Repository navigation
Hosted: the website's checkout switch and the public founders row - #1408
Merged
Merged
Conversation
Deploying mouseterm with
|
| Latest commit: |
1dd5292
|
| Status: | ⚡️ Build in progress... |
dormouse-bot
approved these changes
Oct 28, 2026
This was referenced Oct 28, 2026
…red cohort CHECKOUT_OPEN (committed false) turns the buy buttons into links to the account app's /checkout?plan=, carrying the visit's ref, and the JSON-LD offers from PreOrder to InStock. The yearly tier's id is now "yearly", the plan name checkout and billing use. The founding card drops seats left unless the endpoint's cohort is the one whose price it prerendered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GET /api/hosted/cohorts on the account Worker answers the open cohort, its seats left, and the founders row (opted-in founders whose founding subscription still holds, by shownSince, at most 40), cached 60 s per isolate and resolving no login. Each shown founder's picture is served under a token at /api/hosted/founders/, fetched only from a provider's picture host or a raster data URL, never through a redirect, and checked as PNG, JPEG, GIF, or WebP by its bytes. The site's Pages Worker forwards GET and HEAD under /api/hosted/ to the account's own origin with nothing of the reader's, so the 421 gate needs no exception. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pricing.md moves the cohort endpoint above the fold, states the switch (PreOrder/InStock, the buy button's two states) and the seats-only-for- the-prerendered-cohort rule; opening checkout is now the Stripe bindings then CHECKOUT_OPEN. hosted.md adds the two public routes and the forward from dormouse.sh; website-docs.md widens the site Worker to /api/hosted/*. security-hosted.md adds FAIL IF S288 (next is 289) and the audit prompt reads the site's Worker. Privacy says the picture is fetched from the provider, and only when it supplied one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nedtwigg
force-pushed
the
hosted-billing-launch
branch
from
October 29, 2026 00:06
359bc3c to
1dd5292
Compare
This was referenced Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Billing PR 4a, stacked on #1407. Billing stays closed:
CHECKOUT_OPENisfalseand noSTRIPE_*bindings are set.CHECKOUT_OPENis false, the buy buttons keep today's notice. Once true, they link to the account app's/checkout?plan=carrying the visit'sref, thehosted plan clickedevent still fires, and the JSON-LD offers change fromPreOrdertoInStock. Tierannualis renamedyearlyto match the server's plan names.hosted/server/cohort-routes.ts):GET /api/hosted/cohortsreturns{cohort?, seatsLeft?, founders: {total, shown}}.totalcounts founding purchases net of refunds.shownholds at most 40 founders who opted in and whose founding subscription still holds, ordered byshownSince. Answers are cached 60 s per isolate, and the route cannot read a login.GET /api/hosted/founders/<sha256 token>serves founder avatars server-side, so a visitor's browser never asks a sign-in provider for them. It fetches only https URLs on the GitHub or Google picture hosts, or rasterdata:URLs (Microsoft stores those). It never follows a redirect, caps the size at 256 KiB, and serves only PNG, JPEG, GIF or WebP, judged by the file's leading bytes._worker.jsand_routes.json, from Website: cookieless PostHog visit counts #1401) now also forwards GET and HEAD underdormouse.sh/api/hosted/*tohttps://hosted.dormouse.sh. It drops cookies, credentials, the reader's address and the query string, and passes back only content type, length and caching headers. The proxy fetches the account's own origin, so the 421 gate (S77) needs no exception.fetcha Custom-Domain Worker in the same zone. Cloudflare documents that it can, but it hasn't been tested live.pricing.md,hosted.md,website-docs.md, the audit prompt, and FAIL IFS288insecurity-hosted.md. Privacy now says the founder picture is fetched from the provider, and only shown if the provider supplied one.🤖 Generated with Claude Code