Commit graph

59 commits

Author SHA1 Message Date
Autowebassat-blip
e89c10cc80
Reject malformed CoinPay webhook signatures (#41)
* Reject malformed CoinPay webhook signatures

* Fix webhook signature type guard

---------

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:56:12 -07:00
FuturMix
f8040e9736
fix(auth): remove hardcoded fallback session secret (fixes #59) (#60) 2026-06-13 22:51:24 -07:00
FuturMix
5cfece3b84
fix(auth): use base64url encoding in session signature verification (fixes #64) (#67) 2026-06-13 22:44:53 -07:00
Autowebassat-blip
9ed98ceaf7
Accept spaced CoinPay signature parts (#17) 2026-06-11 21:04:41 -07:00
Autowebassat-blip
d558554da3
Reject extra session token segments (#18) 2026-06-11 21:04:25 -07:00
74abf8985f feat(web): og:image, /pricing + FAQ schema, llms-full.txt, GitHub nav
More AEO audit fixes (the content-independent quick wins):

- Generated 1200x630 OpenGraph/Twitter card (app/opengraph-image.tsx);
  drop the SVG fallback and use summary_large_image.
- /pricing page with question-style headings and FAQPage JSON-LD; clarifies
  the spec/tooling is free and implementation is $250/week.
- /llms-full.txt — full markdown of the curated docs concatenated for
  large-context RAG ingestion.
- GitHub link added to both navs (SPA rail + SiteShell) and Pricing nav item;
  /pricing added to the sitemap.

Verified in a running build: og image renders as PNG and is referenced in
head; /pricing serves FAQ + schema; /llms-full.txt concatenates docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:51:51 +00:00
fb20fd2e99 feat(web): real /about and /docs pages (unique crawlable content)
Addresses the top cross-engine AEO finding — every route previously served
the homepage SPA. /about and /docs are now distinct routes with their own
server-rendered content and titles.

- /about: substantive about page (what LogicSRC is, the standards surface,
  CommandBoard.run reference impl, GitHub, hire-us) — derived from public
  positioning, no fabricated team.
- /docs + /docs/[slug]: render the repo's docs/*.md (curated public set) via
  marked, statically generated at build (no runtime fs dependency).
- Drop about/docs from the catch-all; add doc URLs to the sitemap.

Verified in a running build: /about and /docs serve unique content with
distinct titles; /docs/[slug] renders each markdown doc.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:43:42 +00:00
cf99e93c53 feat(web): blog-post ingestion webhook + /blog, dynamic RSS & sitemap
Add an autoblog webhook receiver and a Supabase-backed blog to logicsrc-web
(the app had no Supabase usage before).

- Migration: blog_posts table (RLS: public reads published, service-role
  writes). Applied to the linked project.
- POST /api/webhooks/blog: verifies the Standard Webhooks signature against
  BLOG_WEBHOOK_SECRET via @profullstack/autoblog verifyAndParse (no admin
  user — shared secret only) and upserts the post by slug.
- /blog index + /blog/[slug] render published posts from the table.
- /blog/rss.xml and /sitemap.xml are now dynamic, generated from the table;
  removed the static public/sitemap.xml and public/blog/rss.xml.
- BLOG_WEBHOOK_SECRET added to .env.example.

Verified end-to-end: a signed sample post delivered 200 and appeared in the
index, post page, RSS, and sitemap; build + typecheck pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 11:53:43 +00:00
f0a9f3890e Migrate logicsrc-web from Vite SPA to Next.js 16 App Router
Replaces the Vite single-page app + custom Node server.js with a Next.js
16.2.6 App Router app.

- proxy.ts (src/proxy.ts): www.logicsrc.com -> logicsrc.com 301 over https,
  preserving path + query (the original request, now via Next 16 Proxy).
- One SSR page via an optional catch-all ([[...slug]]) that renders the same
  marketing/spec page for each known top-level route (/docs, /blog, /openspec,
  ...) and 404s unknown paths, preserving existing canonical URLs. Markup is a
  faithful server-rendered port of the old main.ts (SEO upgrade over the prior
  client render); interactivity (hire-us form, CoinPay button, section scroll)
  moves to a client component.
- API routes ported to app/api/**: hire-us coinpay-checkout + project-request,
  oauth/coinpay start/callback/session, webhooks/coinpay. Shared logic in
  src/lib/coinpay.ts (eligibility, payment-rail selection, webhook verify,
  HMAC session sign/verify, cookies).
- commandboard-api (/health + /api/boards|tasks|plugins/*) is no longer mounted
  in-process; next.config.ts proxies those paths to COMMANDBOARD_API_URL via
  afterFiles rewrites (our own /api routes match first).
- Build/start switch to next build / next start. Contract tests rewritten to
  exercise proxy.ts, the route handlers, and pure helpers directly (21 passing);
  Playwright webServer updated.

Deployment (Railway): set COMMANDBOARD_API_URL to the commandboard-api service
URL and run it as its own service; root start now runs next start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-07 03:41:48 +00:00