \\\n+  -d '{"signal":"down","context":"example","whatWentWrong":"example","whatToChange":"example"}'`,
+          }
+          : result.offerKind === 'workflow_hardening_diagnostic'
+            ? { fulfillment: 'Payment confirmed. Diagnostic fulfillment is processing; an email will arrive when it completes.' }
+            : {};
 
         sendJson(res, 200, {
           ...result,
           traceId: resolvedTraceId || null,
           appOrigin: hostedConfig.appOrigin,
           apiBaseUrl: hostedConfig.billingApiBaseUrl,
-          nextSteps: {
+          nextSteps: result.apiKey ? {
             env: `THUMBGATE_API_KEY=${result.apiKey || ''}\nTHUMBGATE_API_BASE_URL=${hostedConfig.billingApiBaseUrl}`,
             curl: `curl -X POST ${hostedConfig.billingApiBaseUrl}/v1/feedback/capture \\\n  -H 'Authorization: Bearer ${result.apiKey || ''}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{"signal":"down","context":"example","whatWentWrong":"example","whatToChange":"example"}'`,
-          },
+          } : nextSteps,
         }, getPublicBillingHeaders(resolvedTraceId));
       } catch (err) {
         const requestedTraceId = parsed.searchParams.get('traceId') || '';
@@ -9857,6 +9965,7 @@ module.exports = {
     answerEnterpriseDataChat,
     answerEnterpriseDialogflowChat,
     buildLossAnalyticsResponse,
+    buildIntakeAlertRateLimitKey,
     sanitizeHtmlUnsafeJsonValue,
   },
 };