"content":" 1→# RateRight - Construction Worker Marketplace\n 2→\n 3→A Next.js app connecting construction workers with contractors. Features AI-powered profile building and smart job matching.\n 4→\n 5→## Features\n 6→\n 7→### ✨ AI Profile Builder (`/worker/profile/build`)\n 8→- **4-step wizard**: Trade → Experience → Location → Availability\n 9→- **AI-generated profiles**: Auto-generates bio, skills, and certifications using OpenAI\n 10→- **Editable results**: Workers can review and customize AI suggestions\n 11→- **Under 30 seconds**: Optimized for mobile with 64px touch targets\n 12→- **Uber-style UX**: Bottom sticky CTAs, minimal taps, glove-friendly design\n 13→\n 14→## Getting Started\n 15→\n 16→### Prerequisites\n 17→1. Copy `.env.local` and add your API keys:\n 18→ ```bash\n 19→ OPENAI_API_KEY=your_key_here\n 20→ NEXT_PUBLIC_SUPABASE_URL=your_supabase_url\n 21→ NEXT_PUBLIC_SUPABASE_ANON_KEY=your_anon_key\n 22→ ```\n 23→\n 24→2. Install dependencies:\n 25→ ```bash\n 26→ npm install\n 27→ ```\n 28→\n 29→3. Run the development server:\n 30→\n 31→```bash\n 32→npm run dev\n 33→# or\n 34→yarn dev\n 35→# or\n 36→pnpm dev\n 37→# or\n 38→bun dev\n 39→```\n 40→\n 41→Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.\n 42→\n 43→You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.\n 44→\n 45→This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.\n 46→\n 47→## Learn More\n 48→\n 49→To learn more about Next.js, take a look at the following resources:\n 50→\n 51→- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.\n 52→- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.\n 53→\n 54→You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!\n 55→\n 56→## Deploy on Vercel\n 57→\n 58→The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.\n 59→\n 60→Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.\n 61→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":"/home/ccuser/the-50-dollar-app/node_modules/next/dist/server/normalizers/built/app/app-bundle-path-normalizer.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/app-dev-overlay-setup.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/app-dev-overlay-error-boundary.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/server/normalizers/built/app/app-filename-normalizer.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/server/normalizers/built/app/app-page-normalizer.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/server/normalizers/built/app/app-pathname-normalizer.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/build/segment-config/app/app-segment-config.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/build/segment-config/app/app-segments.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/client-entry.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/build/segment-config/app/collect-root-param-keys.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/build/static-paths/app/extract-pathname-route-param-segments-from-loader-tree.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/forward-logs-utils.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/forward-logs.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/client/dev/hot-reloader/app/hot-reloader-app.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/errors/index.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/server/normalizers/built/app/index.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/errors/intercept-console-error.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/errors/replay-ssr-only-errors.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/segment-explorer-node.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/errors/stitched-error.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/terminal-logging-config.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/next-devtools/userspace/app/errors/use-error-handler.d.ts\n/home/ccuser/the-50-dollar-app/node_modules/next/dist/client/dev/hot-reloader/app/web-socket.d.ts\n/home/ccuser/the-50-dollar-app/src/app/api/auth/csrf/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/auth/verify-email/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/ai/transcribe-voice/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/ai/parse-profile-voice/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/payments/create/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/webhooks/stripe/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/messages/start/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/send/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/messages/route.ts\n/home/ccuser/the-50-dollar-app/src/app/auth/callback/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/ai/generate-profile/route.ts\n/home/ccuser/the-50-dollar-app/src/app/api/match/find-matches/route.ts"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { createCSRTEndpoint } from '@/lib/csrf';\n 3→import { createClient } from '@/lib/supabase/server';\n 4→\n 5→/**\n 6→ * CSRF Token Endpoint\n 7→ * Generates and returns a CSRF token for authenticated users\n 8→ * This should be called after successful authentication\n 9→ */\n 10→export async function GET(request: NextRequest) {\n 11→ try {\n 12→ // Check if user is authenticated\n 13→ const supabase = await createClient();\n 14→ const { data: { user } } = await supabase.auth.getUser();\n 15→ \n 16→ if (!user) {\n 17→ return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n 18→ }\n 19→ \n 20→ // Create and return CSRF token\n 21→ return createCSRTEndpoint(request);\n 22→ } catch (error) {\n 23→ console.error('CSRF token generation error:', error);\n 24→ return NextResponse.json({ error: 'Internal server error' }, { status: 500 });\n 25→ }\n 26→}\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→/**\n 2→ * Email verification API endpoint\n 3→ * Placeholder for email verification\n 4→ */\n 5→\n 6→import { NextRequest, NextResponse } from 'next/server'\n 7→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit'\n 8→import { withCSRFProtection } from '@/lib/csrf'\n 9→\n 10→// Rate limit: 5 requests per 15 minutes per IP (auth endpoint)\n 11→const VERIFY_RATE_LIMIT = 5;\n 12→const VERIFY_WINDOW_MS = 15 * 60 * 1000;\n 13→\n 14→const handler = async (request: NextRequest) => {\n 15→ try {\n 16→ // --- Rate limiting ---\n 17→ const clientIP = getClientIP(request);\n 18→ const rateLimit = checkRateLimit(`verify-email:${clientIP}`, VERIFY_RATE_LIMIT, VERIFY_WINDOW_MS);\n 19→ \n 20→ if (!rateLimit.allowed) {\n 21→ const retryAfter = Math.ceil((rateLimit.resetTime - Date.now()) / 1000);\n 22→ return createRateLimitResponse(clientIP, retryAfter);\n 23→ }\n 24→ \n 25→ const { userId, token } = await request.json()\n 26→ \n 27→ if (!userId || !token) {\n 28→ return NextResponse.json({ error: 'Missing required fields' }, { status: 400 })\n 29→ }\n 30→ \n 31→ // In production, implement proper token validation\n 32→ // For now, return success\n 33→ \n 34→ return NextResponse.json({ \n 35→ success: true,\n 36→ message: 'Email verification endpoint ready'\n 37→ })\n 38→ \n 39→ } catch (error) {\n 40→ console.error('Email verification error:', error)\n 41→ return NextResponse.json(\n 42→ { error: 'Internal server error' },\n 43→ { status: 500 }\n 44→ )\n 45→ }\n 46→}\n 47→\n 48→// Apply CSRF protection to the handler\n 49→export const POST = withCSRFProtection(handler);\n 50→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→/**\n 2→ * Client-side Supabase configuration with enhanced security\n 3→ * \n 4→ * IMPORTANT: This module does NOT export a singleton instance.\n 5→ * Always use createClient() to get a fresh client instance.\n 6→ * This prevents stale auth credentials on shared devices.\n 7→ */\n 8→\n 9→import { createBrowserClient } from '@supabase/ssr'\n 10→import type { SupabaseClient } from '@supabase/supabase-js'\n 11→\n 12→const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!\n 13→const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!\n 14→\n 15→/**\n 16→ * Creates a Supabase client for use in browser/Client Components.\n 17→ * Uses @supabase/ssr to properly sync cookies with the server.\n 18→ */\n 19→export function createClient(): SupabaseClient {\n 20→ return createBrowserClient(supabaseUrl, supabaseAnonKey)\n 21→}\n 22→\n 23→/**\n 24→ * @deprecated Use createClient() instead. This export will be removed.\n 25→ * Direct supabase export is disabled to prevent stale auth on shared devices.\n 26→ * Always call createClient() to get a fresh instance.\n 27→ */\n 28→export const supabase = new Proxy({} as SupabaseClient, {\n 29→ get() {\n 30→ throw new Error(\n 31→ 'Direct supabase import is deprecated and disabled for security. ' +\n 32→ 'Use createClient() instead to prevent stale auth on shared devices.'\n 33→ )\n 34→ },\n 35→})\n 36→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { getSupabaseAdmin, createClient } from '@/lib/supabase/server';\n 2→import { NextRequest, NextResponse } from 'next/server';\n 3→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit';\n 4→import { createPaymentIntent } from '@/lib/stripe/server';\n 5→import { withCSRFProtection } from '@/lib/csrf';\n 6→\n 7→// Rate limit: 10 requests per 15 minutes per user (sensitive financial operation)\n 8→const PAYMENT_RATE_LIMIT = 10;\n 9→const PAYMENT_WINDOW_MS = 15 * 60 * 1000;\n 10→\n 11→const handler = async (request: NextRequest) => {\n 12→ try {\n 13→ // --- Rate limiting (by IP as initial check) ---\n 14→ const clientIP = getClientIP(request);\n 15→ const ipRateLimit = checkRateLimit(`payment-ip:${clientIP}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 16→ \n 17→ if (!ipRateLimit.allowed) {\n 18→ const retryAfter = Math.ceil((ipRateLimit.resetTime - Date.now()) / 1000);\n 19→ return createRateLimitResponse(clientIP, retryAfter);\n 20→ }\n 21→ \n 22→ const supabase = await createClient();\n 23→ const {\n 24→ data: { user },\n 25→ } = await supabase.auth.getUser();\n 26→ \n 27→ if (!user) {\n 28→ return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n 29→ }\n 30→ \n 31→ // --- Stricter rate limiting by user ID ---\n 32→ const userRateLimit = checkRateLimit(`payment-user:${user.id}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 33→ \n 34→ if (!userRateLimit.allowed) {\n 35→ const retryAfter = Math.ceil((userRateLimit.resetTime - Date.now()) / 1000);\n 36→ return createRateLimitResponse(user.id, retryAfter);\n 37→ }\n 38→\n 39→ const body = await request.json();\n 40→ const { match_id, company_id } = body;\n 41→ const amount = 50.0; // Hardcoded amount to prevent client override\n 42→\n 43→ if (!match_id || !company_id) {\n 44→ return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });\n 45→ }\n 46→\n 47→ // Verify user owns the company\n 48→ const { data: company } = await supabase\n 49→ .from('companies')\n 50→ .select('id, name')\n 51→ .eq('id', company_id)\n 52→ .eq('profile_id', user.id)\n 53→ .single();\n 54→\n 55→ if (!company) {\n 56→ return NextResponse.json({ error: 'Company not found or unauthorized' }, { status: 403 });\n 57→ }\n 58→\n 59→ // Verify match exists and belongs to company's job (can be in any status except rejected)\n 60→ const { data: match } = await supabase\n 61→ .from('matches')\n 62→ .select('status, jobs!inner(company_id, title)')\n 63→ .eq('id', match_id)\n 64→ .neq('status', 'rejected')\n 65→ .eq('jobs.company_id', company_id)\n 66→ .single();\n 67→\n 68→ if (!match) {\n 69→ return NextResponse.json({ error: 'Match not found, already rejected, or unauthorized' }, { status: 403 });\n 70→ }\n 71→\n 72→ // Check if payment already exists for this match\n 73→ const { data: existingPayment } = await supabase\n 74→ .from('payments')\n 75→ .select('id, status, stripe_payment_id')\n 76→ .eq('match_id', match_id)\n 77→ .single();\n 78→\n 79→ if (existingPayment?.status === 'charged') {\n 80→ return NextResponse.json({ error: 'Payment already completed for this hire' }, { status: 400 });\n 81→ }\n 82→\n 83→ // Create Stripe PaymentIntent\n 84→ const jobTitle = (match.jobs as { title?: string }).title || 'Job';\n 85→ const { clientSecret, paymentIntentId } = await createPaymentIntent({\n 86→ amount,\n 87→ matchId: match_id,\n 88→ companyId: company_id,\n 89→ companyName: company.name,\n 90→ description: `Hire for ${jobTitle}`,\n 91→ });\n 92→\n 93→ // Create or update payment record using service role\n 94→ const supabaseService = getSupabaseAdmin();\n 95→ \n 96→ let payment;\n 97→ if (existingPayment) {\n 98→ // Update existing payment record with new PaymentIntent\n 99→ const { data: updatedPayment, error } = await supabaseService\n 100→ .from('payments')\n 101→ .update({\n 102→ stripe_payment_id: paymentIntentId,\n 103→ amount,\n 104→ status: 'pending',\n 105→ })\n 106→ .eq('id', existingPayment.id)\n 107→ .select()\n 108→ .single();\n 109→ \n 110→ if (error) {\n 111→ return NextResponse.json({ error: error.message }, { status: 500 });\n 112→ }\n 113→ payment = updatedPayment;\n 114→ } else {\n 115→ // Create new payment record\n 116→ const { data: newPayment, error } = await supabaseService\n 117→ .from('payments')\n 118→ .insert({\n 119→ match_id,\n 120→ company_id,\n 121→ amount,\n 122→ status: 'pending',\n 123→ stripe_payment_id: paymentIntentId,\n 124→ })\n 125→ .select()\n 126→ .single();\n 127→\n 128→ if (error) {\n 129→ return NextResponse.json({ error: error.message }, { status: 500 });\n 130→ }\n 131→ payment = newPayment;\n 132→ }\n 133→\n 134→ return NextResponse.json({ \n 135→ payment,\n 136→ clientSecret,\n 137→ publishableKey: process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY,\n 138→ });\n 139→ } catch (error) {\n 140→ console.error('Payment creation error:', error);\n 141→ if (error instanceof Error && error.message.includes('Stripe')) {\n 142→ return NextResponse.json({ error: 'Payment service unavailable' }, { status: 503 });\n 143→ }\n 144→ return NextResponse.json({ error: 'Internal server error' }, { status: 500 });\n 145→ }\n 146→}\n 147→\n 148→// Apply CSRF protection to the handler\n 149→export const POST = withCSRFProtection(handler);\n 150→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { createCSRTEndpoint } from '@/lib/csrf';\n 3→import { createClient } from '@/lib/supabase/server';\n 4→\n 5→/**\n 6→ * CSRF Token Endpoint\n 7→ * Generates and returns a CSRF token for authenticated users\n 8→ * This should be called after successful authentication\n 9→ */\n 10→export async function GET(request: NextRequest) {\n 11→ try {\n 12→ // Check if user is authenticated\n 13→ const supabase = await createClient();\n 14→ const { data: { user } } = await supabase.auth.getUser();\n 15→ \n 16→ if (!user) {\n 17→ return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n 18→ }\n 19→ \n 20→ // Create and return CSRF token\n 21→ return createCSRTEndpoint(request);\n 22→ } catch (error) {\n 23→ console.error('CSRF token generation error:', error);\n 24→ return NextResponse.json({ error: 'Internal server error' }, { status: 500 });\n 25→ }\n 26→}\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→/**\n 2→ * Email verification API endpoint\n 3→ * Placeholder for email verification\n 4→ */\n 5→\n 6→import { NextRequest, NextResponse } from 'next/server'\n 7→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit'\n 8→import { withCSRFProtection } from '@/lib/csrf'\n 9→\n 10→// Rate limit: 5 requests per 15 minutes per IP (auth endpoint)\n 11→const VERIFY_RATE_LIMIT = 5;\n 12→const VERIFY_WINDOW_MS = 15 * 60 * 1000;\n 13→\n 14→const handler = async (request: NextRequest) => {\n 15→ try {\n 16→ // --- Rate limiting ---\n 17→ const clientIP = getClientIP(request);\n 18→ const rateLimit = checkRateLimit(`verify-email:${clientIP}`, VERIFY_RATE_LIMIT, VERIFY_WINDOW_MS);\n 19→ \n 20→ if (!rateLimit.allowed) {\n 21→ const retryAfter = Math.ceil((rateLimit.resetTime - Date.now()) / 1000);\n 22→ return createRateLimitResponse(clientIP, retryAfter);\n 23→ }\n 24→ \n 25→ const { userId, token } = await request.json()\n 26→ \n 27→ if (!userId || !token) {\n 28→ return NextResponse.json({ error: 'Missing required fields' }, { status: 400 })\n 29→ }\n 30→ \n 31→ // In production, implement proper token validation\n 32→ // For now, return success\n 33→ \n 34→ return NextResponse.json({ \n 35→ success: true,\n 36→ message: 'Email verification endpoint ready'\n 37→ })\n 38→ \n 39→ } catch (error) {\n 40→ console.error('Email verification error:', error)\n 41→ return NextResponse.json(\n 42→ { error: 'Internal server error' },\n 43→ { status: 500 }\n 44→ )\n 45→ }\n 46→}\n 47→\n 48→// Apply CSRF protection to the handler\n 49→export const POST = withCSRFProtection(handler);\n 50→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit';\n 3→\n 4→// Cache to store logo URLs (in production, use Redis or database)\n 5→const logoCache = new Map();\n 6→const CACHE_DURATION = 24 * 60 * 60 * 1000; // 24 hours\n 7→\n 8→interface LogoResponse {\n 9→ logoUrl: string | null;\n 10→ source: 'clearbit' | 'google' | 'none';\n 11→}\n 12→\n 13→// Rate limit: 30 requests per 15 minutes per IP\n 14→const LOGO_RATE_LIMIT = 30;\n 15→const LOGO_WINDOW_MS = 15 * 60 * 1000;\n 16→\n 17→async function checkLogoExists(url: string): Promise {\n 18→ try {\n 19→ const response = await fetch(url, {\n 20→ method: 'HEAD',\n 21→ headers: {\n 22→ 'User-Agent': 'RateRight/1.0',\n 23→ },\n 24→ });\n 25→ return response.ok;\n 26→ } catch {\n 27→ return false;\n 28→ }\n 29→}\n 30→\n 31→export async function GET(request: NextRequest) {\n 32→ try {\n 33→ // --- Rate limiting ---\n 34→ const clientIP = getClientIP(request);\n 35→ const rateLimit = checkRateLimit(`company-logo:${clientIP}`, LOGO_RATE_LIMIT, LOGO_WINDOW_MS);\n 36→ \n 37→ if (!rateLimit.allowed) {\n 38→ const retryAfter = Math.ceil((rateLimit.resetTime - Date.now()) / 1000);\n 39→ return createRateLimitResponse(clientIP, retryAfter);\n 40→ }\n 41→ \n 42→ const searchParams = request.nextUrl.searchParams;\n 43→ const domain = searchParams.get('domain');\n 44→\n 45→ if (!domain) {\n 46→ return NextResponse.json(\n 47→ { logoUrl: null, source: 'none' },\n 48→ { status: 400, headers: getCORSHeaders(request) }\n 49→ );\n 50→ }\n 51→\n 52→ // Clean the domain (remove protocol if present)\n 53→ const cleanDomain = domain.replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');\n 54→ \n 55→ // Check cache first\n 56→ const cacheKey = cleanDomain;\n 57→ const cached = logoCache.get(cacheKey);\n 58→ if (cached && Date.now() - cached.timestamp < CACHE_DURATION) {\n 59→ return NextResponse.json({\n 60→ logoUrl: cached.logoUrl,\n 61→ source: cached.source as LogoResponse['source'],\n 62→ }, {\n 63→ headers: getCORSHeaders(request),\n 64→ });\n 65→ }\n 66→\n 67→ // Try Clearbit Logo API first\n 68→ const clearbitUrl = `https://logo.clearbit.com/${cleanDomain}`;\n 69→ const clearbitExists = await checkLogoExists(clearbitUrl);\n 70→ \n 71→ if (clearbitExists) {\n 72→ logoCache.set(cacheKey, {\n 73→ logoUrl: clearbitUrl,\n 74→ source: 'clearbit',\n 75→ timestamp: Date.now(),\n 76→ });\n 77→ \n 78→ return NextResponse.json({\n 79→ logoUrl: clearbitUrl,\n 80→ source: 'clearbit',\n 81→ }, {\n 82→ headers: getCORSHeaders(request),\n 83→ });\n 84→ }\n 85→\n 86→ // Try Google Favicon as fallback\n 87→ const googleUrl = `https://www.google.com/s2/favicons?domain=${cleanDomain}&sz=128`;\n 88→ const googleExists = await checkLogoExists(googleUrl);\n 89→ \n 90→ if (googleExists) {\n 91→ logoCache.set(cacheKey, {\n 92→ logoUrl: googleUrl,\n 93→ source: 'google',\n 94→ timestamp: Date.now(),\n 95→ });\n 96→ \n 97→ return NextResponse.json({\n 98→ logoUrl: googleUrl,\n 99→ source: 'google',\n 100→ }, {\n 101→ headers: getCORSHeaders(request),\n 102→ });\n 103→ }\n 104→\n 105→ // No logo found\n 106→ logoCache.set(cacheKey, {\n 107→ logoUrl: null,\n 108→ source: 'none',\n 109→ timestamp: Date.now(),\n 110→ });\n 111→\n 112→ return NextResponse.json({\n 113→ logoUrl: null,\n 114→ source: 'none',\n 115→ }, {\n 116→ headers: getCORSHeaders(request),\n 117→ });\n 118→\n 119→ } catch (error) {\n 120→ console.error('Logo fetch error:', error);\n 121→ \n 122→ return NextResponse.json(\n 123→ { logoUrl: null, source: 'none' },\n 124→ { status: 500, headers: getCORSHeaders(request) }\n 125→ );\n 126→ }\n 127→}\n 128→\n 129→// CORS configuration - restrict to known origins\n 130→const ALLOWED_ORIGINS = [\n 131→ process.env.NEXT_PUBLIC_APP_URL, // Production URL from env\n 132→ 'http://localhost:3000', // Local development\n 133→ 'https://localhost:3000', // Local development with HTTPS\n 134→].filter(Boolean) as string[];\n 135→\n 136→function getCORSHeaders(request: NextRequest): Record {\n 137→ const origin = request.headers.get('origin');\n 138→ \n 139→ // Only allow specific origins, no wildcards (H5 fix)\n 140→ const allowedOrigin = origin && ALLOWED_ORIGINS.includes(origin) \n 141→ ? origin \n 142→ : ALLOWED_ORIGINS[0] || 'null';\n 143→ \n 144→ return {\n 145→ 'Access-Control-Allow-Origin': allowedOrigin,\n 146→ 'Access-Control-Allow-Methods': 'GET, OPTIONS',\n 147→ 'Access-Control-Allow-Headers': 'Content-Type',\n 148→ 'Vary': 'Origin',\n 149→ };\n 150→}\n 151→\n 152→// Add OPTIONS handler for CORS\n 153→export async function OPTIONS(request: NextRequest) {\n 154→ return new NextResponse(null, {\n 155→ status: 200,\n 156→ headers: getCORSHeaders(request),\n 157→ });\n 158→}\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { constructWebhookEvent, stripe } from '@/lib/stripe/server';\n 3→import { getSupabaseAdmin } from '@/lib/supabase/server';\n 4→import type Stripe from 'stripe';\n 5→\n 6→// Disable body parsing for webhook verification\n 7→export const runtime = 'nodejs';\n 8→export const dynamic = 'force-dynamic';\n 9→\n 10→export async function POST(request: NextRequest) {\n 11→ try {\n 12→ // Get the raw body as text for signature verification\n 13→ const payload = await request.text();\n 14→ const signature = request.headers.get('stripe-signature');\n 15→\n 16→ if (!signature) {\n 17→ return NextResponse.json({ error: 'Missing stripe-signature header' }, { status: 400 });\n 18→ }\n 19→\n 20→ // Verify webhook signature and construct event\n 21→ let event: Stripe.Event;\n 22→ try {\n 23→ event = constructWebhookEvent(payload, signature);\n 24→ } catch (error) {\n 25→ console.error('Webhook signature verification failed:', error);\n 26→ return NextResponse.json({ error: 'Invalid signature' }, { status: 400 });\n 27→ }\n 28→\n 29→ const supabaseService = getSupabaseAdmin();\n 30→\n 31→ // Handle specific event types\n 32→ switch (event.type) {\n 33→ case 'payment_intent.succeeded': {\n 34→ const paymentIntent = event.data.object as Stripe.PaymentIntent;\n 35→ await handlePaymentSuccess(supabaseService, paymentIntent);\n 36→ break;\n 37→ }\n 38→\n 39→ case 'payment_intent.payment_failed': {\n 40→ const paymentIntent = event.data.object as Stripe.PaymentIntent;\n 41→ await handlePaymentFailure(supabaseService, paymentIntent);\n 42→ break;\n 43→ }\n 44→\n 45→ case 'payment_intent.canceled': {\n 46→ const paymentIntent = event.data.object as Stripe.PaymentIntent;\n 47→ await handlePaymentCancellation(supabaseService, paymentIntent);\n 48→ break;\n 49→ }\n 50→\n 51→ default:\n 52→ console.log(`Unhandled event type: ${event.type}`);\n 53→ }\n 54→\n 55→ return NextResponse.json({ received: true });\n 56→ } catch (error) {\n 57→ console.error('Webhook error:', error);\n 58→ return NextResponse.json({ error: 'Webhook processing failed' }, { status: 500 });\n 59→ }\n 60→}\n 61→\n 62→async function handlePaymentSuccess(\n 63→ supabase: ReturnType,\n 64→ paymentIntent: Stripe.PaymentIntent\n 65→) {\n 66→ const matchId = paymentIntent.metadata?.match_id;\n 67→ \n 68→ if (!matchId) {\n 69→ console.error('No match_id in payment intent metadata');\n 70→ return;\n 71→ }\n 72→\n 73→ try {\n 74→ // Update payment status to charged\n 75→ const { data: payment, error: paymentError } = await supabase\n 76→ .from('payments')\n 77→ .update({\n 78→ status: 'charged',\n 79→ })\n 80→ .eq('stripe_payment_id', paymentIntent.id)\n 81→ .select('id, match_id, company_id')\n 82→ .single();\n 83→\n 84→ if (paymentError) {\n 85→ console.error('Error updating payment status:', paymentError);\n 86→ return;\n 87→ }\n 88→\n 89→ if (!payment) {\n 90→ console.error('Payment not found for intent:', paymentIntent.id);\n 91→ return;\n 92→ }\n 93→\n 94→ // Update match status to hired\n 95→ const { error: matchError } = await supabase\n 96→ .from('matches')\n 97→ .update({\n 98→ status: 'hired',\n 99→ contractor_action: 'accepted',\n 100→ hired_at: new Date().toISOString(),\n 101→ fee_charged: true,\n 102→ })\n 103→ .eq('id', matchId);\n 104→\n 105→ if (matchError) {\n 106→ console.error('Error updating match status:', matchError);\n 107→ return;\n 108→ }\n 109→\n 110→ // Create notification for worker\n 111→ const { data: match } = await supabase\n 112→ .from('matches')\n 113→ .select('worker_id, jobs(title)')\n 114→ .eq('id', matchId)\n 115→ .single();\n 116→\n 117→ if (match) {\n 118→ const jobTitle = (match.jobs as { title?: string }).title || 'a job';\n 119→ await supabase.from('notifications').insert({\n 120→ profile_id: match.worker_id,\n 121→ type: 'hire_confirmed',\n 122→ title: 'You\\'ve been hired!',\n 123→ body: `Congratulations! You've been hired for ${jobTitle}.`,\n 124→ data: { match_id: matchId, payment_id: payment.id },\n 125→ });\n 126→ }\n 127→\n 128→ console.log('Payment success processed for match:', matchId);\n 129→ } catch (error) {\n 130→ console.error('Error processing payment success:', error);\n 131→ }\n 132→}\n 133→\n 134→async function handlePaymentFailure(\n 135→ supabase: ReturnType,\n 136→ paymentIntent: Stripe.PaymentIntent\n 137→) {\n 138→ try {\n 139→ const { error } = await supabase\n 140→ .from('payments')\n 141→ .update({\n 142→ status: 'pending', // Keep as pending to allow retry\n 143→ })\n 144→ .eq('stripe_payment_id', paymentIntent.id);\n 145→\n 146→ if (error) {\n 147→ console.error('Error updating payment failure:', error);\n 148→ }\n 149→\n 150→ console.log('Payment failed for intent:', paymentIntent.id);\n 151→ } catch (error) {\n 152→ console.error('Error handling payment failure:', error);\n 153→ }\n 154→}\n 155→\n 156→async function handlePaymentCancellation(\n 157→ supabase: ReturnType,\n 158→ paymentIntent: Stripe.PaymentIntent\n 159→) {\n 160→ try {\n 161→ const { error } = await supabase\n 162→ .from('payments')\n 163→ .delete()\n 164→ .eq('stripe_payment_id', paymentIntent.id)\n 165→ .eq('status', 'pending');\n 166→\n 167→ if (error) {\n 168→ console.error('Error deleting cancelled payment:', error);\n 169→ }\n 170→\n 171→ console.log('Payment cancelled for intent:', paymentIntent.id);\n 172→ } catch (error) {\n 173→ console.error('Error handling payment cancellation:', error);\n 174→ }\n 175→}\n 176→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit';\n 3→\n 4→// Cache to store logo URLs (in production, use Redis or database)\n 5→const logoCache = new Map();\n 6→const CACHE_DURATION = 24 * 60 * 60 * 1000; // 24 hours\n 7→\n 8→interface LogoResponse {\n 9→ logoUrl: string | null;\n 10→ source: 'clearbit' | 'google' | 'none';\n 11→}\n 12→\n 13→// Rate limit: 30 requests per 15 minutes per IP\n 14→const LOGO_RATE_LIMIT = 30;\n 15→const LOGO_WINDOW_MS = 15 * 60 * 1000;\n 16→\n 17→async function checkLogoExists(url: string): Promise {\n 18→ try {\n 19→ const response = await fetch(url, {\n 20→ method: 'HEAD',\n 21→ headers: {\n 22→ 'User-Agent': 'RateRight/1.0',\n 23→ },\n 24→ });\n 25→ return response.ok;\n 26→ } catch {\n 27→ return false;\n 28→ }\n 29→}\n 30→\n 31→export async function GET(request: NextRequest) {\n 32→ try {\n 33→ // --- Rate limiting ---\n 34→ const clientIP = getClientIP(request);\n 35→ const rateLimit = checkRateLimit(`company-logo:${clientIP}`, LOGO_RATE_LIMIT, LOGO_WINDOW_MS);\n 36→ \n 37→ if (!rateLimit.allowed) {\n 38→ const retryAfter = Math.ceil((rateLimit.resetTime - Date.now()) / 1000);\n 39→ return createRateLimitResponse(clientIP, retryAfter);\n 40→ }\n 41→ \n 42→ const searchParams = request.nextUrl.searchParams;\n 43→ const domain = searchParams.get('domain');\n 44→\n 45→ if (!domain) {\n 46→ return NextResponse.json(\n 47→ { logoUrl: null, source: 'none' },\n 48→ { status: 400, headers: getCORSHeaders(request) }\n 49→ );\n 50→ }\n 51→\n 52→ // Clean the domain (remove protocol if present)\n 53→ const cleanDomain = domain.replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');\n 54→ \n 55→ // Check cache first\n 56→ const cacheKey = cleanDomain;\n 57→ const cached = logoCache.get(cacheKey);\n 58→ if (cached && Date.now() - cached.timestamp < CACHE_DURATION) {\n 59→ return NextResponse.json({\n 60→ logoUrl: cached.logoUrl,\n 61→ source: cached.source as LogoResponse['source'],\n 62→ }, {\n 63→ headers: getCORSHeaders(request),\n 64→ });\n 65→ }\n 66→\n 67→ // Try Clearbit Logo API first\n 68→ const clearbitUrl = `https://logo.clearbit.com/${cleanDomain}`;\n 69→ const clearbitExists = await checkLogoExists(clearbitUrl);\n 70→ \n 71→ if (clearbitExists) {\n 72→ logoCache.set(cacheKey, {\n 73→ logoUrl: clearbitUrl,\n 74→ source: 'clearbit',\n 75→ timestamp: Date.now(),\n 76→ });\n 77→ \n 78→ return NextResponse.json({\n 79→ logoUrl: clearbitUrl,\n 80→ source: 'clearbit',\n 81→ }, {\n 82→ headers: getCORSHeaders(request),\n 83→ });\n 84→ }\n 85→\n 86→ // Try Google Favicon as fallback\n 87→ const googleUrl = `https://www.google.com/s2/favicons?domain=${cleanDomain}&sz=128`;\n 88→ const googleExists = await checkLogoExists(googleUrl);\n 89→ \n 90→ if (googleExists) {\n 91→ logoCache.set(cacheKey, {\n 92→ logoUrl: googleUrl,\n 93→ source: 'google',\n 94→ timestamp: Date.now(),\n 95→ });\n 96→ \n 97→ return NextResponse.json({\n 98→ logoUrl: googleUrl,\n 99→ source: 'google',\n 100→ }, {\n 101→ headers: getCORSHeaders(request),\n 102→ });\n 103→ }\n 104→\n 105→ // No logo found\n 106→ logoCache.set(cacheKey, {\n 107→ logoUrl: null,\n 108→ source: 'none',\n 109→ timestamp: Date.now(),\n 110→ });\n 111→\n 112→ return NextResponse.json({\n 113→ logoUrl: null,\n 114→ source: 'none',\n 115→ }, {\n 116→ headers: getCORSHeaders(request),\n 117→ });\n 118→\n 119→ } catch (error) {\n 120→ console.error('Logo fetch error:', error);\n 121→ \n 122→ return NextResponse.json(\n 123→ { logoUrl: null, source: 'none' },\n 124→ { status: 500, headers: getCORSHeaders(request) }\n 125→ );\n 126→ }\n 127→}\n 128→\n 129→// CORS configuration - restrict to known origins\n 130→const ALLOWED_ORIGINS = [\n 131→ process.env.NEXT_PUBLIC_APP_URL, // Production URL from env\n 132→ 'http://localhost:3000', // Local development\n 133→ 'https://localhost:3000', // Local development with HTTPS\n 134→].filter(Boolean) as string[];\n 135→\n 136→function getCORSHeaders(request: NextRequest): Record {\n 137→ const origin = request.headers.get('origin');\n 138→ \n 139→ // Only allow specific origins, no wildcards (H5 fix)\n 140→ const allowedOrigin = origin && ALLOWED_ORIGINS.includes(origin) \n 141→ ? origin \n 142→ : ALLOWED_ORIGINS[0] || 'null';\n 143→ \n 144→ return {\n 145→ 'Access-Control-Allow-Origin': allowedOrigin,\n 146→ 'Access-Control-Allow-Methods': 'GET, OPTIONS',\n 147→ 'Access-Control-Allow-Headers': 'Content-Type',\n 148→ 'Vary': 'Origin',\n 149→ };\n 150→}\n 151→\n 152→// Add OPTIONS handler for CORS\n 153→export async function OPTIONS(request: NextRequest) {\n 154→ return new NextResponse(null, {\n 155→ status: 200,\n 156→ headers: getCORSHeaders(request),\n 157→ });\n 158→}\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { getSupabaseAdmin, createClient } from '@/lib/supabase/server';\n 2→import { NextRequest, NextResponse } from 'next/server';\n 3→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit';\n 4→import { createPaymentIntent } from '@/lib/stripe/server';\n 5→import { withCSRFProtection } from '@/lib/csrf';\n 6→\n 7→// Rate limit: 10 requests per 15 minutes per user (sensitive financial operation)\n 8→const PAYMENT_RATE_LIMIT = 10;\n 9→const PAYMENT_WINDOW_MS = 15 * 60 * 1000;\n 10→\n 11→const handler = async (request: NextRequest) => {\n 12→ try {\n 13→ // --- Rate limiting (by IP as initial check) ---\n 14→ const clientIP = getClientIP(request);\n 15→ const ipRateLimit = checkRateLimit(`payment-ip:${clientIP}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 16→ \n 17→ if (!ipRateLimit.allowed) {\n 18→ const retryAfter = Math.ceil((ipRateLimit.resetTime - Date.now()) / 1000);\n 19→ return createRateLimitResponse(clientIP, retryAfter);\n 20→ }\n 21→ \n 22→ const supabase = await createClient();\n 23→ const {\n 24→ data: { user },\n 25→ } = await supabase.auth.getUser();\n 26→ \n 27→ if (!user) {\n 28→ return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n 29→ }\n 30→ \n 31→ // --- Stricter rate limiting by user ID ---\n 32→ const userRateLimit = checkRateLimit(`payment-user:${user.id}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 33→ \n 34→ if (!userRateLimit.allowed) {\n 35→ const retryAfter = Math.ceil((userRateLimit.resetTime - Date.now()) / 1000);\n 36→ return createRateLimitResponse(user.id, retryAfter);\n 37→ }\n 38→\n 39→ const body = await request.json();\n 40→ const { match_id, company_id } = body;\n 41→ const amount = 50.0; // Hardcoded amount to prevent client override\n 42→\n 43→ if (!match_id || !company_id) {\n 44→ return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });\n 45→ }\n 46→\n 47→ // Verify user owns the company\n 48→ const { data: company } = await supabase\n 49→ .from('companies')\n 50→ .select('id, name')\n 51→ .eq('id', company_id)\n 52→ .eq('profile_id', user.id)\n 53→ .single();\n 54→\n 55→ if (!company) {\n 56→ return NextResponse.json({ error: 'Company not found or unauthorized' }, { status: 403 });\n 57→ }\n 58→\n 59→ // Verify match exists and belongs to company's job (can be in any status except rejected)\n 60→ const { data: match } = await supabase\n 61→ .from('matches')\n 62→ .select('status, jobs!inner(company_id, title)')\n 63→ .eq('id', match_id)\n 64→ .neq('status', 'rejected')\n 65→ .eq('jobs.company_id', company_id)\n 66→ .single();\n 67→\n 68→ if (!match) {\n 69→ return NextResponse.json({ error: 'Match not found, already rejected, or unauthorized' }, { status: 403 });\n 70→ }\n 71→\n 72→ // Check if payment already exists for this match\n 73→ const { data: existingPayment } = await supabase\n 74→ .from('payments')\n 75→ .select('id, status, stripe_payment_id')\n 76→ .eq('match_id', match_id)\n 77→ .single();\n 78→\n 79→ if (existingPayment?.status === 'charged') {\n 80→ return NextResponse.json({ error: 'Payment already completed for this hire' }, { status: 400 });\n 81→ }\n 82→\n 83→ // Create Stripe PaymentIntent\n 84→ const jobTitle = (match.jobs as { title?: string }).title || 'Job';\n 85→ const { clientSecret, paymentIntentId } = await createPaymentIntent({\n 86→ amount,\n 87→ matchId: match_id,\n 88→ companyId: company_id,\n 89→ companyName: company.name,\n 90→ description: `Hire for ${jobTitle}`,\n 91→ });\n 92→\n 93→ // Create or update payment record using service role\n 94→ const supabaseService = getSupabaseAdmin();\n 95→ \n 96→ let payment;\n 97→ if (existingPayment) {\n 98→ // Update existing payment record with new PaymentIntent\n 99→ const { data: updatedPayment, error } = await supabaseService\n 100→ .from('payments')\n 101→ .update({\n 102→ stripe_payment_id: paymentIntentId,\n 103→ amount,\n 104→ status: 'pending',\n 105→ })\n 106→ .eq('id', existingPayment.id)\n 107→ .select()\n 108→ .single();\n 109→ \n 110→ if (error) {\n 111→ return NextResponse.json({ error: error.message }, { status: 500 });\n 112→ }\n 113→ payment = updatedPayment;\n 114→ } else {\n 115→ // Create new payment record\n 116→ const { data: newPayment, error } = await supabaseService\n 117→ .from('payments')\n 118→ .insert({\n 119→ match_id,\n 120→ company_id,\n 121→ amount,\n 122→ status: 'pending',\n 123→ stripe_payment_id: paymentIntentId,\n 124→ })\n 125→ .select()\n 126→ .single();\n 127→\n 128→ if (error) {\n 129→ return NextResponse.json({ error: error.message }, { status: 500 });\n 130→ }\n 131→ payment = newPayment;\n 132→ }\n 133→\n 134→ return NextResponse.json({ \n 135→ payment,\n 136→ clientSecret,\n 137→ publishableKey: process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY,\n 138→ });\n 139→ } catch (error) {\n 140→ console.error('Payment creation error:', error);\n 141→ if (error instanceof Error && error.message.includes('Stripe')) {\n 142→ return NextResponse.json({ error: 'Payment service unavailable' }, { status: 503 });\n 143→ }\n 144→ return NextResponse.json({ error: 'Internal server error' }, { status: 500 });\n 145→ }\n 146→}\n 147→\n 148→// Apply CSRF protection to the handler\n 149→export const POST = withCSRFProtection(handler);\n 150→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { getSupabaseAdmin, createClient } from '@/lib/supabase/server';\n 2→import { NextRequest, NextResponse } from 'next/server';\n 3→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit';\n 4→import { createPaymentIntent } from '@/lib/stripe/server';\n 5→import { withCSRFProtection } from '@/lib/csrf';\n 6→\n 7→// Rate limit: 10 requests per 15 minutes per user (sensitive financial operation)\n 8→const PAYMENT_RATE_LIMIT = 10;\n 9→const PAYMENT_WINDOW_MS = 15 * 60 * 1000;\n 10→\n 11→const handler = async (request: NextRequest) => {\n 12→ try {\n 13→ // --- Rate limiting (by IP as initial check) ---\n 14→ const clientIP = getClientIP(request);\n 15→ const ipRateLimit = checkRateLimit(`payment-ip:${clientIP}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 16→ \n 17→ if (!ipRateLimit.allowed) {\n 18→ const retryAfter = Math.ceil((ipRateLimit.resetTime - Date.now()) / 1000);\n 19→ return createRateLimitResponse(clientIP, retryAfter);\n 20→ }\n 21→ \n 22→ const supabase = await createClient();\n 23→ const {\n 24→ data: { user },\n 25→ } = await supabase.auth.getUser();\n 26→ \n 27→ if (!user) {\n 28→ return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n 29→ }\n 30→ \n 31→ // --- Stricter rate limiting by user ID ---\n 32→ const userRateLimit = checkRateLimit(`payment-user:${user.id}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 33→ \n 34→ if (!userRateLimit.allowed) {\n 35→ const retryAfter = Math.ceil((userRateLimit.resetTime - Date.now()) / 1000);\n 36→ return createRateLimitResponse(user.id, retryAfter);\n 37→ }\n 38→\n 39→ const body = await request.json();\n 40→ const { match_id, company_id } = body;\n 41→ const amount = 50.0; // Hardcoded amount to prevent client override\n 42→\n 43→ if (!match_id || !company_id) {\n 44→ return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });\n 45→ }\n 46→\n 47→ // Verify user owns the company\n 48→ const { data: company } = await supabase\n 49→ .from('companies')\n 50→ .select('id, name')\n 51→ .eq('id', company_id)\n 52→ .eq('profile_id', user.id)\n 53→ .single();\n 54→\n 55→ if (!company) {\n 56→ return NextResponse.json({ error: 'Company not found or unauthorized' }, { status: 403 });\n 57→ }\n 58→\n 59→ // Verify match exists and belongs to company's job (can be in any status except rejected)\n 60→ const { data: match } = await supabase\n 61→ .from('matches')\n 62→ .select('status, jobs!inner(company_id, title)')\n 63→ .eq('id', match_id)\n 64→ .neq('status', 'rejected')\n 65→ .eq('jobs.company_id', company_id)\n 66→ .single();\n 67→\n 68→ if (!match) {\n 69→ return NextResponse.json({ error: 'Match not found, already rejected, or unauthorized' }, { status: 403 });\n 70→ }\n 71→\n 72→ // Check if payment already exists for this match\n 73→ const { data: existingPayment } = await supabase\n 74→ .from('payments')\n 75→ .select('id, status, stripe_payment_id')\n 76→ .eq('match_id', match_id)\n 77→ .single();\n 78→\n 79→ if (existingPayment?.status === 'charged') {\n 80→ return NextResponse.json({ error: 'Payment already completed for this hire' }, { status: 400 });\n 81→ }\n 82→\n 83→ // Create Stripe PaymentIntent\n 84→ const jobTitle = (match.jobs as { title?: string }).title || 'Job';\n 85→ const { clientSecret, paymentIntentId } = await createPaymentIntent({\n 86→ amount,\n 87→ matchId: match_id,\n 88→ companyId: company_id,\n 89→ companyName: company.name,\n 90→ description: `Hire for ${jobTitle}`,\n 91→ });\n 92→\n 93→ // Create or update payment record using service role\n 94→ const supabaseService = getSupabaseAdmin();\n 95→ \n 96→ let payment;\n 97→ if (existingPayment) {\n 98→ // Update existing payment record with new PaymentIntent\n 99→ const { data: updatedPayment, error } = await supabaseService\n 100→ .from('payments')\n 101→ .update({\n 102→ stripe_payment_id: paymentIntentId,\n 103→ amount,\n 104→ status: 'pending',\n 105→ })\n 106→ .eq('id', existingPayment.id)\n 107→ .select()\n 108→ .single();\n 109→ \n 110→ if (error) {\n 111→ return NextResponse.json({ error: error.message }, { status: 500 });\n 112→ }\n 113→ payment = updatedPayment;\n 114→ } else {\n 115→ // Create new payment record\n 116→ const { data: newPayment, error } = await supabaseService\n 117→ .from('payments')\n 118→ .insert({\n 119→ match_id,\n 120→ company_id,\n 121→ amount,\n 122→ status: 'pending',\n 123→ stripe_payment_id: paymentIntentId,\n 124→ })\n 125→ .select()\n 126→ .single();\n 127→\n 128→ if (error) {\n 129→ return NextResponse.json({ error: error.message }, { status: 500 });\n 130→ }\n 131→ payment = newPayment;\n 132→ }\n 133→\n 134→ return NextResponse.json({ \n 135→ payment,\n 136→ clientSecret,\n 137→ publishableKey: process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY,\n 138→ });\n 139→ } catch (error) {\n 140→ console.error('Payment creation error:', error);\n 141→ if (error instanceof Error && error.message.includes('Stripe')) {\n 142→ return NextResponse.json({ error: 'Payment service unavailable' }, { status: 503 });\n 143→ }\n 144→ return NextResponse.json({ error: 'Internal server error' }, { status: 500 });\n 145→ }\n 146→}\n 147→\n 148→// Apply CSRF protection to the handler\n 149→export const POST = withCSRFProtection(handler);\n 150→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { constructWebhookEvent, stripe } from '@/lib/stripe/server';\n 3→import { getSupabaseAdmin } from '@/lib/supabase/server';\n 4→import type Stripe from 'stripe';\n 5→\n 6→// Disable body parsing for webhook verification\n 7→export const runtime = 'nodejs';\n 8→export const dynamic = 'force-dynamic';\n 9→\n 10→export async function POST(request: NextRequest) {\n 11→ try {\n 12→ // Get the raw body as text for signature verification\n 13→ const payload = await request.text();\n 14→ const signature = request.headers.get('stripe-signature');\n 15→\n 16→ if (!signature) {\n 17→ return NextResponse.json({ error: 'Missing stripe-signature header' }, { status: 400 });\n 18→ }\n 19→\n 20→ // Verify webhook signature and construct event\n 21→ let event: Stripe.Event;\n 22→ try {\n 23→ event = constructWebhookEvent(payload, signature);\n 24→ } catch (error) {\n 25→ console.error('Webhook signature verification failed:', error);\n 26→ return NextResponse.json({ error: 'Invalid signature' }, { status: 400 });\n 27→ }\n 28→\n 29→ const supabaseService = getSupabaseAdmin();\n 30→\n 31→ // Handle specific event types\n 32→ switch (event.type) {\n 33→ case 'payment_intent.succeeded': {\n 34→ const paymentIntent = event.data.object as Stripe.PaymentIntent;\n 35→ await handlePaymentSuccess(supabaseService, paymentIntent);\n 36→ break;\n 37→ }\n 38→\n 39→ case 'payment_intent.payment_failed': {\n 40→ const paymentIntent = event.data.object as Stripe.PaymentIntent;\n 41→ await handlePaymentFailure(supabaseService, paymentIntent);\n 42→ break;\n 43→ }\n 44→\n 45→ case 'payment_intent.canceled': {\n 46→ const paymentIntent = event.data.object as Stripe.PaymentIntent;\n 47→ await handlePaymentCancellation(supabaseService, paymentIntent);\n 48→ break;\n 49→ }\n 50→\n 51→ default:\n 52→ console.log(`Unhandled event type: ${event.type}`);\n 53→ }\n 54→\n 55→ return NextResponse.json({ received: true });\n 56→ } catch (error) {\n 57→ console.error('Webhook error:', error);\n 58→ return NextResponse.json({ error: 'Webhook processing failed' }, { status: 500 });\n 59→ }\n 60→}\n 61→\n 62→async function handlePaymentSuccess(\n 63→ supabase: ReturnType,\n 64→ paymentIntent: Stripe.PaymentIntent\n 65→) {\n 66→ const matchId = paymentIntent.metadata?.match_id;\n 67→ \n 68→ if (!matchId) {\n 69→ console.error('No match_id in payment intent metadata');\n 70→ return;\n 71→ }\n 72→\n 73→ try {\n 74→ // Update payment status to charged\n 75→ const { data: payment, error: paymentError } = await supabase\n 76→ .from('payments')\n 77→ .update({\n 78→ status: 'charged',\n 79→ })\n 80→ .eq('stripe_payment_id', paymentIntent.id)\n 81→ .select('id, match_id, company_id')\n 82→ .single();\n 83→\n 84→ if (paymentError) {\n 85→ console.error('Error updating payment status:', paymentError);\n 86→ return;\n 87→ }\n 88→\n 89→ if (!payment) {\n 90→ console.error('Payment not found for intent:', paymentIntent.id);\n 91→ return;\n 92→ }\n 93→\n 94→ // Update match status to hired\n 95→ const { error: matchError } = await supabase\n 96→ .from('matches')\n 97→ .update({\n 98→ status: 'hired',\n 99→ contractor_action: 'accepted',\n 100→ hired_at: new Date().toISOString(),\n 101→ fee_charged: true,\n 102→ })\n 103→ .eq('id', matchId);\n 104→\n 105→ if (matchError) {\n 106→ console.error('Error updating match status:', matchError);\n 107→ return;\n 108→ }\n 109→\n 110→ // Create notification for worker\n 111→ const { data: match } = await supabase\n 112→ .from('matches')\n 113→ .select('worker_id, jobs(title)')\n 114→ .eq('id', matchId)\n 115→ .single();\n 116→\n 117→ if (match) {\n 118→ const jobTitle = (match.jobs as { title?: string }).title || 'a job';\n 119→ await supabase.from('notifications').insert({\n 120→ profile_id: match.worker_id,\n 121→ type: 'hire_confirmed',\n 122→ title: 'You\\'ve been hired!',\n 123→ body: `Congratulations! You've been hired for ${jobTitle}.`,\n 124→ data: { match_id: matchId, payment_id: payment.id },\n 125→ });\n 126→ }\n 127→\n 128→ console.log('Payment success processed for match:', matchId);\n 129→ } catch (error) {\n 130→ console.error('Error processing payment success:', error);\n 131→ }\n 132→}\n 133→\n 134→async function handlePaymentFailure(\n 135→ supabase: ReturnType,\n 136→ paymentIntent: Stripe.PaymentIntent\n 137→) {\n 138→ try {\n 139→ const { error } = await supabase\n 140→ .from('payments')\n 141→ .update({\n 142→ status: 'pending', // Keep as pending to allow retry\n 143→ })\n 144→ .eq('stripe_payment_id', paymentIntent.id);\n 145→\n 146→ if (error) {\n 147→ console.error('Error updating payment failure:', error);\n 148→ }\n 149→\n 150→ console.log('Payment failed for intent:', paymentIntent.id);\n 151→ } catch (error) {\n 152→ console.error('Error handling payment failure:', error);\n 153→ }\n 154→}\n 155→\n 156→async function handlePaymentCancellation(\n 157→ supabase: ReturnType,\n 158→ paymentIntent: Stripe.PaymentIntent\n 159→) {\n 160→ try {\n 161→ const { error } = await supabase\n 162→ .from('payments')\n 163→ .delete()\n 164→ .eq('stripe_payment_id', paymentIntent.id)\n 165→ .eq('status', 'pending');\n 166→\n 167→ if (error) {\n 168→ console.error('Error deleting cancelled payment:', error);\n 169→ }\n 170→\n 171→ console.log('Payment cancelled for intent:', paymentIntent.id);\n 172→ } catch (error) {\n 173→ console.error('Error handling payment cancellation:', error);\n 174→ }\n 175→}\n 176→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":"/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts-197- acn?: string, \n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts-198- userEmail?: string\n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts-199-): Promise {\n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts:200: // TODO: Implement ASIC Connect API integration\n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts-201- // For now, flag all for manual review\n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts-202- \n/home/ccuser/the-50-dollar-app/src/app/api/abn-lookup/route.ts-203- console.log(`[ASIC] Director verification requested for ABN ${abn}, ACN ${acn || 'N/A'}`);\n--\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts-95- name: profile.name,\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts-96- avatar: profile.avatar_url,\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts-97- type: profile.type,\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts:98: isOnline: true // TODO: Implement online status\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts-99- },\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts-100- messages: messages?.map(msg => ({\n/home/ccuser/the-50-dollar-app/src/app/api/messages/[id]/route.ts-101- id: msg.id,"
"content":" 1→import { NextRequest, NextResponse } from 'next/server';\n 2→import { randomBytes } from 'crypto';\n 3→\n 4→// CSRF token configuration\n 5→const CSRF_TOKEN_LENGTH = 32;\n 6→const CSRF_COOKIE_NAME = 'csrf-token';\n 7→const CSRF_HEADER_NAME = 'x-csrf-token';\n 8→const CSRF_FORM_FIELD_NAME = 'csrf_token';\n 9→\n 10→/**\n 11→ * Generate a cryptographically secure CSRF token\n 12→ */\n 13→export function generateCSRFToken(): string {\n 14→ return randomBytes(CSRF_TOKEN_LENGTH).toString('hex');\n 15→}\n 16→\n 17→/**\n 18→ * Create a CSRF token and set it in a cookie\n 19→ */\n 20→export function createCSRFToken(): { token: string; cookie: string } {\n 21→ const token = generateCSRFToken();\n 22→ let cookie = `${CSRF_COOKIE_NAME}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`; // 24 hours\n 23→ \n 24→ // Add secure flag in production\n 25→ if (process.env.NODE_ENV === 'production' && process.env.NEXT_PUBLIC_APP_URL?.startsWith('https://')) {\n 26→ cookie += '; Secure';\n 27→ }\n 28→ \n 29→ return { token, cookie };\n 30→}\n 31→\n 32→/**\n 33→ * Get CSRF token from cookie\n 34→ */\n 35→export function getCSRFCookieToken(request: Request | NextRequest): string | null {\n 36→ // Check if it's a NextRequest with cookies property\n 37→ if ('cookies' in request && typeof request.cookies.get === 'function') {\n 38→ const cookie = request.cookies.get(CSRF_COOKIE_NAME);\n 39→ return cookie?.value || null;\n 40→ }\n 41→ \n 42→ // Fall back to parsing Cookie header for standard Request\n 43→ const cookieHeader = request.headers.get('cookie');\n 44→ if (!cookieHeader) return null;\n 45→ \n 46→ const cookies = cookieHeader.split(';');\n 47→ for (const cookie of cookies) {\n 48→ const [name, value] = cookie.trim().split('=');\n 49→ if (name === CSRF_COOKIE_NAME) {\n 50→ return value;\n 51→ }\n 52→ }\n 53→ return null;\n 54→}\n 55→\n 56→/**\n 57→ * Get CSRF token from request (header or form data)\n 58→ */\n 59→export function getCSRFRequestToken(request: Request | NextRequest): string | null {\n 60→ // Check header first\n 61→ const headerToken = request.headers.get(CSRF_HEADER_NAME);\n 62→ if (headerToken) return headerToken;\n 63→ \n 64→ // For form data, check in the request body (will need to parse appropriately)\n 65→ // This is handled in the validation function for JSON requests\n 66→ return null;\n 67→}\n 68→\n 69→/**\n 70→ * Validate CSRF token from request\n 71→ * For JSON requests: checks x-csrf-token header\n 72→ * For form requests: checks form field\n 73→ */\n 74→export async function validateCSRFToken(request: Request | NextRequest): Promise {\n 75→ const cookieToken = getCSRFCookieToken(request);\n 76→ \n 77→ if (!cookieToken) {\n 78→ console.error('CSRF validation failed: No token in cookie');\n 79→ return false;\n 80→ }\n 81→ \n 82→ let requestToken: string | null = null;\n 83→ \n 84→ // For JSON requests\n 85→ if (request.headers.get('content-type')?.includes('application/json')) {\n 86→ requestToken = request.headers.get(CSRF_HEADER_NAME);\n 87→ \n 88→ // If no header, check in JSON body\n 89→ if (!requestToken) {\n 90→ try {\n 91→ const body = await request.clone().json();\n 92→ requestToken = body[CSRF_FORM_FIELD_NAME] || null;\n 93→ } catch {\n 94→ // Ignore JSON parsing errors\n 95→ }\n 96→ }\n 97→ }\n 98→ \n 99→ // For form data requests\n 100→ else if (request.headers.get('content-type')?.includes('multipart/form-data')) {\n 101→ try {\n 102→ const formData = await request.clone().formData();\n 103→ requestToken = formData.get(CSRF_FORM_FIELD_NAME) as string;\n 104→ } catch {\n 105→ // Ignore form parsing errors\n 106→ }\n 107→ }\n 108→ \n 109→ if (!requestToken) {\n 110→ console.error('CSRF validation failed: No token in request');\n 111→ return false;\n 112→ }\n 113→ \n 114→ // Constant-time comparison to prevent timing attacks\n 115→ const tokensMatch = timingSafeEqual(cookieToken, requestToken);\n 116→ \n 117→ if (!tokensMatch) {\n 118→ console.error('CSRF validation failed: Token mismatch');\n 119→ return false;\n 120→ }\n 121→ \n 122→ return true;\n 123→}\n 124→\n 125→/**\n 126→ * Timing-safe string comparison\n 127→ */\n 128→function timingSafeEqual(a: string, b: string): boolean {\n 129→ if (a.length !