Public order/pay POSTs hit ladl.link first; satellite CSRF tokens cannot bind
to Link (or platform/satellite) sessions, which returned 419 and showed
"Could not start checkout." Except public checkout paths and return
access_code from owner-gateway Paystack init. Sync contained Paystack sheet.
Storefront QR cards, slug preview, payment callbacks, and document downloads now use LadillLink so displayed and encoded links match ladl.link.
Co-authored-by: Cursor <cursoragent@cursor.com>
Public landing pages, asset paths, payment callbacks, and redirects now go through QrCode::publicPath() / LadillLink instead of ladill.com/q/* routes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop required buyer email on public merchant forms; require phone for bookings so merchants can reach guests without Ladill accounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Push the customer's connected domain to the central connected-domains registry
so it appears under My Domains (with Transfer in if not registered with Ladill).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.
- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When a menu (food) storefront order is paid, best-effort POST it to the
merchant's Ladill POS kitchen ingest (config/kitchen.php → KITCHEN_API_URL/KEY)
so it lands on their Kitchen Display alongside dine-in tabs. Failures are logged,
never surfaced — order completion is unaffected; POS ignores orders for accounts
that don't run a POS kitchen.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- New Products page (merchant.products.*) with full CRUD proxied to the Ladill
CRM products API via a new CrmClient + config/crm.php (owner-scoped, type=product).
- Sidebar gains a Products entry.
- The new storefront form loads the merchant's catalog: each shop/menu section
gets an "Add from products…" picker that drops a CRM product in as an item
(name, price, description). Catalog fetch is resilient — empty if CRM is down.
Wires CRM_API_URL + CRM_API_KEY_MERCHANT on the merchant env (matches CRM).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The merchant app shipped the QR Plus Afia: the chat panel subtitle read
'Give assistant' and the system prompt identified as 'Ladill QR Plus' and
described QR-code features (Link/PDF/WiFi/styling) instead of this app's
storefronts. Rewrite the prompt for Ladill Merchant (storefronts —
shop/menu/booking, orders, payouts, fees) and fix the subtitle to
'Merchant assistant'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SVG can embed JavaScript and would run as stored XSS when served inline on a
public storefront page, and we have no SVG sanitizer. Allow only raster
formats:
- item_images validation: image rule (permits SVG) -> mimes:jpeg,jpg,png,gif,webp
- QrCodeManagerService: reject image/svg+xml / .svg(z) in brand-image and
item-image storage (defense in depth, since those only checked the image/* prefix)
- file pickers: accept raster mimes only
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The storefront create/edit/manage UI and the public storefront page were
give's church-donation flow relabeled. Replace with genuine merchant
storefronts, reusing the QR-core manager + validator (which already build
sections/services content):
- Merchant create: type picker (shop/menu/booking) + per-type editors in a
shared partial (products/menu items with prices; bookable services with
days/hours). x-if per type so inputs never collide across types.
- StorefrontController store/update/create now delegate to QrCodeManagerService
for all three types (was hardcoded church org_type/denomination/collection).
- Storefront show = QR preview + download + live toggle + delete + full editor.
- QrCodeManagerService: shop/menu/booking are free (no QR-wallet gate); drop
the duplicate church TYPE_SHOP arm in hasContentChanges.
- Public: new storefront catalog+cart view for shop/menu (posts items[] to the
existing order/Pay flow); route shop+menu to it. Booking already had a real
public page; church TYPE_SHOP landing branch retired.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
isaacclad