Skip to content

Premium checkout: CoinPay hosted session with URL + QR in the SSH terminal - #156

Merged
ralyodio merged 1 commit into
mainfrom
checkout-sessions
Oct 21, 2026
Merged

ralyodio merged 1 commit into
mainfrom
checkout-sessions

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Moves the $99 Founding Lifetime checkout over SSH join@ to a CoinPay hosted checkout session.

  • POST /api/checkout/sessions with property bbs.profullstack.com, account_id = handle, customer_email = verified email (prompted if missing), metadata {ref, plan, handle, pubkey_fp, user_id, site}. No pinned chain: any coin or PayPal.
  • Terminal shows the session URL plus a QR code of it (rsc.io/qr, half blocks), then polls GET /checkout/sessions/:id every 5s until paid (grants premium, shows perks), Enter, disconnect, or 60 min.
  • VerifyPremium handles cs_ ids and still settles legacy payment ids.
  • Only COINPAY_API_KEY is needed now (the key identifies the business).

Tested: unit tests for the session body + paid/legacy settle; live run of the checkout path against prod CoinPay created cs_FwUWGG4TnRrsYGUJ2z7unCNQ (property bbs.profullstack.com, methods incl. PAYPAL).

🤖 Generated with Claude Code

…minal

join@ now creates a CoinPay checkout session (POST /checkout/sessions) instead
of a single-chain ETH payment: the buyer picks any coin the business accepts or
PayPal. The session URL and a half-block QR code of it are shown in the
terminal, and the session is polled (GET /checkout/sessions/:id) until paid,
Enter, disconnect or expiry. property=bbs.profullstack.com, account_id=handle,
customer_email=the verified email (asked for if none is stored), metadata
carries pubkey fingerprint, user id and the HMAC ref. Legacy payment ids still
verify.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedrsc.io/​qr@​v0.2.010010010075100

View full report

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

10 finding(s)

HIGH/CRITICAL: 7 | LOW: 3

Severity Rule Location
HIGH secret-generic-credential deploy/ergo/ircd.yaml:162
HIGH secret-generic-credential deploy/ergo/ircd.yaml:221
HIGH secret-generic-credential deploy/ergo/ircd.yaml:638
HIGH secret-generic-credential deploy/ergo/ircd.yaml:787
HIGH secret-database-url deploy/ergo/ircd.yaml:893
HIGH secret-generic-credential deploy/ergo/ircd.yaml:1025
HIGH secret-generic-credential deploy/ergo/ircd.yaml:1033
LOW secret-generic-credential deploy/ergo/ircd.yaml:772
LOW tls-verification-disabled internal/mail/mail.go:109
LOW secret-generic-credential internal/mailu/mailu_test.go:44

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 0499cb6 into main Oct 21, 2026
6 checks passed
@ralyodio
ralyodio deleted the checkout-sessions branch October 21, 2026 12:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant