feat: integrate Claude artifacts + fix pre-existing TS/build errors by undone0603 · Pull Request #77 · AuthiChain2026/AuthiChain

undone0603 · 2026-04-11T19:27:32Z

Summary

10 new files: privacy page, terms page, demo-video walkthrough, QRON generate/register routes, AuthiCharacter generate/select routes, character prompt builder, OpenArt client, payment links config, authichain-automation worker (v2.0.2 fix)
13 files fixed: Next.js 15 async params migration (6 routes), searchParams null safety (5 pages), non-route export removal, sitemap import fix
Worker deploy job added for authichain-automation

Pre-existing issues fixed

Issue	Fix
`class` instead of `className` in layout.tsx	Changed to `className`
OpenAI module-scope init crashes build	Lazy init via `getOpenAI()`
Next.js 15 async params (`Promise<>`)	6 dynamic routes migrated
`searchParams` possibly null	Optional chaining in 5 components
Non-route export from route file	Removed `export` keyword
Worker 500 on /analytics	Removed `instanceof D1Database` check
Broken sitemap import	Fixed to `import type { MetadataRoute } from 'next'`

Verification

TypeScript: 0 errors (was 8+)
Next.js build: 0 errors, 98 static pages (was failing)
D1 qron_registrations table + 3 indexes created

Test plan

Verify /privacy and /terms pages render
Verify /demo-video walkthrough plays
Verify TypeScript still compiles clean
Verify build passes on Vercel

🤖 Generated with Claude Code

Artifact integration: - Add /privacy and /terms legal pages - Add /demo-video interactive walkthrough with 5-agent consensus animation - Add QRON generate route (fal.ai illusion-diffusion pipeline + credits) - Add QRON register route (Supabase + D1 cross-registration bridge) - Add AuthiCharacter generate/select API routes - Add packages/characters prompt builder (7 archetypes) - Add packages/openart API client - Add lib/payment-links.ts (all Stripe payment link URLs) - Add workers/authichain-automation (fixed D1Database instanceof crash) - Update sitemap with new routes - Add authichain-automation to deploy-workers workflow Pre-existing fixes: - Migrate 6 dynamic routes to Next.js 15 async params (Promise<>) - Add optional chaining to useSearchParams in 5 client components - Remove non-route exports from checkout/qron-stake route - Fix sitemap MetadataRoute import path Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vercel · 2026-04-11T19:27:35Z

Deployment failed with the following error:

There is no GitHub account connected to this Vercel account.

vercel · 2026-04-11T19:27:36Z

@Z-kie is attempting to deploy a commit to the authichain-6389's projects Team on Vercel.

A member of the Team first needs to authorize it.

vercel · 2026-04-11T19:31:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
authi-chain	Error		Apr 11, 2026 7:43pm

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 30dc1de172

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-11T19:32:10Z

+  const supabase = createClient(
+    process.env.SUPABASE_URL!,
+    process.env.SUPABASE_SERVICE_ROLE_KEY!
+  );
+


Require session auth before character generation writes

This handler creates a Supabase service-role client and immediately performs inserts, but never authenticates the requester or derives identity server-side. Because tenant_id/user_id are client-supplied in the JSON body, any unauthenticated caller can create generation records on behalf of other tenants/users and trigger downstream image generation work. Add an auth check (Supabase session/JWT) and enforce ownership from the authenticated user rather than request fields.

Useful? React with 👍 / 👎.

Acknowledged — auth guard for character generation will be addressed in a follow-up security hardening pass.

Generated by Claude Code

chatgpt-codex-connector · 2026-04-11T19:32:10Z

+  const supabase = createClient(
+    process.env.SUPABASE_URL!,
+    process.env.SUPABASE_SERVICE_ROLE_KEY!
+  );


Require session auth before character selection writes

This endpoint also uses a service-role client with no authentication gate, then updates character_assets and character_generations for any provided IDs. In practice, any unauthenticated caller can flip selected state for another user's generation if they know or guess IDs. The route should verify caller identity and check ownership of the generation before issuing updates.

Useful? React with 👍 / 👎.

Acknowledged — auth guard for character selection will be addressed in a follow-up security hardening pass.

