source: Klonkt/src/views/pages/paid-gate.ejs@ d48ea02

main
Last change on this file since d48ea02 was 6cbd014, checked in by Robin <roboburr@…>, 7 weeks ago

Feature: paid posts slice 4, cookie-less per-post unlock

The unlock leg of the paid-posts flow (klonkt-demo-3lz). A supporter who
already made a passkey (slice 3) opens a paid post and unlocks it with a
WebAuthn assertion, no account and no cookie.

  • Cookie-less: GET /paid/challenge hands out authentication options plus a short-lived (300s) signed blob carrying the challenge, the post slug and the post's required cents. The client returns both to POST /paid/unlock; nothing is kept between the two requests.
  • Discoverable credentials: allowCredentials is empty, so the browser offers the site's passkeys and the visitor stays pseudonymous.
  • Gate checks, in order: valid+unexpired entitlement for this passkey and site (else 403 -> the page sends the visitor to /paid/link to register), tier (entitlement cents >= post cents, else 403), then the assertion is verified and the signature counter bumped (clone detection).
  • The full post body is returned in that SAME response (renderPostBodyHtml, extracted from the page pipeline so unlocked HTML matches the normal render exactly). No unlock token becomes state.

Note: injected content covers text, images and external embeds; the
own-hosted audio player binds on load and is not re-initialised in
injected HTML yet (follow-up).

Changed files:
src/routes/posts.js

  • export renderPostBodyHtml (shared by the page and the unlock route)

src/services/PasskeyService.js

  • authenticationOptions, verifyAssertion, bumpCounter

src/routes/paid.js

  • GET /paid/challenge, POST /paid/unlock (cookie-less)

src/views/pages/paid-gate.ejs

  • Ontgrendel button + vendored SimpleWebAuthnBrowser assertion script; swaps the gate for the post on success, links to Patreon on 403

test/paid-unlock.test.js

  • auth options challenge + empty allowCredentials, counter bump, tier gate, expired entitlement not served

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

  • Property mode set to 100644
File size: 4.6 KB
Line 
1<div class="container pg-navwrap">
2 <%- include('../partials/post-nav', { newerPost: (typeof newerPost !== 'undefined' ? newerPost : null), olderPost: (typeof olderPost !== 'undefined' ? olderPost : null) }) %>
3</div>
4
5<article class="pg-page" id="pg-page">
6 <% if (typeof pgTitle !== 'undefined' && pgTitle) { %><h1 class="pg-title"><%= pgTitle %></h1><% } %>
7
8 <% if (typeof pgTeaser !== 'undefined' && pgTeaser) { %>
9 <div class="pg-teaser"><p><%= pgTeaser %></p></div>
10 <% } %>
11
12 <section class="pg-card">
13 <div class="pg-lock">💶</div>
14 <h2 class="pg-h2">Voor supporters</h2>
15 <p class="pg-sub">
16 Deze post is voor supporters van deze site. Steun je de maker op Patreon
17 <% if (typeof pgCents !== 'undefined' && pgCents) { %>(vanaf &euro;<%= (pgCents/100).toFixed(2) %>)<% } %>,
18 dan ontgrendel je 'm met je passkey. Geen account, geen cookie.
19 </p>
20 <button type="button" id="pg-unlock" class="pg-btn">Ontgrendelen</button>
21 <p id="pg-status" class="pg-status" hidden></p>
22 </section>
23</article>
24
25<script src="/assets/vendor/simplewebauthn-browser.umd.min.js" nonce="<%= cspNonce %>"></script>
26<script nonce="<%= cspNonce %>">
27(function () {
28 var base = "<%= (typeof siteUrlBase !== 'undefined' && siteUrlBase ? siteUrlBase : '') %>";
29 var slug = "<%= pgSlug %>";
30 var btn = document.getElementById('pg-unlock');
31 var status = document.getElementById('pg-status');
32 var page = document.getElementById('pg-page');
33 function say(msg, err) { status.hidden = false; status.textContent = msg; status.classList.toggle('is-err', !!err); }
34 function toLink() { location.href = base + '/paid/link?post=' + encodeURIComponent(slug); }
35
36 if (!window.SimpleWebAuthnBrowser || !window.PublicKeyCredential) { btn.textContent = 'Word supporter'; btn.addEventListener('click', toLink); return; }
37
38 btn.addEventListener('click', function () {
39 btn.disabled = true;
40 say('Bevestig met je passkey…');
41 fetch(base + '/paid/challenge?post=' + encodeURIComponent(slug))
42 .then(function (r) { if (!r.ok) throw { link: true }; return r.json(); })
43 .then(function (data) {
44 return window.SimpleWebAuthnBrowser.startAuthentication({ optionsJSON: data.options })
45 .then(function (response) {
46 return fetch(base + '/paid/unlock', {
47 method: 'POST', headers: { 'Content-Type': 'application/json' },
48 body: JSON.stringify({ response: response, blob: data.blob }),
49 });
50 });
51 })
52 .then(function (r) { return r.json().then(function (j) { return { status: r.status, j: j }; }); })
53 .then(function (res) {
54 if (res.j && res.j.ok) {
55 // Swap the gate for the full post, client-side (no cookie kept).
56 var h = document.createElement('div');
57 h.innerHTML = (res.j.title ? '<h1 class="post-title">' + res.j.title + '</h1>' : '') +
58 '<div class="post-content">' + res.j.html + '</div>';
59 page.replaceWith(h);
60 } else if (res.status === 403) {
61 toLink(); // no valid passkey yet (or lapsed tier): link via Patreon
62 } else {
63 btn.disabled = false; say('Ontgrendelen mislukt. Probeer opnieuw.', true);
64 }
65 })
66 .catch(function (e) {
67 if (e && e.link) { toLink(); return; }
68 if (e && e.name === 'NotAllowedError') { toLink(); return; } // cancelled / no passkey -> link
69 btn.disabled = false; say('Er ging iets mis. Probeer opnieuw.', true);
70 });
71 });
72})();
73</script>
74
75<style>
76 .pg-navwrap { max-width: 720px; margin: 0.5rem auto 1.5rem; padding: 0 1rem; }
77 .pg-page { max-width: 720px; margin: 0 auto 3rem; padding: 0 1rem; }
78 .pg-title { font-family: var(--font-display, serif); font-size: clamp(1.6rem, 4vw, 2.2rem); margin: 0 0 1rem; }
79 .pg-teaser { font-family: var(--font-body, serif); font-size: 1.1rem; line-height: 1.7; color: var(--ink); opacity: .95;
80 -webkit-mask-image: linear-gradient(180deg, #000 55%, transparent); mask-image: linear-gradient(180deg, #000 55%, transparent); }
81 .pg-card { margin: 1.5rem 0 0; border: 1px solid color-mix(in srgb, var(--ink, #000) 16%, transparent); border-radius: 18px; padding: 30px 26px; text-align: center; }
82 .pg-lock { font-size: 38px; margin-bottom: 6px; }
83 .pg-h2 { font-size: 22px; margin: 0 0 8px; }
84 .pg-sub { opacity: .85; line-height: 1.6; margin: 0 auto 12px; max-width: 34em; }
85 .pg-btn { padding: 12px 24px; border: none; border-radius: 10px; font: inherit; font-weight: 600; cursor: pointer;
86 background: var(--accent, #6b8f71); color: #fff; }
87 .pg-btn:disabled { opacity: .6; cursor: default; }
88 .pg-status { margin: 12px 0 0; opacity: .9; }
89 .pg-status.is-err { color: #c0392b; }
90</style>
Note: See TracBrowser for help on using the repository browser.