bedbb8c008
Stripe wired to the Phase-A mechanism. Live prices verified READ-ONLY; no Stripe object was created and no payment was run. B1 PRICE KEY -> ID + BOOT ASSERTION (src/config/stripePrices.js). claim_founder_slot returns a price KEY; this module is the only place a key becomes a Stripe id, and it reads env (legacy STRIPE_PRICE_ANALYST/DESK accepted as fallbacks so an existing deploy keeps working). assertPricesConfigured() is wired into server.js and FAILS BOOT when any of the four is unset — verified by deleting one: it throws "BOOT FAILED - unset Stripe price env for: desk_founder". A blank price can no longer sell at the wrong rate or 503 a customer at checkout. B2 CHECKOUT CLAIMS BEFORE CREATING THE SESSION. resolveCheckoutPrice previously called founderSeatsAvailable() — a COUNT read, which WAS the race (two checkouts at seat 99 both read 99, both got founder). It now calls claim_founder_slot and uses the returned key. The promo-code bypass is retired: founderCode no longer influences price or metadata, and getPriceId THROWS if handed a code rather than silently granting a founder rate. metadata.is_founder is renamed is_founder_audit and the webhook no longer reads it — caller-supplied metadata must never decide who pays the lifetime founder price. TRANSIENT-FAILURE POLICY (a real design call, not a default): if the claim RPC errors we now fail RETRYABLY (503 claim_failed) instead of silently selling at standing. Both silent options are irreversible — standing permanently overcharges someone who was entitled to founder, and granting founder without a slot pushes past the 100 cap at permanent prices. A full cap is NOT an error and still returns standing normally, per "never error to the customer": a full cap is a real answer, a DB blip is not. B3 WEBHOOK FINALIZES THROUGH THE SINGLE WRITER. checkout.session.completed calls finalize_founder_slot, which flips user_profiles.founder_pricing (canonical) and mirrors users.founder_status in the SAME txn, so they cannot drift again (they already had, 1 vs 0). Verify-after-write re-reads the profile and logs the end state. If finalize errors, the tier is still set so a PAID customer is never left unentitled, but no founder flag is guessed. B4 SIGNATURE VERIFICATION was already present (constructEvent with STRIPE_WEBHOOK_SECRET + express.raw). The live endpoint exists and is enabled: https://api.vyndr.app/api/stripe/webhook subscribing checkout.session.completed, customer.subscription.created/updated/deleted, invoice.payment_succeeded/failed. VERIFICATION: V1 boot assertion proven by simulation. V2 all four prices retrieved live and confirmed active with correct amounts and monthly recurrence (14.99 / 24.99 / 44.99 / 59.99) — read-only, nothing created. V3 no code path grants founder except the claim (greps clean; the legacy helper now throws). V4 the handler reads customer/subscription/metadata.user_id and calls finalize with signature verification in place. V5 reset to a pristine 100 free / 0 claimed baseline with both founder flags at 0. Secrets live only in .env (0600, gitignored, untracked). A pre-commit scan confirmed NO tracked file contains the key material. Floor: 320 suites / 3984 passed, 3 skipped (superseded founder-code tests), web build exit 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QJs13VsyiSKYQP6rj3NNmc
49 lines
2.5 KiB
JavaScript
49 lines
2.5 KiB
JavaScript
// Session 65 (§A4) — preflight BEFORE anything else prints, so the container's
|
|
// state (content present? critical env present? cron armed?) is the first
|
|
// thing in the logs, not something inferred after a silent rollback.
|
|
require('./preflight').runPreflight();
|
|
|
|
const app = require('./app');
|
|
// B1 — fail boot loudly if any Stripe price env is unset. A blank price would
|
|
// otherwise sell at the wrong rate or 503 checkout in front of a customer.
|
|
require('./config/stripePrices').assertPricesConfigured();
|
|
// Session 20 — surface which providers are actually configured at
|
|
// boot. A silently-missing key (e.g. ODDSPAPI_KEY unset in prod)
|
|
// otherwise only manifests when the gateway tries to fall over and
|
|
// finds no chain.
|
|
const { getConfiguredProviders, listProviderIds } = require('./config/providers');
|
|
// Session 24 — warm the Tank01 cache after boot so streaks / hot lists /
|
|
// game lines have data on the first page load. Non-blocking; see module.
|
|
const { scheduleStartupPrefetch } = require('./startupPrefetch');
|
|
// Session 45 — in-process snapshot cron (gated on SNAPSHOT_CRON=1).
|
|
const { startSnapshotScheduler } = require('./snapshotScheduler');
|
|
const { startBackupScheduler } = require('./backupScheduler');
|
|
|
|
// Default 3001 — Next.js owns 3000 locally and in production. The poller,
|
|
// internal cron, and BASE_URL conventions all assume 3001 for the Express
|
|
// backend. PORT env still overrides for special-case deploys.
|
|
const PORT = process.env.PORT || 3001;
|
|
|
|
app.listen(PORT, () => {
|
|
console.log(`[VYNDR] Server running on port ${PORT}`);
|
|
const configured = getConfiguredProviders();
|
|
const missing = listProviderIds().filter((id) => !configured.find((c) => c.id === id));
|
|
console.log(`[VYNDR] providers configured (${configured.length}): ${configured.map((c) => c.id).join(', ') || 'none'}`);
|
|
if (missing.length) {
|
|
console.warn(`[VYNDR] providers missing keys: ${missing.join(', ')}`);
|
|
}
|
|
|
|
// Session 24 — fire-and-forget cache warm. 5s delay so Redis is ready.
|
|
// Skips itself when RAPID_API_KEY is unset; never blocks or crashes boot.
|
|
scheduleStartupPrefetch();
|
|
|
|
// Session 45 — arm the snapshot cron (no-op unless SNAPSHOT_CRON=1).
|
|
startSnapshotScheduler();
|
|
|
|
// Session 64 — arm the NIGHTLY BACKUP. Opt-OUT (armed whenever
|
|
// SUPABASE_DB_URL exists; BACKUP_CRON=0 kills it). The host cron was written
|
|
// in S62 and never installed, so the database went unbacked every night;
|
|
// shipping it as code means deploy == installed.
|
|
startBackupScheduler();
|
|
});
|