Repository navigation
Checkout recovery: every CoinPay coin + PayPal, tagged payments, one-click finish - #105
Merged
Merged
Conversation
…click finish
- Offer every coin CoinPay has live for the business (GET /api/supported-coins,
cached 10 min, static fallback): adds USDC_BASE, BCH, DOGE, XRP, ADA, BNB and
USDT_TRON once CoinPay enables it. PayPal gets its own prominent tile.
- Every payment carries metadata { property: smshub.dev, order_id, user_id,
kind, email, customer_email }; PayPal also gets customer_email top level.
- Prefer CoinPay hosted checkout sessions (POST /api/checkout/sessions) when
CoinPay has them, feature-detected, with the direct payment as fallback.
- Webhook maps a payment back by metadata (order_id + user_id) when its id is
unknown (session payments), and refuses a user mismatch.
- POST /api/numbers/orders/:id/reopen: an expired unpaid order reopens as a
fresh 60-minute checkout with the same terms, optionally on PayPal. "Finish
your order" banner on /numbers and the inbox.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const j = await res.json().catch(() => ({})); | ||
| if (!res.ok) throw new Error(j.error || "Could not reopen the checkout"); | ||
| const pay = safePayUrl(j.order?.pay_url); | ||
| window.location.href = pay || "/numbers"; |
ThreatCrush Security Scan12 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 6
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Revenue audit 2026-10-21: 30 number orders since Oct 5, 27 expired unpaid.
expires_in_minutes: 60, fix(numbers): 60-minute CoinPay checkout window #94). Confirmed in CoinPay's payments rows: every smshub payment since 2026-10-17 12:30Z has a 60 min window. Also sent on hosted sessions.GET /api/supported-coins, 10 min cache, static fallback). Adds USDC_BASE, BCH, DOGE, XRP, ADA, BNB (and USDT_TRON automatically once CoinPay turns it on). /numbers has two tiles, PayPal first ("No crypto needed"), Crypto with a coin picker. No Stripe.{ property: "smshub.dev", order_id, user_id, kind, email, customer_email }; the PayPal rail also gets top-levelcustomer_email. The webhook maps by payment id, then by metadata (order_id + user_id) for payments it never saw the id of (session payments), and refuses a user mismatch.POST /api/numbers/orders/:id/reopenreopens an expired unpaid order as a fresh checkout with the same terms, optionally switching to PayPal; returns the open checkout instead of a second one. "Finish your order" banner on /numbers and in the inbox, plus "Pay with PayPal instead". No finish-your-order email: the app has no transactional email system (only GoTrue auth mail), so skipped.Also: prefers CoinPay hosted checkout sessions (
POST /api/checkout/sessions) when CoinPay serves them, feature-detected (today it answers its HTML 404 page, so the direct payment is used and the probe backs off 15 min).Tests: 303 pass (new: chain discovery, metadata, session preference and fallback, metadata-mapped settlement, reopen, recovery helper); tsc, eslint and next build clean.
🤖 Generated with Claude Code