mirror of
https://github.com/hanzoai/agency.git
synced 2026-11-02 19:13:28 +00:00
zeekay
f8a1fcfcc1
The onboarding checkout POSTed the mint straight from the browser to commerce /v1/checkout/sessions. commerce v1.46.4 (P0) closed that anonymous path, so the browser POST now 401s and checkout is broken. Fix: a small stdlib-only Go server (server/) serves the embedded Vite SPA AND a single server-side checkout entry POST /v1/checkout. The browser holds no token and can choose no org/price/redirect — it only names a plan. The BFF calls commerce with a per-org Published storefront token from KMS; org is derived from the token, prices from the server-side plans map, success/cancel URLs from PUBLIC_BASE_URL (https://hanzo.agency). Fails closed (503) without the token — never an anon mint. - server/main.go, checkout.go, spa.go, embed.go — BFF + SPA server - server/checkout_test.go — authed mint, no client override, fail-closed, wire - src/lib/commerce.ts — browser now calls same-origin /v1/checkout - Dockerfile — node build (dist) -> go build (embed) -> alpine - pairs with commerce v1.46.7 (adds hanzo.agency to the redirect allowlist)
24 lines
594 B
Go
24 lines
594 B
Go
package main
|
|
|
|
import (
|
|
"embed"
|
|
"io/fs"
|
|
)
|
|
|
|
// staticFS holds the built Vite SPA. At docker build time the Vite output
|
|
// (dist/) is copied into ./static, overwriting the committed placeholder
|
|
// index.html. `all:` includes files whose names start with "_" or "." so
|
|
// Vite's hashed assets under _assets/ are embedded too.
|
|
//
|
|
//go:embed all:static
|
|
var staticFS embed.FS
|
|
|
|
// spaFS returns the embedded SPA rooted at the static/ directory.
|
|
func spaFS() fs.FS {
|
|
sub, err := fs.Sub(staticFS, "static")
|
|
if err != nil {
|
|
panic("agency: embedded static/ missing: " + err.Error())
|
|
}
|
|
return sub
|
|
}
|