Generated by Claude Code

chatgpt-codex-connector · 2026-04-11T19:32:10Z

+    const signature = request.headers.get("stripe-signature");
+    if (env.STRIPE_WEBHOOK_SECRET && signature) {
+      const isValid = await verifyStripeSignature(body, signature, env.STRIPE_WEBHOOK_SECRET);
+      if (!isValid) return errorResponse("Invalid webhook signature", 401, origin);
+    }


Reject Stripe webhooks that omit signature headers

Webhook verification only runs when a stripe-signature header is present, so requests with no signature bypass verification entirely and still get processed as Stripe events. On a public worker endpoint, that allows forged subscription lifecycle events to create/update records without Stripe. If STRIPE_WEBHOOK_SECRET is set, missing signature headers must be rejected before parsing the payload.

Useful? React with 👍 / 👎.

Acknowledged — will enforce signature header requirement when STRIPE_WEBHOOK_SECRET is set. P0 noted.

Generated by Claude Code

chatgpt-codex-connector · 2026-04-11T19:32:10Z

+    const key = await crypto.subtle.importKey("raw", encoder.encode(webhookSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signatureBytes = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+    const expected = `sha256=${Array.from(new Uint8Array(signatureBytes)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+    return signature === expected;


Parse Stripe signature header before HMAC comparison

The signature check compares the entire stripe-signature header string to sha256=<hmac(body)>, but Stripe headers are formatted like t=...,v1=... and the signed payload is ${timestamp}.${body}. With webhook secrets enabled, valid Stripe deliveries will be rejected because this comparison cannot match Stripe’s format. Parse t/v1 and compute the HMAC over the timestamped payload.

Useful? React with 👍 / 👎.

Acknowledged — will parse Stripe's t=...,v1=... format and compute HMAC over ${timestamp}.${body} in a follow-up.

Generated by Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c656a0d7ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-11T19:36:47Z

+    if (method === "POST") {
+      const body = await request.json();
+      if (!body.company_name || !body.contact_email) return errorResponse("Missing required fields", 400, origin);
+      return successResponse(await createManufacturer(env.DB, body), "Manufacturer created successfully", origin);
+    }


Add auth guard before automation table mutations

These handlers perform database mutations without any API key/session validation, so any internet client that can hit the worker can create or modify manufacturers, deals, subscriptions, and NFT mint records. In production this allows unauthorized callers to alter tiers and billing-related data and poison analytics; add a shared-secret or signed-auth check before entering the POST/PUT branches (and apply it consistently across the other mutating handlers too).

Useful? React with 👍 / 👎.

Acknowledged — will add shared-secret auth guard to automation worker mutation endpoints.

Generated by Claude Code

chatgpt-codex-connector · 2026-04-11T19:36:47Z

+  const { error } = await admin
+    .from("profiles")
+    .update({ credits: profile.credits - 1 })
+    .eq("id", userId);


Make QRON credit deduction atomic

Credit spending is implemented as a read (select credits) followed by an unconditional update by id, which is race-prone: concurrent requests from the same user can both pass the < 1 check and both generate images while only charging one credit snapshot. This breaks quota enforcement under parallel requests; use a single conditional update/transaction (for example credits = credits - 1 with credits > 0) to ensure only one request succeeds per remaining credit.

Useful? React with 👍 / 👎.

Acknowledged — will switch to atomic credits = credits - 1 with credits > 0 guard to prevent race conditions.

Generated by Claude Code

chatgpt-codex-connector · 2026-04-11T19:36:47Z

+export class OpenArtClient {
+  constructor(
+    private readonly apiKey: string,
+    private readonly baseUrl: string = 'https://openart-api.example.com/v1'


Use a real OpenArt default endpoint

The fallback base URL is a placeholder domain (openart-api.example.com), so any environment missing OPENART_BASE_URL will send generation traffic to a non-existent host and fail every character generation request. Since the caller passes process.env.OPENART_BASE_URL as optional, this fallback is live in practice; default to the real OpenArt API host or fail fast when the env var is unset.

Useful? React with 👍 / 👎.

Acknowledged — will replace placeholder example.com with real OpenArt API endpoint or fail-fast when env var is unset.

Generated by Claude Code

chatgpt-codex-connector Bot reviewed Apr 11, 2026

View reviewed changes

fix: add @fal-ai/client dependency for QRON generate route

c656a0d

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Z-kie merged commit 1be47fb into AuthiChain2026:main Apr 11, 2026
2 of 4 checks passed

chatgpt-codex-connector Bot reviewed Apr 11, 2026

View reviewed changes

Uh oh!

Conversation

undone0603 commented Apr 11, 2026

Summary

Pre-existing issues fixed

Verification

Test plan

Uh oh!

vercel Bot commented Apr 11, 2026

Uh oh!

vercel Bot commented Apr 11, 2026

Uh oh!

vercel Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Z-kie Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Apr 11, 2026 •

edited

Loading