== b.length) return false;\n 130→ \n 131→ let result = 0;\n 132→ for (let i = 0; i < a.length; i++) {\n 133→ result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n 134→ }\n 135→ \n 136→ return result === 0;\n 137→}\n 138→\n 139→/**\n 140→ * Check if request is same-origin\n 141→ */\n 142→export function isSameOrigin(request: Request | NextRequest): boolean {\n 143→ const origin = request.headers.get('origin');\n 144→ const referer = request.headers.get('referer');\n 145→ \n 146→ if (!origin && !referer) {\n 147→ // No origin/referer headers - reject the request to prevent CSRF bypass\n 148→ return false;\n 149→ }\n 150→ \n 151→ const checkUrl = origin || referer;\n 152→ if (!checkUrl) return false;\n 153→ \n 154→ try {\n 155→ const parsedUrl = new URL(checkUrl);\n 156→ const appUrl = new URL(process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000');\n 157→ \n 158→ return parsedUrl.origin === appUrl.origin;\n 159→ } catch {\n 160→ return false;\n 161→ }\n 162→}\n 163→\n 164→/**\n 165→ * CSRF protection middleware\n 166→ * Use this for routes that need CSRF protection\n 167→ */\n 168→export function withCSRFProtection(\n 169→ handler: (request: T) => Promise,\n 170→ options?: {\n 171→ requireSameOrigin?: boolean;\n 172→ skipValidation?: boolean;\n 173→ }\n 174→): (request: T) => Promise {\n 175→ return async (request: T) => {\n 176→ // Skip CSRF for GET, HEAD, OPTIONS requests\n 177→ if (['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {\n 178→ return handler(request);\n 179→ }\n 180→ \n 181→ // Check if request is same-origin (optional, but recommended)\n 182→ if (options?.requireSameOrigin !== false && !isSameOrigin(request)) {\n 183→ return NextResponse.json(\n 184→ { error: 'Cross-origin request not allowed' },\n 185→ { status: 403 }\n 186→ );\n 187→ }\n 188→ \n 189→ // Validate CSRF token (unless explicitly skipped)\n 190→ if (!options?.skipValidation) {\n 191→ const isValid = await validateCSRFToken(request);\n 192→ if (!isValid) {\n 193→ return NextResponse.json(\n 194→ { error: 'Invalid or missing CSRF token' },\n 195→ { status: 403 }\n 196→ );\n 197→ }\n 198→ }\n 199→ \n 200→ return handler(request);\n 201→ };\n 202→}\n 203→\n 204→/**\n 205→ * Create a CSRF token endpoint\n 206→ * This should be called when a user session starts\n 207→ */\n 208→export async function createCSRTEndpoint(request: NextRequest): Promise {\n 209→ if (request.method !== 'GET') {\n 210→ return NextResponse.json({ error: 'Method not allowed' }, { status: 405 });\n 211→ }\n 212→ \n 213→ const { token, cookie } = createCSRFToken();\n 214→ \n 215→ const response = NextResponse.json({ token });\n 216→ response.headers.append('Set-Cookie', cookie);\n 217→ \n 218→ return response;\n 219→}\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→/**\n 2→ * Client-side CSRF protection utilities\n 3→ */\n 4→\n 5→const CSRF_HEADER_NAME = 'x-csrf-token';\n 6→const CSRF_COOKIE_NAME = 'csrf-token';\n 7→\n 8→/**\n 9→ * Get CSRF token from cookie\n 10→ */\n 11→export function getCSRFCookie(): string | null {\n 12→ if (typeof document === 'undefined') return null;\n 13→ \n 14→ const cookies = document.cookie.split(';');\n 15→ for (const cookie of cookies) {\n 16→ const [name, value] = cookie.trim().split('=');\n 17→ if (name === CSRF_COOKIE_NAME) {\n 18→ return value;\n 19→ }\n 20→ }\n 21→ return null;\n 22→}\n 23→\n 24→/**\n 25→ * Fetch a new CSRF token from the server\n 26→ * This should be called after authentication\n 27→ */\n 28→export async function fetchCSRFToken(): Promise {\n 29→ try {\n 30→ const response = await fetch('/api/auth/csrf', {\n 31→ method: 'GET',\n 32→ credentials: 'include', // Include cookies\n 33→ });\n 34→ \n 35→ if (!response.ok) {\n 36→ console.error('Failed to fetch CSRF token:', response.status);\n 37→ return null;\n 38→ }\n 39→ \n 40→ const data = await response.json();\n 41→ return data.token || null;\n 42→ } catch (error) {\n 43→ console.error('Error fetching CSRF token:', error);\n 44→ return null;\n 45→ }\n 46→}\n 47→\n 48→/**\n 49→ * Add CSRF token to fetch options\n 50→ */\n 51→export function withCSRFToken(options: RequestInit = {}): RequestInit {\n 52→ const token = getCSRFCookie();\n 53→ \n 54→ if (!token) {\n 55→ console.warn('No CSRF token found in cookies');\n 56→ return options;\n 57→ }\n 58→ \n 59→ return {\n 60→ ...options,\n 61→ headers: {\n 62→ ...options.headers,\n 63→ [CSRF_HEADER_NAME]: token,\n 64→ },\n 65→ };\n 66→}\n 67→\n 68→/**\n 69→ * Enhanced fetch with CSRF protection\n 70→ */\n 71→export async function csrfFetch(input: RequestInfo | URL, options?: RequestInit): Promise {\n 72→ const enhancedOptions = withCSRFToken(options);\n 73→ return fetch(input, enhancedOptions);\n 74→}\n 75→\n 76→/**\n 77→ * Add CSRF token to form data\n 78→ */\n 79→export function addCSRFTokenToFormData(formData: FormData): FormData {\n 80→ const token = getCSRFCookie();\n 81→ \n 82→ if (token) {\n 83→ formData.append('csrf_token', token);\n 84→ } else {\n 85→ console.warn('No CSRF token found in cookies');\n 86→ }\n 87→ \n 88→ return formData;\n 89→}\n 90→\n 91→/**\n 92→ * Initialize CSRF token after authentication\n 93→ * Call this after successful login/signup\n 94→ */\n 95→export async function initializeCSRF(): Promise {\n 96→ const token = await fetchCSRFToken();\n 97→ return token !== null;\n 98→}\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→/**\n 2→ * Simple in-memory rate limiting for API endpoints\n 3→ * In production, use Redis or a proper rate limiting service\n 4→ * \n 5→ * SECURITY NOTES:\n 6→ * - This is an in-memory store, so rate limits are per-instance\n 7→ * - For multi-instance deployments, use Redis or a shared cache\n 8→ * - IP-based rate limiting can be bypassed by users with rotating IPs\n 9→ * - Consider adding user ID-based limiting for authenticated routes\n 10→ */\n 11→\n 12→interface RateLimitEntry {\n 13→ count: number;\n 14→ resetTime: number;\n 15→}\n 16→\n 17→const rateLimitStore = new Map();\n 18→const WINDOW_MS = 15 * 60 * 1000; // 15 minutes\n 19→const MAX_REQUESTS = 100; // 100 requests per window (more generous for general use)\n 20→\n 21→// Cleanup interval to prevent memory leaks (H14 fix)\n 22→const CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // Run cleanup every 5 minutes\n 23→let cleanupInterval: NodeJS.Timeout | null = null;\n 24→\n 25→/**\n 26→ * Start the cleanup interval to prevent memory leaks\n 27→ * This should be called once when the app starts\n 28→ */\n 29→export function startRateLimitCleanup(): void {\n 30→ if (cleanupInterval) return; // Already running\n 31→ \n 32→ cleanupInterval = setInterval(() => {\n 33→ const now = Date.now();\n 34→ let cleaned = 0;\n 35→ \n 36→ for (const [key, entry] of rateLimitStore.entries()) {\n 37→ if (now > entry.resetTime) {\n 38→ rateLimitStore.delete(key);\n 39→ cleaned++;\n 40→ }\n 41→ }\n 42→ \n 43→ if (cleaned > 0) {\n 44→ console.log(`[RateLimit] Cleaned up ${cleaned} expired entries`);\n 45→ }\n 46→ }, CLEANUP_INTERVAL_MS);\n 47→ \n 48→ // Ensure cleanup doesn't prevent process exit (for serverless)\n 49→ if (cleanupInterval.unref) {\n 50→ cleanupInterval.unref();\n 51→ }\n 52→}\n 53→\n 54→/**\n 55→ * Stop the cleanup interval (useful for testing)\n 56→ */\n 57→export function stopRateLimitCleanup(): void {\n 58→ if (cleanupInterval) {\n 59→ clearInterval(cleanupInterval);\n 60→ cleanupInterval = null;\n 61→ }\n 62→}\n 63→\n 64→/**\n 65→ * Get client IP address from request\n 66→ * Handles various proxy scenarios and falls back to 'unknown'\n 67→ */\n 68→export function getClientIP(request: Request): string {\n 69→ // Try X-Forwarded-For first (common proxy header)\n 70→ const forwarded = request.headers.get('x-forwarded-for');\n 71→ if (forwarded) {\n 72→ // X-Forwarded-For can be a comma-separated list; use the first (original client)\n 73→ return forwarded.split(',')[0].trim();\n 74→ }\n 75→ \n 76→ // Try other common headers\n 77→ const realIP = request.headers.get('x-real-ip');\n 78→ if (realIP) return realIP;\n 79→ \n 80→ // Fallback to a default (for serverless/edge environments)\n 81→ return 'unknown';\n 82→}\n 83→\n 84→/**\n 85→ * Check if request is allowed based on rate limit\n 86→ * @param identifier - Unique identifier (IP address, user ID, etc.)\n 87→ * @param maxRequests - Maximum requests allowed in the window (optional, uses default if not provided)\n 88→ * @param windowMs - Time window in milliseconds (optional, uses default if not provided)\n 89→ * @returns Object with allowed status and remaining requests\n 90→ */\n 91→export function checkRateLimit(\n 92→ identifier: string,\n 93→ maxRequests?: number,\n 94→ windowMs?: number\n 95→): {\n 96→ allowed: boolean;\n 97→ remaining: number;\n 98→ resetTime: number;\n 99→ totalLimit: number;\n 100→} {\n 101→ const limit = maxRequests ?? MAX_REQUESTS;\n 102→ const window = windowMs ?? WINDOW_MS;\n 103→ const now = Date.now();\n 104→ const entry = rateLimitStore.get(identifier);\n 105→ \n 106→ if (!entry || now > entry.resetTime) {\n 107→ // New window or expired\n 108→ rateLimitStore.set(identifier, {\n 109→ count: 1,\n 110→ resetTime: now + window,\n 111→ });\n 112→ return {\n 113→ allowed: true,\n 114→ remaining: limit - 1,\n 115→ resetTime: now + window,\n 116→ totalLimit: limit,\n 117→ };\n 118→ }\n 119→ \n 120→ if (entry.count >= limit) {\n 121→ // Rate limit exceeded\n 122→ return {\n 123→ allowed: false,\n 124→ remaining: 0,\n 125→ resetTime: entry.resetTime,\n 126→ totalLimit: limit,\n 127→ };\n 128→ }\n 129→ \n 130→ // Within limit\n 131→ entry.count++;\n 132→ return {\n 133→ allowed: true,\n 134→ remaining: limit - entry.count,\n 135→ resetTime: entry.resetTime,\n 136→ totalLimit: limit,\n 137→ };\n 138→}\n 139→\n 140→/**\n 141→ * Get rate limit headers for response\n 142→ */\n 143→export function getRateLimitHeaders(\n 144→ identifier: string,\n 145→ maxRequests?: number,\n 146→ windowMs?: number\n 147→): Record {\n 148→ const limit = checkRateLimit(identifier, maxRequests, windowMs);\n 149→ return {\n 150→ 'X-RateLimit-Limit': limit.totalLimit.toString(),\n 151→ 'X-RateLimit-Remaining': Math.max(0, limit.remaining).toString(),\n 152→ 'X-RateLimit-Reset': new Date(limit.resetTime).toISOString(),\n 153→ };\n 154→}\n 155→\n 156→/**\n 157→ * Create a rate limit response with proper headers\n 158→ */\n 159→export function createRateLimitResponse(\n 160→ identifier: string,\n 161→ retryAfterSeconds?: number\n 162→): Response {\n 163→ const headers = new Headers({\n 164→ 'Content-Type': 'application/json',\n 165→ 'X-RateLimit-Limit': MAX_REQUESTS.toString(),\n 166→ 'X-RateLimit-Remaining': '0',\n 167→ });\n 168→ \n 169→ if (retryAfterSeconds) {\n 170→ headers.set('Retry-After', retryAfterSeconds.toString());\n 171→ }\n 172→ \n 173→ return new Response(\n 174→ JSON.stringify({\n 175→ error: 'Rate limit exceeded. Please try again later.',\n 176→ retryAfter: retryAfterSeconds,\n 177→ }),\n 178→ {\n 179→ status: 429,\n 180→ headers,\n 181→ }\n 182→ );\n 183→}\n 184→\n 185→// Auto-start cleanup when module loads\n 186→startRateLimitCleanup();\n 187→\n 188→// Export constants for use in route handlers\n 189→export { MAX_REQUESTS, WINDOW_MS };\n 190→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import Stripe from 'stripe';\n 2→\n 3→// Initialize Stripe with secret key\n 4→export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY || '', {\n 5→ apiVersion: '2026-01-28.clover', // Use latest API version\n 6→ typescript: true,\n 7→});\n 8→\n 9→// Validate Stripe is configured\n 10→export function validateStripeConfig(): void {\n 11→ if (!process.env.STRIPE_SECRET_KEY) {\n 12→ throw new Error('STRIPE_SECRET_KEY is not configured');\n 13→ }\n 14→ if (!process.env.STRIPE_WEBHOOK_SECRET) {\n 15→ throw new Error('STRIPE_WEBHOOK_SECRET is not configured');\n 16→ }\n 17→}\n 18→\n 19→// Create a PaymentIntent for hiring a worker\n 20→export async function createPaymentIntent({\n 21→ amount,\n 22→ matchId,\n 23→ companyId,\n 24→ companyName,\n 25→ description,\n 26→}: {\n 27→ amount: number;\n 28→ matchId: string;\n 29→ companyId: string;\n 30→ companyName: string;\n 31→ description: string;\n 32→}) {\n 33→ try {\n 34→ const paymentIntent = await stripe.paymentIntents.create({\n 35→ amount: Math.round(amount * 100), // Convert to cents\n 36→ currency: 'aud',\n 37→ automatic_payment_methods: {\n 38→ enabled: true,\n 39→ },\n 40→ metadata: {\n 41→ match_id: matchId,\n 42→ company_id: companyId,\n 43→ company_name: companyName,\n 44→ description,\n 45→ },\n 46→ description: `RateRight Hire Fee - ${description}`,\n 47→ });\n 48→\n 49→ return {\n 50→ clientSecret: paymentIntent.client_secret,\n 51→ paymentIntentId: paymentIntent.id,\n 52→ };\n 53→ } catch (error) {\n 54→ console.error('Error creating PaymentIntent:', error);\n 55→ throw new Error('Failed to create payment intent');\n 56→ }\n 57→}\n 58→\n 59→// Retrieve a PaymentIntent\n 60→export async function retrievePaymentIntent(paymentIntentId: string) {\n 61→ try {\n 62→ return await stripe.paymentIntents.retrieve(paymentIntentId);\n 63→ } catch (error) {\n 64→ console.error('Error retrieving PaymentIntent:', error);\n 65→ throw new Error('Failed to retrieve payment intent');\n 66→ }\n 67→}\n 68→\n 69→// Construct webhook event with signature verification\n 70→export function constructWebhookEvent(\n 71→ payload: string | Buffer,\n 72→ signature: string\n 73→): Stripe.Event {\n 74→ const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;\n 75→ \n 76→ if (!webhookSecret) {\n 77→ throw new Error('STRIPE_WEBHOOK_SECRET is not configured');\n 78→ }\n 79→\n 80→ try {\n 81→ return stripe.webhooks.constructEvent(payload, signature, webhookSecret);\n 82→ } catch (error) {\n 83→ console.error('Webhook signature verification failed:', error);\n 84→ throw new Error('Invalid webhook signature');\n 85→ }\n 86→}\n 87→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":"\nOutput too large (33KB). Full output saved to: /home/ccuser/.claude/projects/-home-ccuser-rateright-growth/ce8d9785-a717-447c-bb05-7625d35a54fe/tool-results/toolu_015PLG5Nx41FHZyLZeUKE5UG.txt\n\nPreview (first 2KB):\n/home/ccuser/the-50-dollar-app/src/components/payment/PaymentForm.tsx-52- }\n/home/ccuser/the-50-dollar-app/src/components/payment/PaymentForm.tsx-53- } catch (error) {\n/home/ccuser/the-50-dollar-app/src/components/payment/PaymentForm.tsx:54: console.error('Payment error:', error);\n/home/ccuser/the-50-dollar-app/src/components/payment/PaymentForm.tsx-55- setErrorMessage('An unexpected error occurred. Please try again.');\n/home/ccuser/the-50-dollar-app/src/components/payment/PaymentForm.tsx-56- } finally {\n--\n/home/ccuser/the-50-dollar-app/src/components/payment/HirePaymentModal.tsx-70- });\n/home/ccuser/the-50-dollar-app/src/components/payment/HirePaymentModal.tsx-71- } catch (error) {\n/home/ccuser/the-50-dollar-app/src/components/payment/HirePaymentModal.tsx:72: console.error('Payment initialization error:', error);\n/home/ccuser/the-50-dollar-app/src/components/payment/HirePaymentModal.tsx-73- setPaymentState({\n/home/ccuser/the-50-dollar-app/src/components/payment/HirePaymentModal.tsx-74- type: 'error',\n--\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-76- \n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-77- if (!cookieToken) {\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts:78: console.error('CSRF validation failed: No token in cookie');\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-79- return false;\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-80- }\n--\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-108- \n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-109- if (!requestToken) {\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts:110: console.error('CSRF validation failed: No token in request');\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-111- return false;\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-112- }\n--\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-116- \n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-117- if (!tokensMatch) {\n...\n"
"content":"/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-154- try {\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-155- const parsedUrl = new URL(checkUrl);\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts:156: const appUrl = new URL(process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000');\n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-157- \n/home/ccuser/the-50-dollar-app/src/lib/csrf.ts-158- return parsedUrl.origin === appUrl.origin;\n--\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts-130-const ALLOWED_ORIGINS = [\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts-131- process.env.NEXT_PUBLIC_APP_URL, // Production URL from env\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts:132: 'http://localhost:3000', // Local development\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts:133: 'https://localhost:3000', // Local development with HTTPS\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts-134-].filter(Boolean) as string[];\n/home/ccuser/the-50-dollar-app/src/app/api/company-logo/route.ts-135-\n\n[Showing results with pagination = limit: 50, offset: 0]"
"content":" 1→import Stripe from 'stripe';\n 2→\n 3→// Initialize Stripe with secret key\n 4→export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY || '', {\n 5→ apiVersion: '2026-01-28.clover', // Use latest API version\n 6→ typescript: true,\n 7→});\n 8→\n 9→// Validate Stripe is configured\n 10→export function validateStripeConfig(): void {\n 11→ if (!process.env.STRIPE_SECRET_KEY) {\n 12→ throw new Error('STRIPE_SECRET_KEY is not configured');\n 13→ }\n 14→ if (!process.env.STRIPE_WEBHOOK_SECRET) {\n 15→ throw new Error('STRIPE_WEBHOOK_SECRET is not configured');\n 16→ }\n 17→}\n 18→\n 19→// Create a PaymentIntent for hiring a worker\n 20→export async function createPaymentIntent({\n 21→ amount,\n 22→ matchId,\n 23→ companyId,\n 24→ companyName,\n 25→ description,\n 26→}: {\n 27→ amount: number;\n 28→ matchId: string;\n 29→ companyId: string;\n 30→ companyName: string;\n 31→ description: string;\n 32→}) {\n 33→ try {\n 34→ const paymentIntent = await stripe.paymentIntents.create({\n 35→ amount: Math.round(amount * 100), // Convert to cents\n 36→ currency: 'aud',\n 37→ automatic_payment_methods: {\n 38→ enabled: true,\n 39→ },\n 40→ metadata: {\n 41→ match_id: matchId,\n 42→ company_id: companyId,\n 43→ company_name: companyName,\n 44→ description,\n 45→ },\n 46→ description: `RateRight Hire Fee - ${description}`,\n 47→ });\n 48→\n 49→ return {\n 50→ clientSecret: paymentIntent.client_secret,\n 51→ paymentIntentId: paymentIntent.id,\n 52→ };\n 53→ } catch (error) {\n 54→ console.error('Error creating PaymentIntent:', error);\n 55→ throw new Error('Failed to create payment intent');\n 56→ }\n 57→}\n 58→\n 59→// Retrieve a PaymentIntent\n 60→export async function retrievePaymentIntent(paymentIntentId: string) {\n 61→ try {\n 62→ return await stripe.paymentIntents.retrieve(paymentIntentId);\n 63→ } catch (error) {\n 64→ console.error('Error retrieving PaymentIntent:', error);\n 65→ throw new Error('Failed to retrieve payment intent');\n 66→ }\n 67→}\n 68→\n 69→// Construct webhook event with signature verification\n 70→export function constructWebhookEvent(\n 71→ payload: string | Buffer,\n 72→ signature: string\n 73→): Stripe.Event {\n 74→ const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;\n 75→ \n 76→ if (!webhookSecret) {\n 77→ throw new Error('STRIPE_WEBHOOK_SECRET is not configured');\n 78→ }\n 79→\n 80→ try {\n 81→ return stripe.webhooks.constructEvent(payload, signature, webhookSecret);\n 82→ } catch (error) {\n 83→ console.error('Webhook signature verification failed:', error);\n 84→ throw new Error('Invalid webhook signature');\n 85→ }\n 86→}\n 87→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":"/home/ccuser/the-50-dollar-app/src/app/api/payments/create/route.ts: return NextResponse.json({ error: 'Company not found or unauthorized' }, { status: 403 });\n/home/ccuser/the-50-dollar-app/src/app/api/payments/create/route.ts: return NextResponse.json({ error: 'Match not found, already rejected, or unauthorized' }, { status: 403 });\n/home/ccuser/the-50-dollar-app/src/app/api/webhooks/stripe/route.ts: console.error('Payment not found for intent:', paymentIntent.id);\n/home/ccuser/the-50-dollar-app/src/app/api/match/find-matches/route.ts: return NextResponse.json({ error: \"
