Files
vyndr/src/server.js
T
builtbykev bedbb8c008 Build 2 Phase B: checkout claims atomically, webhook finalizes, bypass retired
Stripe wired to the Phase-A mechanism. Live prices verified READ-ONLY; no
Stripe object was created and no payment was run.

B1 PRICE KEY -> ID + BOOT ASSERTION (src/config/stripePrices.js). claim_founder_slot
returns a price KEY; this module is the only place a key becomes a Stripe id, and
it reads env (legacy STRIPE_PRICE_ANALYST/DESK accepted as fallbacks so an existing
deploy keeps working). assertPricesConfigured() is wired into server.js and FAILS
BOOT when any of the four is unset — verified by deleting one: it throws
"BOOT FAILED - unset Stripe price env for: desk_founder". A blank price can no
longer sell at the wrong rate or 503 a customer at checkout.

B2 CHECKOUT CLAIMS BEFORE CREATING THE SESSION. resolveCheckoutPrice previously
called founderSeatsAvailable() — a COUNT read, which WAS the race (two checkouts
at seat 99 both read 99, both got founder). It now calls claim_founder_slot and
uses the returned key. The promo-code bypass is retired: founderCode no longer
influences price or metadata, and getPriceId THROWS if handed a code rather than
silently granting a founder rate. metadata.is_founder is renamed is_founder_audit
and the webhook no longer reads it — caller-supplied metadata must never decide
who pays the lifetime founder price.

TRANSIENT-FAILURE POLICY (a real design call, not a default): if the claim RPC
errors we now fail RETRYABLY (503 claim_failed) instead of silently selling at
standing. Both silent options are irreversible — standing permanently overcharges
someone who was entitled to founder, and granting founder without a slot pushes
past the 100 cap at permanent prices. A full cap is NOT an error and still returns
standing normally, per "never error to the customer": a full cap is a real answer,
a DB blip is not.

B3 WEBHOOK FINALIZES THROUGH THE SINGLE WRITER. checkout.session.completed calls
finalize_founder_slot, which flips user_profiles.founder_pricing (canonical) and
mirrors users.founder_status in the SAME txn, so they cannot drift again (they
already had, 1 vs 0). Verify-after-write re-reads the profile and logs the end
state. If finalize errors, the tier is still set so a PAID customer is never left
unentitled, but no founder flag is guessed.

B4 SIGNATURE VERIFICATION was already present (constructEvent with
STRIPE_WEBHOOK_SECRET + express.raw). The live endpoint exists and is enabled:
https://api.vyndr.app/api/stripe/webhook subscribing checkout.session.completed,
customer.subscription.created/updated/deleted, invoice.payment_succeeded/failed.

VERIFICATION: V1 boot assertion proven by simulation. V2 all four prices retrieved
live and confirmed active with correct amounts and monthly recurrence (14.99 /
24.99 / 44.99 / 59.99) — read-only, nothing created. V3 no code path grants founder
except the claim (greps clean; the legacy helper now throws). V4 the handler reads
customer/subscription/metadata.user_id and calls finalize with signature
verification in place. V5 reset to a pristine 100 free / 0 claimed baseline with
both founder flags at 0.

Secrets live only in .env (0600, gitignored, untracked). A pre-commit scan
confirmed NO tracked file contains the key material.

Floor: 320 suites / 3984 passed, 3 skipped (superseded founder-code tests), web
build exit 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QJs13VsyiSKYQP6rj3NNmc
2026-07-31 18:42:44 -04:00

49 lines
2.5 KiB
JavaScript

// Session 65 (§A4) — preflight BEFORE anything else prints, so the container's
// state (content present? critical env present? cron armed?) is the first
// thing in the logs, not something inferred after a silent rollback.
require('./preflight').runPreflight();
const app = require('./app');
// B1 — fail boot loudly if any Stripe price env is unset. A blank price would
// otherwise sell at the wrong rate or 503 checkout in front of a customer.
require('./config/stripePrices').assertPricesConfigured();
// Session 20 — surface which providers are actually configured at
// boot. A silently-missing key (e.g. ODDSPAPI_KEY unset in prod)
// otherwise only manifests when the gateway tries to fall over and
// finds no chain.
const { getConfiguredProviders, listProviderIds } = require('./config/providers');
// Session 24 — warm the Tank01 cache after boot so streaks / hot lists /
// game lines have data on the first page load. Non-blocking; see module.
const { scheduleStartupPrefetch } = require('./startupPrefetch');
// Session 45 — in-process snapshot cron (gated on SNAPSHOT_CRON=1).
const { startSnapshotScheduler } = require('./snapshotScheduler');
const { startBackupScheduler } = require('./backupScheduler');
// Default 3001 — Next.js owns 3000 locally and in production. The poller,
// internal cron, and BASE_URL conventions all assume 3001 for the Express
// backend. PORT env still overrides for special-case deploys.
const PORT = process.env.PORT || 3001;
app.listen(PORT, () => {
console.log(`[VYNDR] Server running on port ${PORT}`);
const configured = getConfiguredProviders();
const missing = listProviderIds().filter((id) => !configured.find((c) => c.id === id));
console.log(`[VYNDR] providers configured (${configured.length}): ${configured.map((c) => c.id).join(', ') || 'none'}`);
if (missing.length) {
console.warn(`[VYNDR] providers missing keys: ${missing.join(', ')}`);
}
// Session 24 — fire-and-forget cache warm. 5s delay so Redis is ready.
// Skips itself when RAPID_API_KEY is unset; never blocks or crashes boot.
scheduleStartupPrefetch();
// Session 45 — arm the snapshot cron (no-op unless SNAPSHOT_CRON=1).
startSnapshotScheduler();
// Session 64 — arm the NIGHTLY BACKUP. Opt-OUT (armed whenever
// SUPABASE_DB_URL exists; BACKUP_CRON=0 kills it). The host cron was written
// in S62 and never installed, so the database went unbacked every night;
// shipping it as code means deploy == installed.
startBackupScheduler();
});