Deploy 4a2edb8

Route Paddle checkout out of the HF iframe to the approved website (#101)

Source: https://github.com/WINTER4000/turingDNA/commit/4a2edb88a32933dd8247beb7953e59105ceb8da4

dee/core/paddle.py

@@ -12,7 +12,7 @@ Everything the engine needs to sell and honour a Pro subscription:
 
 WHAT DOES NOT LIVE HERE
 -----------------------
-Checkout itself. That is Paddle.js in the browser (dee/static/billing.js):
+Checkout itself. That is Paddle.js on turingdna.com/pricing/ (landing branch):
 the overlay opens against a price id, the buyer pays Paddle, and Paddle calls
 the webhook. The server never sees a card, and never creates a transaction.
 
@@ -368,7 +368,7 @@ def cancel_subscription(subscription_id: Optional[str]) -> bool:
 
 # ── Config handed to the browser ─────────────────────────────────────────
 def public_config(user_id: Optional[str], email: Optional[str]) -> Dict[str, Any]:
-    """What dee/static/billing.js needs to render the upsell and open checkout.
+    """What the engine upsell and the website checkout need to render billing.
 
     Every value here is safe in a browser: the client token and price id are
     public by design, and the customer id and user id are the requester's own.
@@ -424,7 +424,7 @@ def _user_for(data: Dict[str, Any]) -> Optional[str]:
 
     Three routes, in order of how much we trust them:
 
-      1. custom_data.user_id, set by billing.js at checkout — CHECKED against
+      1. custom_data.user_id, set by the website checkout — CHECKED against
          the buyer Paddle actually charged (see below).
       2. The profile already stamped with this customer id. A change made from
          Paddle's dashboard carries no custom_data.

dee/server.py

@@ -1770,7 +1770,7 @@ def create_app() -> Flask:
             "retention_days": None if pro else _auth.FREE_LIBRARY_TTL_DAYS,
         })
 
-    @app.get("/api/billing/config")
+    @app.route("/api/billing/config", methods=["GET", "OPTIONS"])
     def billing_config() -> Response:
         """What the browser needs to render the Pro upsell and open checkout.
 
@@ -1778,10 +1778,26 @@ def create_app() -> Flask:
         the customer id, email and current plan only for the signed-in
         requester, about themselves. See dee/core/paddle.public_config.
         """
+        # The approved checkout origin is the website, not the HF iframe.
+        # Explicitly allow only the site's two canonical origins, with Bearer
+        # auth (no cookies). No other API route inherits this permission.
+        def checkout_response(resp):
+            resp.headers["Cache-Control"] = "no-store"
+            resp.vary.add("Origin")
+            if request.headers.get("Origin") in (
+                    "https://turingdna.com", "https://www.turingdna.com"):
+                resp.headers["Access-Control-Allow-Origin"] = request.headers["Origin"]
+                resp.headers["Access-Control-Allow-Methods"] = "GET, OPTIONS"
+                resp.headers["Access-Control-Allow-Headers"] = "authorization"
+                resp.headers["Access-Control-Max-Age"] = "600"
+            return resp
+
+        if request.method == "OPTIONS":
+            return checkout_response(app.make_response(("", 204)))
         from .core import paddle as _paddle
         auth = _auth.get_auth()
         uid = None if auth.anonymous else auth.user_id
-        return jsonify(_paddle.public_config(uid, auth.email))
+        return checkout_response(jsonify(_paddle.public_config(uid, auth.email)))
 
     @app.route("/api/account/delete", methods=["POST", "OPTIONS"])
     def account_delete() -> Response:

