Skip to content

feat(pass): Profullstack Pass gives Pro until it ends - #183

Merged
ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass
Nov 7, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/coinpay-pass

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Profullstack Pass: a CoinPay user who deposited $99 into their own CoinPay wallet gets a free month of PairUX Pro.

  • CoinPay callback reads pass via @profullstack/coinpay-onboard ^0.5.0 and calls plan_apply_coinpay_pass(user, until) for the account bound to the CoinPay sub (never by email).
  • Migration 20261107120000_coinpay_pass.sql: profiles.coinpay_pass_until + service-role-only RPC. It writes plan/plan_expires_at with max semantics (a running Team plan is kept; expiry = GREATEST(running expiry, pass end)), so every existing reader (web effectivePlan, LiveKit limits, desktop entitlement) sees Pro without code changes. Idempotent on the pass end.
  • Pricing: one line linking https://coinpayportal.com/pass.
  • Tests: apps/web/src/lib/coinpay-pass.test.ts.

🤖 Generated with Claude Code

CoinPay sign-in reads the userinfo `pass` claim (coinpay-onboard ^0.5.0)
and calls the new service-role plan_apply_coinpay_pass() for the account
bound to the CoinPay sub. It writes profiles.plan / plan_expires_at with
max semantics (bigger plan kept, expiry = GREATEST(running, pass end)), so
effectivePlan, LiveKit limits and the desktop app all see Pro, and stores
coinpay_pass_until so a repeat sign-in is a no-op. Pricing links the Pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

50 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 24 | LOW: 22

Severity Rule Location
HIGH sh-eval-expansion .githooks/pre-commit:33
HIGH js-electron-node-integration apps/desktop/src/main/window.ts:49
HIGH sh-unquoted-expansion-destructive apps/installer/scripts/install.sh:717
HIGH sh-unquoted-expansion-destructive apps/installer/scripts/install.sh:948
MEDIUM sh-remote-script-execution apps/installer/scripts/install.sh:693
MEDIUM sh-remote-script-execution apps/installer/scripts/install.sh:840
MEDIUM sh-remote-script-execution apps/installer/scripts/install.sh:842
MEDIUM sh-remote-script-execution apps/installer/scripts/install.sh:1138
MEDIUM sh-remote-script-execution apps/installer/scripts/install.sh:1140
MEDIUM sh-remote-script-execution apps/livekit/setup-livekit-server.sh:93
MEDIUM sh-remote-script-execution apps/turn/deploy-droplet.sh:62
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:52
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:79
MEDIUM js-unescaped-html-sink apps/web/src/app/c/[handle]/page.tsx:199
MEDIUM js-open-redirect apps/web/src/app/cli/authorize/consent.tsx:68
MEDIUM js-unescaped-html-sink apps/web/src/app/l/[joinCode]/page.tsx:146
MEDIUM js-unescaped-html-sink apps/web/src/app/l/[joinCode]/page.tsx:230
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:150
MEDIUM js-unescaped-html-sink apps/web/src/app/live/page.tsx:154
MEDIUM js-unescaped-html-sink apps/web/src/app/page.tsx:98
MEDIUM js-unescaped-html-sink apps/web/src/app/pricing/page.tsx:263
MEDIUM js-open-redirect apps/web/src/app/settings/copilot/copilot-settings.tsx:144
MEDIUM js-unescaped-html-sink apps/web/src/app/u/[username]/page.tsx:285
MEDIUM js-open-redirect apps/web/src/components/billing/useCheckout.ts:81
MEDIUM js-unescaped-html-sink apps/web/src/components/universal-footer.tsx:29
MEDIUM js-open-redirect apps/web/src/hooks/useDesktopHandoff.ts:24
MEDIUM redos-nested-quantifier apps/web/src/lib/deliverable.ts:11
MEDIUM sql-template-interpolation packages/ai-core/src/prompts.ts:36
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:138
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:139
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:340
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:341
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:371
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:372
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:383
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:397
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:398
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:405
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:415
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:416
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:453
LOW secret-generic-credential apps/desktop/src/main/agent-cli/commands.test.ts:454
LOW secret-generic-credential apps/desktop/src/main/agent-cli/copilot.test.ts:92
LOW secret-generic-credential apps/livekit/fly.toml:12
LOW secret-generic-credential apps/turn/fly.toml:11
LOW secret-openai-key apps/web/src/lib/copilot/keys.test.ts:62
LOW secret-generic-credential apps/web/src/lib/youtubeAutoLive.test.ts:90
LOW sh-predictable-temp-path appstores/firetv/emulator-test.sh:23
LOW secret-generic-credential docs/API.md:747
LOW secret-generic-credential docs/API.md:753

Snippets are redacted; ThreatCrush never prints matched credential material.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​profullstack/​coinpay-onboard@​0.3.1 ⏵ 0.5.080 +4100100 +194 +2100

View full report

@ralyodio
ralyodio merged commit 8dbca1c into master Nov 7, 2026
15 checks passed
@ralyodio
ralyodio deleted the feat/coinpay-pass branch November 7, 2026 16:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant