Files
wownerogue/html
jwinterm 8c36f40efc fix(payment): kill double invoice + restore Smirk one-click (status 403)
1) Double invoice: the "Buy Selected Package" button carries BOTH id=buy-credits-btn AND
   class=mode-option, so a click fired the generic .mode-option handler (no data attrs -> defaulted
   to single_game -> a spurious 1-credit invoice) AND its own buy-credits handler (the real pack).
   Guard the generic handler to ignore #buy-credits-btn and intentless clicks.

2) Smirk one-click payment never opened: /api/auth/smirk/status 403d, leaving _isLinked=false so
   onPaymentCreated skipped the Smirk path. The BOLA-hardened query matched socket_id AND anon_token,
   but socket_id is VOLATILE (changes every refresh) so it returned 0 rows after a reload. Match on
   the anon_token alone — the actual ownership secret — same protection, no refresh fragility.
2026-07-18 04:01:19 -04:00
..
2025-09-27 08:45:22 -04:00