"content":" 1→/**\n 2→ * Client-side Supabase configuration with enhanced security\n 3→ * \n 4→ * IMPORTANT: This module does NOT export a singleton instance.\n 5→ * Always use createClient() to get a fresh client instance.\n 6→ * This prevents stale auth credentials on shared devices.\n 7→ */\n 8→\n 9→import { createBrowserClient } from '@supabase/ssr'\n 10→import type { SupabaseClient } from '@supabase/supabase-js'\n 11→\n 12→const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!\n 13→const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!\n 14→\n 15→/**\n 16→ * Creates a Supabase client for use in browser/Client Components.\n 17→ * Uses @supabase/ssr to properly sync cookies with the server.\n 18→ */\n 19→export function createClient(): SupabaseClient {\n 20→ return createBrowserClient(supabaseUrl, supabaseAnonKey)\n 21→}\n 22→\n 23→/**\n 24→ * @deprecated Use createClient() instead. This export will be removed.\n 25→ * Direct supabase export is disabled to prevent stale auth on shared devices.\n 26→ * Always call createClient() to get a fresh instance.\n 27→ */\n 28→export const supabase = new Proxy({} as SupabaseClient, {\n 29→ get() {\n 30→ throw new Error(\n 31→ 'Direct supabase import is deprecated and disabled for security. ' +\n 32→ 'Use createClient() instead to prevent stale auth on shared devices.'\n 33→ )\n 34→ },\n 35→})\n 36→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→/**\n 2→ * Client-side Supabase configuration with enhanced security\n 3→ * \n 4→ * IMPORTANT: This module does NOT export a singleton instance.\n 5→ * Always use createClient() to get a fresh client instance.\n 6→ * This prevents stale auth credentials on shared devices.\n 7→ */\n 8→\n 9→import { createBrowserClient } from '@supabase/ssr'\n 10→import type { SupabaseClient } from '@supabase/supabase-js'\n 11→\n 12→const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!\n 13→const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!\n 14→\n 15→/**\n 16→ * Creates a Supabase client for use in browser/Client Components.\n 17→ * Uses @supabase/ssr to properly sync cookies with the server.\n 18→ */\n 19→export function createClient(): SupabaseClient {\n 20→ return createBrowserClient(supabaseUrl, supabaseAnonKey)\n 21→}\n 22→\n 23→/**\n 24→ * @deprecated Use createClient() instead. This export will be removed.\n 25→ * Direct supabase export is disabled to prevent stale auth on shared devices.\n 26→ * Always call createClient() to get a fresh instance.\n 27→ */\n 28→export const supabase = new Proxy({} as SupabaseClient, {\n 29→ get() {\n 30→ throw new Error(\n 31→ 'Direct supabase import is deprecated and disabled for security. ' +\n 32→ 'Use createClient() instead to prevent stale auth on shared devices.'\n 33→ )\n 34→ },\n 35→})\n 36→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":" 1→import { getSupabaseAdmin, createClient } from '@/lib/supabase/server';\n 2→import { NextRequest, NextResponse } from 'next/server';\n 3→import { checkRateLimit, getClientIP, createRateLimitResponse } from '@/lib/rate-limit';\n 4→import { createPaymentIntent } from '@/lib/stripe/server';\n 5→import { withCSRFProtection } from '@/lib/csrf';\n 6→\n 7→// Rate limit: 10 requests per 15 minutes per user (sensitive financial operation)\n 8→const PAYMENT_RATE_LIMIT = 10;\n 9→const PAYMENT_WINDOW_MS = 15 * 60 * 1000;\n 10→\n 11→const handler = async (request: NextRequest) => {\n 12→ try {\n 13→ // --- Rate limiting (by IP as initial check) ---\n 14→ const clientIP = getClientIP(request);\n 15→ const ipRateLimit = checkRateLimit(`payment-ip:${clientIP}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 16→ \n 17→ if (!ipRateLimit.allowed) {\n 18→ const retryAfter = Math.ceil((ipRateLimit.resetTime - Date.now()) / 1000);\n 19→ return createRateLimitResponse(clientIP, retryAfter);\n 20→ }\n 21→ \n 22→ const supabase = await createClient();\n 23→ const {\n 24→ data: { user },\n 25→ } = await supabase.auth.getUser();\n 26→ \n 27→ if (!user) {\n 28→ return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });\n 29→ }\n 30→ \n 31→ // --- Stricter rate limiting by user ID ---\n 32→ const userRateLimit = checkRateLimit(`payment-user:${user.id}`, PAYMENT_RATE_LIMIT, PAYMENT_WINDOW_MS);\n 33→ \n 34→ if (!userRateLimit.allowed) {\n 35→ const retryAfter = Math.ceil((userRateLimit.resetTime - Date.now()) / 1000);\n 36→ return createRateLimitResponse(user.id, retryAfter);\n 37→ }\n 38→\n 39→ const body = await request.json();\n 40→ const { match_id, company_id } = body;\n 41→ const amount = 50.0; // Hardcoded amount to prevent client override\n 42→\n 43→ if (!match_id || !company_id) {\n 44→ return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });\n 45→ }\n 46→\n 47→ // Verify user owns the company\n 48→ const { data: company } = await supabase\n 49→ .from('companies')\n 50→ .select('id, name')\n 51→ .eq('id', company_id)\n 52→ .eq('profile_id', user.id)\n 53→ .single();\n 54→\n 55→ if (!company) {\n 56→ return NextResponse.json({ error: 'Company not found or unauthorized' }, { status: 403 });\n 57→ }\n 58→\n 59→ // Verify match exists and belongs to company's job (can be in any status except rejected)\n 60→ const { data: match } = await supabase\n 61→ .from('matches')\n 62→ .select('status, jobs!inner(company_id, title)')\n 63→ .eq('id', match_id)\n 64→ .neq('status', 'rejected')\n 65→ .eq('jobs.company_id', company_id)\n 66→ .single();\n 67→\n 68→ if (!match) {\n 69→ return NextResponse.json({ error: 'Match not found, already rejected, or unauthorized' }, { status: 403 });\n 70→ }\n 71→\n 72→ // Check if payment already exists for this match\n 73→ const { data: existingPayment } = await supabase\n 74→ .from('payments')\n 75→ .select('id, status, stripe_payment_id')\n 76→ .eq('match_id', match_id)\n 77→ .single();\n 78→\n 79→ if (existingPayment?.status === 'charged') {\n 80→ return NextResponse.json({ error: 'Payment already completed for this hire' }, { status: 400 });\n 81→ }\n 82→\n 83→ // Create Stripe PaymentIntent\n 84→ const jobTitle = (match.jobs as { title?: string }).title || 'Job';\n 85→ const { clientSecret, paymentIntentId } = await createPaymentIntent({\n 86→ amount,\n 87→ matchId: match_id,\n 88→ companyId: company_id,\n 89→ companyName: company.name,\n 90→ description: `Hire for ${jobTitle}`,\n 91→ });\n 92→\n 93→ // Create or update payment record using service role\n 94→ const supabaseService = getSupabaseAdmin();\n 95→ \n 96→ let payment;\n 97→ if (existingPayment) {\n 98→ // Update existing payment record with new PaymentIntent\n 99→ const { data: updatedPayment, error } = await supabaseService\n 100→ .from('payments')\n 101→ .update({\n 102→ stripe_payment_id: paymentIntentId,\n 103→ amount,\n 104→ status: 'pending',\n 105→ })\n 106→ .eq('id', existingPayment.id)\n 107→ .select()\n 108→ .single();\n 109→ \n 110→ if (error) {\n 111→ return NextResponse.json({ error: error.message }, { status: 500 });\n 112→ }\n 113→ payment = updatedPayment;\n 114→ } else {\n 115→ // Create new payment record\n 116→ const { data: newPayment, error } = await supabaseService\n 117→ .from('payments')\n 118→ .insert({\n 119→ match_id,\n 120→ company_id,\n 121→ amount,\n 122→ status: 'pending',\n 123→ stripe_payment_id: paymentIntentId,\n 124→ })\n 125→ .select()\n 126→ .single();\n 127→\n 128→ if (error) {\n 129→ return NextResponse.json({ error: error.message }, { status: 500 });\n 130→ }\n 131→ payment = newPayment;\n 132→ }\n 133→\n 134→ return NextResponse.json({ \n 135→ payment,\n 136→ clientSecret,\n 137→ publishableKey: process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY,\n 138→ });\n 139→ } catch (error) {\n 140→ console.error('Payment creation error:', error);\n 141→ if (error instanceof Error && error.message.includes('Stripe')) {\n 142→ return NextResponse.json({ error: 'Payment service unavailable' }, { status: 503 });\n 143→ }\n 144→ return NextResponse.json({ error: 'Internal server error' }, { status: 500 });\n 145→ }\n 146→}\n 147→\n 148→// Apply CSRF protection to the handler\n 149→export const POST = withCSRFProtection(handler);\n 150→\n\n\nWhenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.\n\n"
"content":"/home/ccuser/the-50-dollar-app/src/app/api/messages/route.ts:20: console.error(\"
"content":" 1→'use client';\n 2→\n 3→import { useState } from 'react';\n 4→import {\n 5→ PaymentElement,\n 6→ useStripe,\n 7→ useElements,\n 8→} from '@stripe/react-stripe-js';\n 9→import { Button } from '@/components/ui/button';\n 10→import { Loader2, CreditCard } from 'lucide-react';\n 11→\n 12→interface PaymentFormProps {\n 13→ onSuccess: () => void;\n 14→ onCancel: () => void;\n 15→ amount: number;\n 16→}\n 17→\n 18→export function PaymentForm({ onSuccess, onCancel, amount }: PaymentFormProps) {\n 19→ const stripe = useStripe();\n 20→ const elements = useElements();\n 21→ const [isLoading, setIsLoading] = useState(false);\n 22→ const [errorMessage, setErrorMessage] = useState(null);\n 23→\n 24→ const handleSubmit = async (e: React.FormEvent) => {\n 25→ e.preventDefault();\n 26→\n 27→ if (!stripe || !elements) {\n 28→ return;\n 29→ }\n 30→\n 31→ setIsLoading(true);\n 32→ setErrorMessage(null);\n 33→\n 34→ try {\n 35→ const { error, paymentIntent } = await stripe.confirmPayment({\n 36→ elements,\n 37→ confirmParams: {\n 38→ return_url: `${window.location.origin}/contractor/payment-success`,\n 39→ },\n 40→ redirect: 'if_required',\n 41→ });\n 42→\n 43→ if (error) {\n 44→ setErrorMessage(error.message || 'Payment failed. Please try again.');\n 45→ } else if (paymentIntent && paymentIntent.status === 'succeeded') {\n 46→ onSuccess();\n 47→ } else if (paymentIntent && paymentIntent.status === 'requires_action') {\n 48→ // 3D Secure or other authentication required - Stripe handles this automatically\n 49→ // The redirect above will handle it\n 50→ } else {\n 51→ setErrorMessage('Payment processing. Please wait...');\n 52→ }\n 53→ } catch (error) {\n 54→ console.error('Payment error:', error);\n 55→ setErrorMessage('An unexpected error occurred. Please try again.');\n 56→ } finally {\n 57→ setIsLoading(false);\n 58→ }\n 59→ };\n 60→\n 61→ return (\n 62→