From d31b5b4dace3e17624d7bdb54afdeffdd2560d03 Mon Sep 17 00:00:00 2001 From: Jennie Robinson Faber Date: Sat, 4 Apr 2026 13:37:34 +0100 Subject: [PATCH] fix: use private helcimApiToken for all server-side Helcim API calls --- .serena/.gitignore | 2 + .serena/project.yml | 152 ++++++++++ CLAUDE.md | 10 +- app/assets/css/main.css | 12 +- app/components/EventTicketCard.vue | 4 +- app/components/EventsMiniSidebar.vue | 67 ++-- app/components/SeriesPassPurchase.vue | 56 ++-- app/composables/useHelcimPay.js | 6 +- app/pages/about.vue | 21 +- app/pages/admin/events/index.vue | 119 +++++++- app/pages/admin/members.vue | 103 ++++++- app/pages/admin/series-management.vue | 116 ++++--- app/pages/events/[id].vue | 2 +- app/pages/index.vue | 75 +++-- app/pages/join.vue | 8 +- app/pages/member/account.vue | 285 ++++++++++++------ app/pages/member/dashboard.vue | 35 ++- app/pages/member/my-updates.vue | 12 +- app/pages/member/profile.vue | 167 ++++++---- app/pages/series/[id].vue | 28 +- app/pages/updates/[id]/edit.vue | 157 ++++++++++ app/pages/updates/new.vue | 139 +++++++++ app/pages/verify.vue | 80 +++++ server/api/admin/members/[id].put.js | 42 +++ server/api/admin/members/invite.post.js | 40 ++- server/api/auth/member.get.js | 4 + server/api/auth/refresh.post.js | 14 +- server/api/auth/status.get.js | 3 +- server/api/dev/member-login.get.js | 41 +++ .../events/[id]/cancel-registration.post.js | 29 +- server/api/events/[id]/register.post.js | 18 +- server/api/helcim/create-plan.post.js | 2 +- server/api/helcim/customer-code.get.js | 2 +- server/api/helcim/customer.post.js | 2 +- .../api/helcim/get-or-create-customer.post.js | 2 +- server/api/helcim/initialize-payment.post.js | 12 +- server/api/helcim/plans.get.js | 2 +- server/api/helcim/subscription.post.js | 2 +- server/api/helcim/subscriptions.get.js | 2 +- server/api/helcim/update-billing.post.js | 2 +- server/api/helcim/verify-payment.post.js | 2 +- .../api/members/cancel-subscription.post.js | 3 +- server/api/members/directory.get.js | 13 +- server/api/members/me/peer-support.patch.js | 111 +++---- server/api/members/my-calendar.get.js | 134 ++++---- server/api/members/my-events.get.js | 52 +--- server/api/members/profile.patch.js | 2 + server/api/members/update-circle.post.js | 34 +++ .../api/members/update-contribution.post.js | 72 ++--- server/middleware/02.security-headers.js | 4 +- server/middleware/03.rate-limit.js | 2 +- server/models/member.js | 15 +- server/utils/auth.js | 8 + 53 files changed, 1755 insertions(+), 572 deletions(-) create mode 100644 .serena/.gitignore create mode 100644 .serena/project.yml create mode 100644 app/pages/updates/[id]/edit.vue create mode 100644 app/pages/updates/new.vue create mode 100644 app/pages/verify.vue create mode 100644 server/api/admin/members/[id].put.js create mode 100644 server/api/dev/member-login.get.js create mode 100644 server/api/members/update-circle.post.js diff --git a/.serena/.gitignore b/.serena/.gitignore new file mode 100644 index 0000000..2e510af --- /dev/null +++ b/.serena/.gitignore @@ -0,0 +1,2 @@ +/cache +/project.local.yml diff --git a/.serena/project.yml b/.serena/project.yml new file mode 100644 index 0000000..9d24cb3 --- /dev/null +++ b/.serena/project.yml @@ -0,0 +1,152 @@ +# the name by which the project can be referenced within Serena +project_name: "ghostguild-org" + + +# list of languages for which language servers are started; choose from: +# al bash clojure cpp csharp +# csharp_omnisharp dart elixir elm erlang +# fortran fsharp go groovy haskell +# java julia kotlin lua markdown +# matlab nix pascal perl php +# php_phpactor powershell python python_jedi r +# rego ruby ruby_solargraph rust scala +# swift terraform toml typescript typescript_vts +# vue yaml zig +# (This list may be outdated. For the current list, see values of Language enum here: +# https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py +# For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.) +# Note: +# - For C, use cpp +# - For JavaScript, use typescript +# - For Free Pascal/Lazarus, use pascal +# Special requirements: +# Some languages require additional setup/installations. +# See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers +# When using multiple languages, the first language server that supports a given file will be used for that file. +# The first language is the default language and the respective language server will be used as a fallback. +# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored. +languages: +- vue + +# the encoding used by text files in the project +# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings +encoding: "utf-8" + +# line ending convention to use when writing source files. +# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default) +# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings. +line_ending: + +# The language backend to use for this project. +# If not set, the global setting from serena_config.yml is used. +# Valid values: LSP, JetBrains +# Note: the backend is fixed at startup. If a project with a different backend +# is activated post-init, an error will be returned. +language_backend: + +# whether to use project's .gitignore files to ignore files +ignore_all_files_in_gitignore: true + +# advanced configuration option allowing to configure language server-specific options. +# Maps the language key to the options. +# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available. +# No documentation on options means no options are available. +ls_specific_settings: {} + +# list of additional paths to ignore in this project. +# Same syntax as gitignore, so you can use * and **. +# Note: global ignored_paths from serena_config.yml are also applied additively. +ignored_paths: [] + +# whether the project is in read-only mode +# If set to true, all editing tools will be disabled and attempts to use them will result in an error +# Added on 2025-04-18 +read_only: false + +# list of tool names to exclude. +# This extends the existing exclusions (e.g. from the global configuration) +# +# Below is the complete list of tools for convenience. +# To make sure you have the latest list of tools, and to view their descriptions, +# execute `uv run scripts/print_tool_overview.py`. +# +# * `activate_project`: Activates a project by name. +# * `check_onboarding_performed`: Checks whether project onboarding was already performed. +# * `create_text_file`: Creates/overwrites a file in the project directory. +# * `delete_lines`: Deletes a range of lines within a file. +# * `delete_memory`: Deletes a memory from Serena's project-specific memory store. +# * `execute_shell_command`: Executes a shell command. +# * `find_referencing_code_snippets`: Finds code snippets in which the symbol at the given location is referenced. +# * `find_referencing_symbols`: Finds symbols that reference the symbol at the given location (optionally filtered by type). +# * `find_symbol`: Performs a global (or local) search for symbols with/containing a given name/substring (optionally filtered by type). +# * `get_current_config`: Prints the current configuration of the agent, including the active and available projects, tools, contexts, and modes. +# * `get_symbols_overview`: Gets an overview of the top-level symbols defined in a given file. +# * `initial_instructions`: Gets the initial instructions for the current project. +# Should only be used in settings where the system prompt cannot be set, +# e.g. in clients you have no control over, like Claude Desktop. +# * `insert_after_symbol`: Inserts content after the end of the definition of a given symbol. +# * `insert_at_line`: Inserts content at a given line in a file. +# * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol. +# * `list_dir`: Lists files and directories in the given directory (optionally with recursion). +# * `list_memories`: Lists memories in Serena's project-specific memory store. +# * `onboarding`: Performs onboarding (identifying the project structure and essential tasks, e.g. for testing or building). +# * `prepare_for_new_conversation`: Provides instructions for preparing for a new conversation (in order to continue with the necessary context). +# * `read_file`: Reads a file within the project directory. +# * `read_memory`: Reads the memory with the given name from Serena's project-specific memory store. +# * `remove_project`: Removes a project from the Serena configuration. +# * `replace_lines`: Replaces a range of lines within a file with new content. +# * `replace_symbol_body`: Replaces the full definition of a symbol. +# * `restart_language_server`: Restarts the language server, may be necessary when edits not through Serena happen. +# * `search_for_pattern`: Performs a search for a pattern in the project. +# * `summarize_changes`: Provides instructions for summarizing the changes made to the codebase. +# * `switch_modes`: Activates modes by providing a list of their names +# * `think_about_collected_information`: Thinking tool for pondering the completeness of collected information. +# * `think_about_task_adherence`: Thinking tool for determining whether the agent is still on track with the current task. +# * `think_about_whether_you_are_done`: Thinking tool for determining whether the task is truly completed. +# * `write_memory`: Writes a named memory (for future reference) to Serena's project-specific memory store. +excluded_tools: [] + +# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default). +# This extends the existing inclusions (e.g. from the global configuration). +included_optional_tools: [] + +# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools. +# This cannot be combined with non-empty excluded_tools or included_optional_tools. +fixed_tools: [] + +# list of mode names to that are always to be included in the set of active modes +# The full set of modes to be activated is base_modes + default_modes. +# If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply. +# Otherwise, this setting overrides the