marty/instantadpay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PolHunter return loop: ?from=polhunter sets iap.return (landing + join links), /api/me carries returnTo, Overview card sends them back once a wallet is linked, wallet link answers next=/api/my/polhunter, hand-off clears the cookie

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-19 20:00:55 -05:00
parent ad539d5fae
commit 7ea7a5f409
3 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server.js
+9 -4
View File
@@ -1066,6 +1066,7 @@ const server = http.createServer(async (req, res) => {
const cookieTail = `; Path=/; SameSite=Lax; Max-Age=${30 * 24 * 3600}${IS_PROD ? '; Secure' : ''}`; // 30 days: whoever brings them back gets the credit
const set = [];
set.push('iap.sponsor=' + tok + cookieTail); // last touch wins
if (u.searchParams.get('from') === 'polhunter') set.push('iap.return=polhunter' + cookieTail); // came through a PolHunter share link: send them back after the wallet step
const promo = promos.norm(u.searchParams.get('promo')); if (promo) set.push('iap.promo=' + promo + cookieTail); // partner code, redeemed at signup
if (promo) { const pref = String(req.headers.referer || '').replace(/^https?:\/\//, '').split('/')[0].toLowerCase().slice(0, 80); if (pref) set.push('iap.promoref=' + encodeURIComponent(pref) + cookieTail); } // which partner page it came from
if (ang) set.push('iap.angle=' + angle + cookieTail);
@@ -1379,7 +1380,7 @@ const server = http.createServer(async (req, res) => {
const lr = await accounts.linkWallet(s.email, r.address);
if (lr.error) return json(res, 400, lr);
await auth.updateSession(s.token, { address: r.address, memberId });
return json(res, 200, { ok: true, linked: true, address: r.address, memberId });
return json(res, 200, { ok: true, linked: true, address: r.address, memberId, next: parseCookies(req)['iap.return'] === 'polhunter' ? '/api/my/polhunter' : null });
}
const acct = await accounts.byAddress(r.address);
if (!acct && await accounts.positionOwner(r.address))
@@ -1414,7 +1415,7 @@ const server = http.createServer(async (req, res) => {
const _defSpon = Number(siteConfig().defaultSponsorId) || 1;
if (!sponsorId && memberId !== _defSpon) sponsorId = _defSpon; // orphan fallback → #1 (never self-sponsor)
if (memberId && acct && acct.memberId !== memberId) accounts.setMemberId(acct.email, memberId).catch(() => {});
const out = { signedIn: true, sponsorBlocked, sponsorRouted, sponsorName: spdMe.name || null, email: s.email || (acct && acct.email) || null,
const out = { signedIn: true, returnTo: parseCookies(req)['iap.return'] === 'polhunter' ? 'polhunter' : null, sponsorBlocked, sponsorRouted, sponsorName: spdMe.name || null, email: s.email || (acct && acct.email) || null,
address: s.address || (acct && acct.address) || null, memberId,
username: (acct && acct.username) || null,
refCode: (acct && acct.code) || null, sponsorId,
@@ -2112,7 +2113,7 @@ const server = http.createServer(async (req, res) => {
const b64u = b => Buffer.from(b).toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
const payload = JSON.stringify({ iat: Date.now(), exp: Date.now() + 5 * 60000, nonce: crypto.randomBytes(12).toString('hex'), memberId: Number(memberId), email: s.email, wallet: (acct && acct.address) || s.address || null, username: (acct && acct.username) || null });
const tok = b64u(payload) + '.' + b64u(crypto.createHmac('sha256', secret).update(payload).digest());
res.writeHead(302, { Location: huntUrl + '/auth?t=' + tok, 'Cache-Control': 'no-store' }); return res.end();
res.writeHead(302, { Location: huntUrl + '/auth?t=' + tok, 'Cache-Control': 'no-store', 'Set-Cookie': 'iap.return=; Path=/; SameSite=Lax; Max-Age=0' + (IS_PROD ? '; Secure' : '') }); return res.end(); // the loop is closed
}
if (p === '/api/my/claim' && req.method === 'POST') {
const s = await auth.fromRequest(req);
@@ -3068,7 +3069,11 @@ const server = http.createServer(async (req, res) => {
// -- pages (HEAD answered like GET so link previewers and crawlers see 200; Node drops the body)
if (req.method === 'GET' || req.method === 'HEAD') {
if (p === '/') return sendFile(res, path.join(PUBLIC_DIR, 'index.html'));
if (p === '/') {
// arrived from PolHunter: remember it for 30 days so the dashboard can send them back once a wallet is linked
if (u.searchParams.get('from') === 'polhunter') { res.writeHead(302, { Location: '/', 'Set-Cookie': 'iap.return=polhunter; Path=/; SameSite=Lax; Max-Age=' + (30 * 24 * 3600) + (IS_PROD ? '; Secure' : ''), 'Cache-Control': 'no-store' }); return res.end(); }
return sendFile(res, path.join(PUBLIC_DIR, 'index.html'));
}
if (p === '/ledger') return sendFile(res, path.join(PUBLIC_DIR, 'ledger.html'));
if (p === '/contract') return sendFile(res, path.join(PUBLIC_DIR, 'contract.html'));
if (p === '/terms') return sendFile(res, path.join(PUBLIC_DIR, 'terms.html'));