zeekay f8a1fcfcc1 feat(checkout): server-side BFF to close P0 anon-mint regression — 0.1.1 ...

The onboarding checkout POSTed the mint straight from the browser to commerce
/v1/checkout/sessions. commerce v1.46.4 (P0) closed that anonymous path, so the
browser POST now 401s and checkout is broken.

Fix: a small stdlib-only Go server (server/) serves the embedded Vite SPA AND a
single server-side checkout entry POST /v1/checkout. The browser holds no token
and can choose no org/price/redirect — it only names a plan. The BFF calls
commerce with a per-org Published storefront token from KMS; org is derived from
the token, prices from the server-side plans map, success/cancel URLs from
PUBLIC_BASE_URL (https://hanzo.agency). Fails closed (503) without the token —
never an anon mint.

- server/main.go, checkout.go, spa.go, embed.go — BFF + SPA server
- server/checkout_test.go — authed mint, no client override, fail-closed, wire
- src/lib/commerce.ts — browser now calls same-origin /v1/checkout
- Dockerfile — node build (dist) -> go build (embed) -> alpine
- pairs with commerce v1.46.7 (adds hanzo.agency to the redirect allowlist)

2026-07-02 07:23:18 -07:00

..

index.html

feat(checkout): server-side BFF to close P0 anon-mint regression — 0.1.1

2026-07-02 07:23:18 -07:00