dee/static/billing.js

@@ -1,141 +1,36 @@
-/* billing.js — the upgrade upsell and Paddle.js checkout overlay.
- *
- * The server never sees a card. This asks /api/billing/config what to render,
- * initialises Paddle.js, and — for a signed-in account on a plan below the top
- * one, when Paddle is configured — puts the upgrades it can actually sell in
- * the account menu. Paying happens entirely inside Paddle's iframe; the plan
- * flips server-side when Paddle calls our webhook, so after checkout we poll
- * /api/usage until it does rather than trust the browser.
- *
- * Which plans exist, their price ids and the amounts shown all come from the
- * server. Nothing about pricing is decided here — this file renders what it
- * is told, so a price change never needs a redeploy of the workbench.
- *
- * Everything here fails SILENTLY: a page with no billing configured, no
- * Paddle.js (blocked, offline), or a config fetch that 404s simply shows no
- * upsell. Billing must never be able to break the workbench. */
+/* The engine is embedded on an unapproved HF origin. Checkout must run on
+ * turingdna.com, using that site's own signed-in session. Never put tokens,
+ * customer identities or arbitrary price IDs into the navigation URL. */
 (function () {
   'use strict';
-
-  function onReady(fn) {
-    if (document.readyState !== 'loading') { fn(); return; }
-    document.addEventListener('DOMContentLoaded', fn);
-  }
-
-  function initPaddle(cfg) {
-    if (!window.Paddle) return false;
-    try {
-      // Environment MUST be set before Initialize, and only for sandbox —
-      // Paddle.js defaults to production, and calling set('production') is
-      // not always supported across versions.
-      if (cfg.environment === 'sandbox' && Paddle.Environment && Paddle.Environment.set) {
-        Paddle.Environment.set('sandbox');
-      }
-      var opts = { token: cfg.client_token };
-      // pwCustomer wires Paddle Retain to the known customer. Only when we
-      // actually have their Paddle id — passing an empty one throws.
-      if (cfg.customer_id) opts.pwCustomer = { id: cfg.customer_id };
-      Paddle.Initialize(opts);
-      return true;
-    } catch (e) {
-      return false;
-    }
-  }
-
-  // After the overlay closes, the plan only changes once Paddle's webhook
-  // reaches our server. Poll /api/usage briefly so the panel updates itself
-  // instead of the user wondering whether it worked; give up quietly if the
-  // webhook is slow (it still lands, and a refresh will show it).
-  //
-  // Polls for a CHANGE FROM the plan we started on, rather than for one
-  // specific plan. A Starter subscriber upgrading to Pro starts on 'starter',
-  // so the old "is it 'pro' yet" test was fine — but "is it not 'free' yet"
-  // would have declared victory instantly, before anything moved.
-  function pollUntilPlanChanges(from, tries) {
-    if (tries <= 0) return;
-    fetch('/api/usage')
-      .then(function (r) { return r.ok ? r.json() : null; })
-      .catch(function () { return null; })
-      .then(function (d) {
-        if (d && d.plan && d.plan !== from) {
-          var slot = document.getElementById('acctUpsell');
-          if (slot) { slot.hidden = true; slot.innerHTML = ''; }
-          if (window.TDAuth && typeof window.TDAuth.refreshUsage === 'function') {
-            window.TDAuth.refreshUsage();
-          }
-          return;
-        }
-        setTimeout(function () { pollUntilPlanChanges(from, tries - 1); }, 3000);
-      });
-  }
-
-  function openCheckout(cfg, priceId) {
-    if (!window.Paddle || !priceId) return;
