mirror of
https://github.com/hanzoai/agency.git
synced 2026-11-02 19:13:28 +00:00
zeekay
f8a1fcfcc1
The onboarding checkout POSTed the mint straight from the browser to commerce /v1/checkout/sessions. commerce v1.46.4 (P0) closed that anonymous path, so the browser POST now 401s and checkout is broken. Fix: a small stdlib-only Go server (server/) serves the embedded Vite SPA AND a single server-side checkout entry POST /v1/checkout. The browser holds no token and can choose no org/price/redirect — it only names a plan. The BFF calls commerce with a per-org Published storefront token from KMS; org is derived from the token, prices from the server-side plans map, success/cancel URLs from PUBLIC_BASE_URL (https://hanzo.agency). Fails closed (503) without the token — never an anon mint. - server/main.go, checkout.go, spa.go, embed.go — BFF + SPA server - server/checkout_test.go — authed mint, no client override, fail-closed, wire - src/lib/commerce.ts — browser now calls same-origin /v1/checkout - Dockerfile — node build (dist) -> go build (embed) -> alpine - pairs with commerce v1.46.7 (adds hanzo.agency to the redirect allowlist)
9 lines
352 B
HTML
9 lines
352 B
HTML
<!doctype html>
|
|
<!-- Placeholder. Overwritten at docker build time by the Vite `dist/` output
|
|
(see Dockerfile). Committed so `go build`/`go test` compile the embed
|
|
locally without a prior `pnpm build`. -->
|
|
<html lang="en">
|
|
<head><meta charset="utf-8" /><title>Hanzo Agency</title></head>
|
|
<body>agency SPA build placeholder</body>
|
|
</html>
|