Skip to content

feat: Profullstack Pass pays the Starter pack's credits once per pass on CoinPay sign-in - #435

Merged
ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass
Nov 7, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Profullstack Pass on crawlproof (pay-as-you-go): an active CoinPay pass pays the cheapest credit pack (Starter, 20 credits = 1 scan) once per pass.

  • @profullstack/coinpay-onboard 0.4.0 -> ^0.5.0; fetchCoinpayClaims adds pass: passFromUserinfo(info).
  • lib/coinpay-pass.ts: stores coinpay_identities.pass_until, grants through grant_code_credits() (adds promo_credits too, so pass credits never pay a publisher) with source coinpay-pass:<sub>:<expires_at>. Failure never blocks sign-in. Binding unchanged (sub only).
  • Migration 20261107160000_coinpay_pass.sql (additive): pass_until column + partial unique index on code_credit_grants(source) for coinpay-pass:%, so several crawlproof accounts linked to one CoinPay sub get one grant.
  • Pricing page: one line linking https://coinpayportal.com/pass.
  • Tests: tests/coinpay-pass.test.ts, signin test covers the claim. vitest, tsc, next build pass locally.

🤖 Generated with Claude Code

… on CoinPay sign-in

fetchCoinpayClaims reads the userinfo pass claim (coinpay-onboard ^0.5.0
passFromUserinfo); the callback stores coinpay_identities.pass_until and
grants the cheapest pack's credits through grant_code_credits() (promo,
never cash-backed) with source coinpay-pass:<sub>:<expires_at>. A partial
unique index keeps it to one grant per pass even when several accounts
link the same CoinPay sub. Pricing page links CoinPay Pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​profullstack/​coinpay-onboard@​0.4.0 ⏵ 0.5.080 +7100100 +194 +1100

View full report

@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

50 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 30 | LOW: 18

Severity Rule Location
HIGH tls-verification-disabled lib/onion.ts:48
HIGH secret-generic-credential lib/sp/platforms/facebook.ts:32
MEDIUM js-unescaped-html-sink app/(app)/dashboard/admin/email-broadcast/EmailBroadcastForm.tsx:125
MEDIUM js-unescaped-html-sink app/(app)/dashboard/projects/[id]/autoblog/articles/[articleId]/page.tsx:214
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:74
MEDIUM js-unescaped-html-sink app/(marketing)/blog/[slug]/page.tsx:102
MEDIUM js-unescaped-html-sink app/(marketing)/recent/page.tsx:177
MEDIUM js-unescaped-html-sink app/(marketing)/recent/page.tsx:181
MEDIUM js-unescaped-html-sink app/c/[project]/[slug]/page.tsx:76
MEDIUM js-unescaped-html-sink app/c/[project]/page.tsx:58
MEDIUM js-unescaped-html-sink app/careers.js/route.ts:228
MEDIUM js-unescaped-html-sink app/careers.js/route.ts:285
MEDIUM js-unescaped-html-sink app/layout.tsx:129
MEDIUM js-open-redirect app/login/form.tsx:40
MEDIUM js-unescaped-html-sink app/r/[token]/page.tsx:164
MEDIUM js-open-redirect app/signup/form.tsx:65
MEDIUM js-unescaped-html-sink app/surveys/[slug]/invite/page.tsx:68
MEDIUM js-unescaped-html-sink components/json-ld.tsx:8
MEDIUM js-unescaped-html-sink components/pit-footer.tsx:17
MEDIUM js-unescaped-html-sink components/report/markdown-view.tsx:16
MEDIUM js-unescaped-html-sink lib/careers/page-templates.ts:198
MEDIUM js-dynamic-code-execution lib/crawl-limits.ts:67
MEDIUM redos-nested-quantifier lib/emailMarkdown.ts:41
MEDIUM redos-nested-quantifier lib/emailMarkdown.ts:324
MEDIUM redos-nested-quantifier lib/lx/articleGen.ts:100
MEDIUM redos-nested-quantifier lib/tracker/agent-gate.ts:61
MEDIUM sh-predictable-temp-path ops/selfhost/server/setup-supabase.sh:218
MEDIUM sql-template-interpolation scripts/detect-slot-themes.ts:31
MEDIUM sql-template-interpolation scripts/purge-constructed-keywords.ts:163
MEDIUM sql-template-interpolation scripts/purge-offniche-keywords.ts:124
MEDIUM js-dynamic-code-execution scripts/test-crawl-limits.mjs:14
MEDIUM js-dynamic-code-execution scripts/test-crawl-limits.mjs:24
LOW secret-generic-credential app/(marketing)/docs/autoblog-webhook/page.tsx:156
LOW secret-generic-credential lib/sealed/migrate.ts:38
LOW secret-generic-credential lib/sp/platforms/linkedin.ts:25
LOW secret-generic-api-key tests/ads-generator-agent.test.ts:160
LOW secret-generic-api-key tests/ads-generator-agent.test.ts:187
LOW js-dynamic-code-execution tests/careers-page-templates.test.ts:21
LOW js-dynamic-code-execution tests/careers-widget-script.test.ts:19
LOW js-dynamic-code-execution tests/careers-widget-script.test.ts:69
LOW js-dynamic-code-execution tests/contract/ad-visitor-id.test.ts:51
LOW js-dynamic-code-execution tests/contract/ad-visitor-id.test.ts:52
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:20
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:24
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:25
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:26
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:31
LOW js-dynamic-code-execution tests/contract/ads-click-cooldown-redis.test.ts:35
LOW secret-generic-credential tests/contract/posthog-integration.test.ts:13
LOW secret-generic-credential tests/lead-campaign.test.ts:16

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 68a0af1 into master Nov 7, 2026
10 checks passed
@ralyodio
ralyodio deleted the feat/coinpay-pass branch November 7, 2026 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant