mirror of
https://github.com/Such-Software/bauhaus-echo-web.git
synced 2026-10-17 05:51:24 +02:00
jwinterm
c5dcf5cd2b
- app-config.js: public config placeholder (all null/false -> INERT). Operations populates OIDC client + shop tenant + checkout URL at deploy; no secrets. - checkout.js: Authorization Code + S256 PKCE (public client, no secret), state CSRF guard, token in sessionStorage, code/state scrubbed from URL. Resolves premium via the ledger's per-user /me/entitlements (user's own OIDC token, never the shared read token) and sets window.SUCH_APP.premium for WebBillingManager. Redemption also resolves on page reload / next login (crypto is webhook-driven). - index.html: load config+checkout in <head>; CTA calls SUCH_APP_startCheckout, else falls through to the store links (fail-closed). Store/itch buttons unchanged.
15 lines
980 B
JavaScript
15 lines
980 B
JavaScript
// Public web-app config. NO SECRETS — only public values Operations populates at
|
|
// deploy time once the OIDC client + shop tenant exist. All null/false here → the
|
|
// checkout flow is INERT (fail-closed): the "Get the Full Game" CTA falls through
|
|
// to the store links, premium stays false, guest-first play is untouched.
|
|
//
|
|
// Operations replaces this file (or the values) at deploy; the client never holds
|
|
// a secret — per-user premium is resolved via the user's own OIDC session.
|
|
window.SUCH_APP_CONFIG = {
|
|
oidcIssuer: null, // e.g. https://id.such.software (SUCH_APP_OIDC_ISSUER)
|
|
oidcClientId: null, // PUBLIC native/SPA client id (SUCH_APP_OIDC_CLIENT_ID)
|
|
ledgerBase: null, // e.g. https://entitlements.such.software (such-entitlement-ledger)
|
|
checkoutUrl: null, // bauhaus-scoped shop entry, e.g. https://shop.bauhausecho.com/...
|
|
checkoutEnabled: false, // master flag — CLOSED until the tenant is provisioned + activated
|
|
};
|