Skip to content

feat(pass): Profullstack Pass turns on the paid plan until it ends - #149

Merged
ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass
Nov 7, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Collaborator

Profullstack Pass: a CoinPay user who deposited $99 into their own CoinPay wallet gets a free month of the paid ($1/mo) affiliate plan.

  • CoinPay callback reads pass via @profullstack/coinpay-onboard ^0.5.0 and stores accounts.coinpay_pass_until (added in ensureSchema via addColumnIfMissing) on the account from accountIdForCoinpay(sub) (never by email); also on Connect CoinPay once linked.
  • paidUntil() = later of the granted-days run and the pass, so hasPaidPlan() is on until the pass ends; granted days are not consumed. Enrolls the account as an affiliate like grantPaidDays().
  • /invites: one line linking https://coinpayportal.com/pass.
  • Tests: tests/coinpay-pass.test.mjs.

🤖 Generated with Claude Code

CoinPay sign-in (and Connect CoinPay) reads the userinfo `pass` claim
(coinpay-onboard ^0.5.0) and stores its end on accounts.coinpay_pass_until
for the account bound to the CoinPay sub. paidUntil() is the later of the
granted days and the pass, so hasPaidPlan() is on until the pass ends
without using up granted days. /invites links the CoinPay Pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​profullstack/​coinpay-onboard@​0.3.1 ⏵ 0.5.080 +4100100 +194 +2100

View full report

@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

30 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 26 | LOW: 2

Severity Rule Location
HIGH sh-remote-script-execution public/install.sh:365
HIGH js-ssrf-outbound-request public/sw.js:5
MEDIUM js-open-redirect app/dashboard/[[...tab]]/page.tsx:68
MEDIUM js-open-redirect app/signup/page.tsx:51
MEDIUM js-unescaped-html-sink components/PitFooter.tsx:30
MEDIUM js-open-redirect components/PitSearch.tsx:118
MEDIUM js-unescaped-html-sink components/Tenant.tsx:30
MEDIUM js-unescaped-html-sink components/Tenant.tsx:31
MEDIUM js-unescaped-html-sink components/Tenant.tsx:79
MEDIUM js-unescaped-html-sink components/Tenant.tsx:155
MEDIUM sql-template-interpolation lib/db.ts:592
MEDIUM sql-template-interpolation lib/db.ts:1310
MEDIUM redos-nested-quantifier lib/markdown.ts:109
MEDIUM sql-template-interpolation lib/webhook-store.ts:95
MEDIUM sql-template-interpolation lib/webhook-store.ts:102
MEDIUM sql-template-interpolation lib/webhook-store.ts:108
MEDIUM sql-template-interpolation lib/webhook-store.ts:111
MEDIUM sql-template-interpolation lib/webhook-store.ts:116
MEDIUM sql-template-interpolation lib/webhook-store.ts:117
MEDIUM sql-template-interpolation lib/webhook-store.ts:121
MEDIUM sql-template-interpolation lib/webhook-store.ts:128
MEDIUM sql-template-interpolation lib/webhook-store.ts:133
MEDIUM sql-template-interpolation lib/webhook-store.ts:144
MEDIUM sql-template-interpolation lib/webhook-store.ts:154
MEDIUM sql-template-interpolation lib/webhooks.ts:207
MEDIUM sh-remote-script-execution public/install.sh:124
MEDIUM sh-remote-script-execution public/install.sh:128
MEDIUM sh-remote-script-execution public/install.sh:147
LOW secret-generic-credential tests/signup-profile.test.mjs:28
LOW secret-generic-credential tests/signup-profile.test.mjs:39

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 2fcacc3 into master Nov 7, 2026
5 checks passed
@ralyodio
ralyodio deleted the feat/coinpay-pass branch November 7, 2026 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant