Fix ladl.link CORS for Mini payment assets and pay URL.

Allow cross-origin module loads of Mini build assets and use a same-origin pay path when HTML is proxied through ladl.link so fetch and Vite JS work.
2026-07-21 22:05:36 +00:00
parent e03a5dc30f
commit 75d201bcae
4 changed files with 124 additions and 5 deletions
@@ -2,9 +2,13 @@
    $content = $qrCode->content();
    $businessName = $content['business_name'] ?? $qrCode->label;
    $currency = $content['currency'] ?? 'GHS';
-    // Same-origin pay endpoint — ladl.link publicPath is cross-origin from
-    // mini.ladill.com and has no CORS headers, so fetch() never reaches showSheet.
-    $payUrl = url('/q/'.$qrCode->short_code.'/pay');
+    // Public scans stay on ladl.link/{code} (HTML proxied to Mini). Prefer a
+    // same-origin pay path so fetch() does not cross to mini.ladill.com.
+    // Direct visits on mini.ladill.com keep the local /q/{code}/pay route.
+    $isProxiedPublicScan = request()->headers->get('X-Ladill-Internal') === '1';
+    $payUrl = $isProxiedPublicScan
+        ? '/'.$qrCode->short_code.'/pay'
+        : url('/q/'.$qrCode->short_code.'/pay');
    $csrf = csrf_token();
@endphp
 <!DOCTYPE html>