global configuration. +# Set this to [] to disable base modes for this project. +# Set this to a list of mode names to always include the respective modes for this project. +base_modes: + +# list of mode names that are to be activated by default. +# The full set of modes to be activated is base_modes + default_modes. +# If the setting is undefined, the default_modes from the global configuration (serena_config.yml) apply. +# Otherwise, this overrides the setting from the global configuration (serena_config.yml). +# This setting can, in turn, be overridden by CLI parameters (--mode). +default_modes: + +# initial prompt for the project. It will always be given to the LLM upon activating the project +# (contrary to the memories, which are loaded on demand). +initial_prompt: "" + +# time budget (seconds) per tool call for the retrieval of additional symbol information +# such as docstrings or parameter information. +# This overrides the corresponding setting in the global configuration; see the documentation there. +# If null or missing, use the setting from the global configuration. +symbol_info_budget: + +# list of regex patterns which, when matched, mark a memory entry as read‑only. +# Extends the list from the global configuration, merging the two lists. +read_only_memory_patterns: [] + +# list of regex patterns for memories to completely ignore. +# Matching memories will not appear in list_memories or activate_project output +# and cannot be accessed via read_memory or write_memory. +# To access ignored memory files, use the read_file tool on the raw file path. +# Extends the list from the global configuration, merging the two lists. +# Example: ["_archive/.*", "_episodes/.*"] +ignored_memory_patterns: [] diff --git a/CLAUDE.md b/CLAUDE.md index ef32320..ff59a89 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -71,7 +71,10 @@ Copy `.env.example` to `.env`. Required: `MONGODB_URI`, `JWT_SECRET`, `RESEND_AP - Use `USwitch` (not `UToggle`) — this is the correct Nuxt UI 3+ component name - No fallback/placeholder data — always use real data - Follow Nuxt 4 file-based routing conventions for route naming -- Always check Nuxt UI 3 latest documentation on the web when implementing UI components +- Always check Nuxt UI 4 latest documentation on the web when implementing UI components +- Auth API responses (`/api/auth/status`, `/api/auth/member`) must include `status` in the returned member object — `useMemberStatus` defaults to `PENDING_PAYMENT` if missing +- Helcim payment testing requires ngrok: `npx nuxi dev --https` then `ngrok http https://localhost:3000` — Helcim blocks localhost origins +- The `/api/helcim/initialize-payment` endpoint skips auth for `event_ticket` type payments (public users can buy tickets) ## Product Spec @@ -90,8 +93,3 @@ The sections below describe planned and in-progress features for reference. ### Resources (Planned) - Learning paths by circle, templates and tools, case studies - Tag by circle relevance, download tracking, version control - -### Implementation Priority -**Must have:** Payment processing, Slack automation, member dashboard, resource library, event listing/RSVP -**Nice to have:** Member profiles, peer matching, Cal.com, member updates -**Post-launch:** Etherpad integration, member-proposed events, advanced search, analytics dashboard diff --git a/app/assets/css/main.css b/app/assets/css/main.css index 06098dc..b4f6ac2 100644 --- a/app/assets/css/main.css +++ b/app/assets/css/main.css @@ -28,6 +28,7 @@ --text-dim: #5a5040; --text-faint: #8a7e6a; --parch: #2a2015; + --parch-hover: #3a3025; --parch-text: #ede4d0; --parch-text-dim: #b8ae98; --c-community: #7a4838; @@ -52,6 +53,7 @@ --text-dim: #8a7e6a; --text-faint: #5a5040; --parch: #ede4d0; + --parch-hover: #d4c8a8; --parch-text: #2a2015; --parch-text-dim: #5a5040; --c-community: #a06850; @@ -177,9 +179,17 @@ a:hover { text-decoration: underline; } /* ---- SECTION DIVIDERS ---- */ .section-divider { - border: none; + display: block; + width: 100%; + max-width: none; + box-sizing: border-box; + border: 0; border-top: 1px dashed var(--border); margin: 20px 0 14px; + padding: 0; + flex: 0 0 auto; + align-self: stretch; + min-width: 0; } /* ---- MOBILE ---- */ diff --git a/app/components/EventTicketCard.vue b/app/components/EventTicketCard.vue index 5cd2e05..a392620 100644 --- a/app/components/EventTicketCard.vue +++ b/app/components/EventTicketCard.vue @@ -45,7 +45,7 @@ Early Bird @@ -64,7 +64,7 @@
Early bird ends {{ formatDeadline(ticketInfo.earlyBirdDeadline) }} diff --git a/app/components/EventsMiniSidebar.vue b/app/components/EventsMiniSidebar.vue index cd99c95..84486de 100644 --- a/app/components/EventsMiniSidebar.vue +++ b/app/components/EventsMiniSidebar.vue @@ -1,17 +1,29 @@ @@ -29,9 +41,17 @@ const formatDate = (dateStr) => { diff --git a/app/pages/member/dashboard.vue b/app/pages/member/dashboard.vue index 8f62dc7..f1ed63f 100644 --- a/app/pages/member/dashboard.vue +++ b/app/pages/member/dashboard.vue @@ -21,6 +21,7 @@