-    var from = cfg.plan || 'free';
-    var checkout = {
-      items: [{ priceId: priceId, quantity: 1 }],
-      // custom_data.user_id is how the webhook maps the resulting subscription
-      // back to this Supabase account (dee/core/paddle._user_for).
-      customData: { user_id: cfg.user_id || '' },
-      settings: { displayMode: 'overlay', theme: 'light' },
-      eventCallback: function (ev) {
-        if (ev && (ev.name === 'checkout.completed' || ev.name === 'checkout.closed')) {
-          pollUntilPlanChanges(from, 20);
-        }
-      }
-    };
-    if (cfg.email) checkout.customer = { email: cfg.email };
-    try { Paddle.Checkout.open(checkout); } catch (e) { /* overlay failed to open */ }
-  }
-
-  function upgradeButton(id, label, priceId, cfg) {
-    var btn = document.createElement('button');
-    btn.type = 'button';
-    btn.className = 'acct-menu-item acct-upgrade';
-    btn.id = id;
-    btn.textContent = label;
-    btn.addEventListener('click', function () { openCheckout(cfg, priceId); });
-    return btn;
-  }
-
   function mountUpsell(cfg) {
-    // Anonymous visitors and unconfigured deployments get nothing, and nobody
-    // is offered a plan they already hold. Pro is the top tier, so a Pro
-    // account sees no upsell at all.
-    if (!cfg.user_id || cfg.plan === 'pro') return;
+    if (!cfg || !cfg.configured || !cfg.user_id || cfg.plan === 'pro') return;
     var slot = document.getElementById('acctUpsell');
     if (!slot) return;
     slot.innerHTML = '';
-    // Starter is offered only to a free account, and only where a Starter
-    // price is actually configured — a deployment selling Pro alone must
-    // render exactly what it rendered before this existed.
+    function add(plan, label, id) {
+      var link = document.createElement('a');
+      link.id = id;
+      link.className = 'acct-menu-item acct-upgrade';
+      link.textContent = label;
+      link.href = 'https://turingdna.com/pricing/?plan=' + plan;
+      link.target = '_top';
+      slot.appendChild(link);
+    }
     if (cfg.plan !== 'starter' && cfg.starter_price_id) {
-      slot.appendChild(upgradeButton(
-        'acctUpgradeStarter',
-        'Upgrade to Starter — ' + (cfg.starter_label || ''),
-        cfg.starter_price_id, cfg));
+      add('starter', 'Upgrade to Starter — ' + (cfg.starter_label || ''), 'acctUpgradeStarter');
     }
     if (cfg.pro_price_id) {
-      slot.appendChild(upgradeButton(
-        'acctUpgrade',
-        'Upgrade to Pro — ' + (cfg.pro_label || ''),
-        cfg.pro_price_id, cfg));
+      add('pro', 'Upgrade to Pro — ' + (cfg.pro_label || ''), 'acctUpgrade');
     }
-    // Labels and price ids both come from the server (dee/core/paddle
-    // public_config), so a price change is a Space restart — the amount is no
-    // longer hard-coded here where it could drift from what is charged.
-    if (!slot.childNodes.length) return;
-    slot.hidden = false;
+    slot.hidden = !slot.childNodes.length;
   }
-
-  onReady(function () {
+  function ready() {
     fetch('/api/billing/config')
       .then(function (r) { return r.ok ? r.json() : null; })
-      .catch(function () { return null; })
-      .then(function (cfg) {
-        if (!cfg || !cfg.configured) return;   // billing not set up on this deploy
-        if (!initPaddle(cfg)) return;           // Paddle.js missing/blocked
-        mountUpsell(cfg);
-      });
-  });
+      .then(mountUpsell)
+      .catch(function () { /* The workbench remains usable during a billing outage. */ });
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ready);
+  else ready();
 })();

