Changeset 9e9e6f9 in Klonkt for src

Timestamp:

07/21/2026 01:16:03 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

d43230f

Parents:

928d1c7

git-author:

Robin <roboburr@…> (07/21/2026 01:15:39 AM)

git-committer:

Robin <roboburr@…> (07/21/2026 01:16:03 AM)

Message:

Feature: paid posts slice 3, patron link + passkey (cookie-less)

The registration leg of the paid-posts flow (klonkt-demo-aki). A
visitor links once via Patreon and gets a pseudonymous passkey entitlement,
with no session and no patron identity stored.

• Dependency (approved): @simplewebauthn/server for verification, plus @simplewebauthn/browser vendored (UMD) so the page loads it with no CDN.
• New paid_entitlements table: {passkey, site, proven cents, expiry}. No name, e-mail or Patreon id, ever.
• Cookie-less throughout: the OAuth state and the WebAuthn challenge travel in signed blobs (CryptoBox), so nothing is kept between requests.
• Flow: GET /paid/link -> Patreon authorize; GET /paid/callback verifies the patron (verifyPatron exchanges the code, reads identity?include=memberships.campaign, checks patron_status + currently_entitled_amount_cents against the post's price), then hands out registration options + a signed blob carrying the challenge and proven cents; POST /paid/register verifies the passkey and stores the entitlement. The patron token is used once and discarded.

The gate button and the per-post unlock (assertion) are slice 4; this
leg is what that flow calls to register a passkey on demand.

Changed files:
package.json, package-lock.json

• @simplewebauthn/server + @simplewebauthn/browser

src/assets/vendor/simplewebauthn-browser.umd.min.js

• vendored browser UMD (no CDN)

src/config/database.js

• paid_entitlements table (no patron identity)

src/services/PaidPatreonService.js

• pickCampaignMembership (pure), verifyPatron (exchange + identity)

src/server.js

• mount /paid before the /:slug catch-all

New file:
src/services/PasskeyService.js

• registration options + verify (lib) + entitlement store/prune

src/routes/paid.js

• link / callback / register (cookie-less)

src/views/pages/paid-passkey.ejs, paid-result.ejs

• passkey creation + not-a-supporter pages

test/paid-patron.test.js

• membership parse, patron exchange (mock), options challenge, entitlement store/expiry/prune/delete, no-identity-columns

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Location:

src

Files:

• assets/vendor/simplewebauthn-browser.umd.min.js (added)
• config/database.js (modified) (1 diff)
• routes/paid.js (added)
• server.js (modified) (2 diffs)
• services/PaidPatreonService.js (modified) (2 diffs)
• services/PasskeyService.js (added)
• views/pages/paid-passkey.ejs (added)
• views/pages/paid-result.ejs (added)

src/config/database.js

@@ -323 +323 @@
       default_min_cents INTEGER DEFAULT 0,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+    );
+    -- One row per passkey. NO patron identity is stored (design decision):
+    -- {passkey, site, proven cents, expiry}. Not traceable to a person.
+    CREATE TABLE IF NOT EXISTS paid_entitlements (
+      credential_id TEXT PRIMARY KEY,   -- WebAuthn credential id (opaque, base64url)
+      site_id TEXT NOT NULL,
+      public_key TEXT NOT NULL,         -- COSE public key, base64url
+      counter INTEGER DEFAULT 0,
+      transports TEXT,
+      min_cents INTEGER DEFAULT 0,      -- the amount proven at link time
+      expires_at INTEGER NOT NULL,      -- unix seconds; re-link after
+      created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
     CREATE TABLE IF NOT EXISTS ap_outbox (

src/server.js

@@ -41 +41 @@
 import feedRoutes from './routes/feed.js';
 import postsRoutes from './routes/posts.js';
+import paidRoutes from './routes/paid.js';
 import langRoutes from './routes/lang.js';
 import adminUpdatesRoutes from './routes/admin-updates.js';
@@ -400 +401 @@
 app.use('/', changelogRoutes); // /changelog publieke release-/wijzigingen-pagina
 app.use('/', langRoutes); // /lang/:code — interface-taal kiezen (vóór de catch-all)
+app.use('/paid', paidRoutes);   // paid-posts patron/passkey flow (before the /:slug catch-all)
 app.use('/', postsRoutes);
 

src/services/PaidPatreonService.js

@@ -124 +124 @@
 }
 
+// Pure: pick the membership for the owner's campaign out of a Patreon
+// identity?include=memberships.campaign response (JSON:API). Returns
+// { status, cents } or null.
+export function pickCampaignMembership(identity, campaignId) {
+  const inc = (identity && identity.included) || [];
+  for (const it of inc) {
+    if (it.type !== 'member') continue;
+    const camp = it.relationships && it.relationships.campaign && it.relationships.campaign.data;
+    if (!camp || String(camp.id) !== String(campaignId)) continue;
+    const a = it.attributes || {};
+    return { status: a.patron_status || null, cents: a.currently_entitled_amount_cents || 0 };
+  }
+  return null;
+}
+
+// Exchange a patron's auth code and read their membership of the owner's
+// campaign. Returns { status, cents } or null. The patron token is used once
+// and discarded here: nothing identifying is stored (design decision).
+export async function verifyPatron(siteId, code, redirectUri, fetchImpl = fetch) {
+  const c = getOwnerConfig(siteId);
+  if (!c || !c.clientId || !c.clientSecret || !c.campaignId) return null;
+  const tokenRes = await fetchImpl(TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code', code,
+      client_id: c.clientId, client_secret: c.clientSecret, redirect_uri: redirectUri,
+    }).toString(),
+  });
+  if (!tokenRes.ok) return null;
+  const tok = await tokenRes.json();
+  if (!tok || !tok.access_token) return null;
+  const url = 'https://www.patreon.com/api/oauth2/v2/identity'
+    + '?include=memberships.campaign'
+    + '&fields%5Bmember%5D=patron_status,currently_entitled_amount_cents';
+  const idRes = await fetchImpl(url, { headers: { Authorization: `Bearer ${tok.access_token}` } });
+  if (!idRes.ok) return null;
+  const identity = await idRes.json();
+  return pickCampaignMembership(identity, c.campaignId);   // token goes out of scope, discarded
+}
+
 function safeDecrypt(blob) {
   try { return decrypt(blob); } catch { return null; }
@@ -131 +172 @@
   getOwnerConfig, ownerStatus, saveOwnerConfig, disconnect,
   defaultMinCents, needsRefresh, refreshCreatorToken, creatorAccessToken,
+  pickCampaignMembership, verifyPatron,
 };