dee/static/index.html

@@ -178,21 +178,21 @@
     <!-- ?v= query bumps invalidate browser + iframe asset caches when app.css /
          app.js change. Bump these numbers whenever you ship a frontend update —
          without them, users keep getting the stale file for up to a week. -->
-    <link rel="stylesheet" href="/static/app.css?v=20260915-bench-account" />
+    <link rel="stylesheet" href="/static/app.css?v=20260916-checkout-origin" />
     <!-- The work catalog + the draggable rail. Kept out of app.css so two new
          self-contained surfaces stay reviewable; every colour is an app.css
          token, so both themes work with nothing added. -->
-    <link rel="stylesheet" href="/static/catalog.css?v=20260915-bench-account" />
+    <link rel="stylesheet" href="/static/catalog.css?v=20260916-checkout-origin" />
     <!-- Units, the run strip and the decision trace. Same reasoning as
          catalog.css: kept out of app.css so a self-contained surface stays
          reviewable, and every colour is an app.css token so both themes
          work with nothing added. -->
-    <link rel="stylesheet" href="/static/trace.css?v=20260915-bench-account" />
+    <link rel="stylesheet" href="/static/trace.css?v=20260916-checkout-origin" />
     <!-- Disclosure surfaces added in the 2026-08 scientific review (CRISPR
          scope strip, provenance "Assumes" line). Separate file for the same
          reason as catalog.css: small, self-contained, and app.css's cascade
          is hostile. Uses app.css tokens only, so both themes work. -->
-    <link rel="stylesheet" href="/static/science.css?v=20260915-bench-account" />
+    <link rel="stylesheet" href="/static/science.css?v=20260916-checkout-origin" />
     <link rel="icon" type="image/svg+xml" href="/static/favicon.svg?v=4" />
     <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png?v=2" />
     <!-- Mol* (PDBe) 3-D viewer is ~4.9 MB. We do NOT eager-load it on every
@@ -528,8 +528,8 @@
                     <!-- Upgrade-to-Pro affordance, filled by billing.js only for
                          a signed-in FREE account when Paddle is configured, so a
                          page with no billing set up (or a Pro user) shows nothing
-                         here rather than a dead button. Checkout is a Paddle.js
-                         overlay; the server never sees a card. -->
+                         here rather than a dead button. Links open checkout on the
+                         approved website origin; the server never sees a card. -->
                     <div class="acct-upsell" id="acctUpsell" hidden></div>
                     <!--
                         What Turing remembers about you, and the controls to
@@ -3171,44 +3171,40 @@
          Authorization header on every same-origin /api/* call. Without
          this, signed-in users would still hit the anonymous-quota
          gate. -->
-    <script src="/static/auth.js?v=20260915-bench-account"></script>
-    <!-- Paddle.js (Merchant-of-Record checkout). Loads from cdn.paddle.com,
-         named in the CSP script-src. billing.js below reads /api/billing/config
-         and, for a signed-in free account, opens the checkout overlay. One CDN
-         script for both sandbox and live; the environment is set at runtime. -->
-    <script src="https://cdn.paddle.com/paddle/v2/paddle.js"></script>
-    <script src="/static/billing.js?v=20260915-bench-account" defer></script>
+    <script src="/static/auth.js?v=20260916-checkout-origin"></script>
+    <!-- Checkout runs on the approved turingdna.com origin, outside this iframe. -->
+    <script src="/static/billing.js?v=20260916-checkout-origin" defer></script>
     <!-- Cloning reference data must load before app.js so the Designer
          can read VECTORS / ENZYMES / CLONING_METHODS / TAGS / LINKERS. -->
-    <script src="/static/cloning_db.js?v=20260915-bench-account" defer></script>
-    <script src="/static/context.js?v=20260915-bench-account" defer></script>
-    <script src="/static/lineage.js?v=20260915-bench-account" defer></script>
+    <script src="/static/cloning_db.js?v=20260916-checkout-origin" defer></script>
+    <script src="/static/context.js?v=20260916-checkout-origin" defer></script>
+    <script src="/static/lineage.js?v=20260916-checkout-origin" defer></script>
     <!-- Before app.js: it mounts a strip at init. Both are `defer`, so they
          run in document order. -->
-    <script src="/static/tabs.js?v=20260915-bench-account" defer></script>
-    <script src="/static/app.js?v=20260915-bench-account" defer></script>
+    <script src="/static/tabs.js?v=20260916-checkout-origin" defer></script>
+    <script src="/static/app.js?v=20260916-checkout-origin" defer></script>
     <!-- The decision trace, BEFORE cockpit.js: applyEvent calls TDTrace.push
          on the very first event, and both are `defer`, so document order is
          load order. Loading it after would drop the opening events of a
          restored run on the floor — silently, since the push is guarded. -->
-    <script src="/static/trace.js?v=20260915-bench-account" defer></script>
+    <script src="/static/trace.js?v=20260916-checkout-origin" defer></script>
     <!-- THE COCKPIT — the persistent orchestrator rail. Loads after app.js so
          TDBench/TDStructure exist when a tool result asks the workspace to
          render something. This is the only conversation surface in the app. -->
-    <script src="/static/cockpit.js?v=20260915-bench-account" defer></script>
+    <script src="/static/cockpit.js?v=20260916-checkout-origin" defer></script>
     <!-- structcard before catalog: the catalog calls TDStructCard.observe as
          soon as it paints. Both are defer, so document order is load order. -->
-    <script src="/static/structcard.js?v=20260915-bench-account" defer></script>
-    <script src="/static/catalog.js?v=20260915-bench-account" defer></script>
-    <script src="/static/railsplit.js?v=20260915-bench-account" defer></script>
+    <script src="/static/structcard.js?v=20260916-checkout-origin" defer></script>
+    <script src="/static/catalog.js?v=20260916-checkout-origin" defer></script>
+    <script src="/static/railsplit.js?v=20260916-checkout-origin" defer></script>
     <!-- Dwell-time heartbeat. Loads after auth.js so its /api/ping calls go
          through the JWT-attaching fetch wrapper (signed-in attribution). -->
-    <script src="/static/telemetry.js?v=20260915-bench-account" defer></script>
+    <script src="/static/telemetry.js?v=20260916-checkout-origin" defer></script>
     <!-- First-party UX-behaviour collector (dead/rage clicks, scroll depth,
          funnel steps, feature clicks, client errors). Structure-only, never
          reads sequence content; shares telemetry.js's persisted td_session_id
          and POSTs batches to /api/collect via sendBeacon. First-party /static
          file so it satisfies the strict script-src CSP. -->
-    <script src="/static/collector.js?v=20260915-bench-account" defer></script>
+    <script src="/static/collector.js?v=20260916-checkout-origin" defer></script>
 </body>
 </html>

tests/test_billing_handoff.py

@@ -0,0 +1,31 @@
+"""Exercise the actual engine script: upgrades must leave the HF iframe."""
+import subprocess
+from pathlib import Path
+
+
+def test_engine_links_use_only_plan_names_and_the_approved_origin():
+    script = r"""
+const fs = require('node:fs'), vm = require('node:vm'), assert = require('node:assert/strict');
+const source = fs.readFileSync('dee/static/billing.js', 'utf8');
+async function check(plan, configured, expected) {
+  const slot = {childNodes: [], appendChild(child) {this.childNodes.push(child);}};
+  const config = {configured, user_id: 'private-user', email: 'private-email', plan,
+    client_token: 'public-token', starter_price_id: 'pri_starter', pro_price_id: 'pri_pro'};
+  vm.runInNewContext(source, {
+    document: {readyState: 'complete', getElementById: () => slot, createElement: tag => ({tag})},
+    fetch: async () => ({ok: true, json: async () => config})
+  });
+  await new Promise(resolve => setImmediate(resolve));
+  assert.equal(slot.childNodes.length, expected.length);
+  slot.childNodes.forEach((a, i) => {
+    assert.equal(a.tag, 'a');
+    assert.equal(a.href, 'https://turingdna.com/pricing/?plan=' + expected[i]);
+    assert.equal(a.target, '_top');
+    assert.equal(a.href.includes(config.user_id), false);
+  });
+}
+(async () => {await check('free', true, ['starter', 'pro']);
+await check('starter', true, ['pro']); await check('pro', true, []);
+await check('free', false, []);})().catch(e => {console.error(e);process.exitCode=1;});
+"""
+    subprocess.run(['node', '-e', script], check=True, cwd=Path(__file__).resolve().parents[1])

tests/test_paddle.py

@@ -305,21 +305,60 @@ def _read(rel):
         return fh.read()
 
 
-def test_the_page_loads_paddle_and_the_upsell_slot():
+def test_the_engine_loads_the_handoff_without_paddle():
     html = _read("dee/static/index.html")
-    assert "cdn.paddle.com/paddle/v2/paddle.js" in html
+    assert "cdn.paddle.com/paddle/v2/paddle.js" not in html
     assert "/static/billing.js" in html
     assert 'id="acctUpsell"' in html
 
 
 def test_billing_js_never_breaks_the_workbench():
     js = _read("dee/static/billing.js")
-    # Guards on the two things that can be absent: config and Paddle.js itself.
-    assert "!cfg.configured" in js and "window.Paddle" in js
-    assert "Paddle.Checkout.open" in js
+    # HF is not an approved checkout origin. Its only billing action is a
+    # top-level navigation; the site independently verifies the account.
+    assert "!cfg.configured" in js
+    assert "Paddle.Checkout.open" not in js
+    assert "https://turingdna.com/pricing/?plan=" in js
+    assert "link.target = '_top'" in js
 
 
 def test_the_migration_adds_the_billing_columns():
     sql = _read("supabase/migrations/0025_paddle_billing.sql")
     assert "add column if not exists paddle_customer_id" in sql
     assert "add column if not exists paddle_subscription_id" in sql
+
+
+@pytest.mark.parametrize("origin", ["https://turingdna.com", "https://www.turingdna.com"])
+def test_checkout_config_supports_authenticated_site_preflight(client, monkeypatch, origin):
+    from dee import server
+    monkeypatch.setattr(server._auth, "get_auth", lambda: pytest.fail("preflight must not require auth"))
+    r = client.options("/api/billing/config", headers={
+        "Origin": origin, "Access-Control-Request-Method": "GET",
+        "Access-Control-Request-Headers": "authorization"})
+    assert r.status_code == 204
+    assert r.headers["Access-Control-Allow-Origin"] == origin
+    assert r.headers["Access-Control-Allow-Methods"] == "GET, OPTIONS"
+    assert r.headers["Access-Control-Allow-Headers"] == "authorization"
+    assert "Access-Control-Allow-Credentials" not in r.headers
+
+
+def test_checkout_config_uses_verified_account_and_cannot_be_cached(client, monkeypatch):
+    from types import SimpleNamespace
+    from dee import server
+    monkeypatch.setattr(server._auth, "get_auth", lambda: SimpleNamespace(
+        anonymous=False, user_id=_UUID, email="buyer@example.com"))
+    monkeypatch.setattr(paddle, "_profile_by", lambda field, value: {"plan": "starter"})
+    r = client.get("/api/billing/config?user_id=attacker", headers={"Origin": "https://turingdna.com"})
+    assert r.headers["Access-Control-Allow-Origin"] == "https://turingdna.com"
+    assert r.headers["Cache-Control"] == "no-store"
+    assert "Origin" in r.vary
+    assert r.json["user_id"] == _UUID
+    assert r.json["plan"] == "starter"
+
+
+@pytest.mark.parametrize("origin", ["https://evil.example", "https://turingdna.com.evil.example",
+                                    "https://unapproved.turingdna.com", "http://turingdna.com"])
+def test_checkout_config_does_not_grant_arbitrary_origins(client, origin):
+    for method in (client.get, client.options):
+        r = method("/api/billing/config", headers={"Origin": origin})
+        assert "Access-Control-Allow-Origin" not in r.headers