feat: routes-b exchange-rate resilience, PAT flow, authz helper, and notification preferences by Themancalledpg · Pull Request #2 · Themancalledpg/LancePay

Themancalledpg · 2026-04-28T11:12:10Z

Description

Implements davedumto#549, davedumto#565, davedumto#569, and davedumto#570 in a single routes-b scoped PR.

Closes davedumto#549
Closes davedumto#565
Closes davedumto#569
Closes davedumto#570

Changes proposed

What were you told to do?

Add exchange-rate stale fallback behavior, PAT management/auth integration, auth scope+role helper, and notification preferences under routes-b only.

What did I do?

Exchange Rate Resilience

Added stale fallback with X-Stale and stalenessSeconds
Added 1-hour stale cap and RATE_UNAVAILABLE fail-closed

AuthZ + PAT

Added routes-b authz helper with requireScope, requireRole, hasScope, typed 403 error
Added PAT endpoints (mint/list/revoke), hash-only storage, 10-token cap
Integrated bearer PAT auth path in helper and stats endpoint scope enforcement

Notification Preferences

Added GET/PATCH preferences route and schema
Enforced securityAlert as non-disablable

Check List (Check all the applicable boxes)

My code follows the code style of this project.
This PR does not contain plagiarized content.
The title and description of the PR is clear and explains the approach.
I am making a pull request against the main branch (left side).
My commit messages styles matches our requested structure.
My code additions will fail neither code linting checks nor unit test.
I am only making changes to files I was requested to.

Screenshots / Testing Evidence

Tests were intentionally not run per request.

- Added new route-b endpoint to list messages for a specific invoice. - Implemented authentication and authorization checks (401/403/404). - Returns messages in chronological order as per schema. Closes davedumto#375

…to#366)

- Added endpoint to retrieve invoice data formatted for frontend preview. - Merges user branding settings and freelancer profile information. - Utilizes parallel database queries (Promise.all) for optimized performance. - Enforces invoice ownership verification and provides fallback branding defaults. Closes davedumto#349

…event endpoints - GET /api/routes-b/invoices/[id]/pdf — stream invoice as downloadable PDF (closes davedumto#402) - GET /api/routes-b/invoices/[id]/preview — invoice data formatted for UI preview (closes davedumto#458) - GET /api/routes-b/invoices/paid — paginated list of paid invoices (closes davedumto#451) - GET /api/routes-b/audit-log/[id] — fetch single audit event by ID (closes davedumto#457)

…pdf-download feat(routes-b): implement invoice PDF, preview, paid list, and audit event endpoints

Resolves davedumto#448

Resolves davedumto#453

Resolves davedumto#419

Resolves davedumto#459

…mto#335 davedumto#340

feat: implement routes-d endpoints davedumto#331 davedumto#332 davedumto#335 davedumto#340

Implements tag removal from invoice for routes-b. Returns 204 on success, 404 if tag not applied, 403 if invoice belongs to another user, 401 if unauthenticated. Only the InvoiceTag join record is deleted; the Tag itself is preserved. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

`@/lib/prisma` does not exist in this project; the correct path is `@/lib/db`. This was causing the production build to fail with a module-not-found error. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bank-accounts/[id], transactions/[id], and invoices/[id]/remind were using the old synchronous params pattern, breaking the Next.js 16 TypeScript build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- pdf/route.ts: cast InvoicePDF element to DocumentProps for @react-pdf/renderer - offramp/route.ts: use WithdrawalTransaction model (Withdrawal does not exist), map transactionId→stellarTxId and reason→error, remove non-existent needsManualReview field, move Resend instantiation inside handler to avoid module-level crash when RESEND_API_KEY is not set at build time Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…e-invoice-tag-446 feat: DELETE /api/routes-b/invoices/[id]/tags/[tagId] — remove tag from invoice

…al by ID

…voice-remind feat(api): POST routes-d invoice payment reminder (davedumto#323)

implement api for tag deletion

implement apply a tag to an invoice

implement tag creation routes

…bhook-signature-verification [Security] Add HMAC-SHA256 Signature Verification to MoonPay Webhook

…-invoice-371

…49-452-471 feat: add PATCH handlers for routes-b and routes-d APIs

# Conflicts: # app/api/routes-b/tags/[id]/route.ts

issues solved

…b-get-endpoints-477-485-488-489

…ndpoints, and notification preferences

- profile/route.ts: remove orphan code left over from a merge that duplicated GET logic inside PATCH's catch block. - contacts/[id]/route.ts: drop the stray brace on line 79 that closed the GET handler twice. - package-lock.json: regenerate so transitive tree-sitter resolves to the version package.json's dependency graph actually requires (unblocks 'npm ci' in CI). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…outes Resolves module-not-found and Promise<params> type errors that broke the build. 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>

Themancalledpg · 2026-05-29T13:04:43Z

Closing — this PR was opened against the fork by mistake. The same branch was opened upstream as davedumto#583 and has already been merged.

Demilade01 and others added 30 commits March 27, 2026 08:33

feat(api): implement GET /api/routes-b/invoices/[id]/messages

d59fa2a

- Added new route-b endpoint to list messages for a specific invoice. - Implemented authentication and authorization checks (401/403/404). - Returns messages in chronological order as per schema. Closes davedumto#375

Module '@prisma/client' has no exported member 'Invoice'.

fdedd63

feat: add PATCH /api/routes-b/profile to update display name (davedum…

40c3e38

…to#366)

Merge branch 'main' into overdue-invoice

879b157

Merge branch 'main' into main

13a9d21

Merge pull request davedumto#461 from Themancalledpg/feature/invoice-…

7e65bc9

…pdf-download feat(routes-b): implement invoice PDF, preview, paid list, and audit event endpoints

feat(reminder-settings): add GET endpoint for invoice reminder settings

26c5f7a

Resolves davedumto#448

feat(contacts): add GET endpoint to list all contacts

a0cea7e

Resolves davedumto#453

feat(webhooks): add GET endpoint to list registered webhooks

633ff79

Resolves davedumto#419

feat(analytics): add GET endpoint for withdrawal stats summary

eb71346

Resolves davedumto#459

Merge pull request davedumto#462 from overprodigy/drips-contributions

eb37165

implement tag list to applied invoice

f0ac465

implement tag creation routes

12d4256

implement apply a tag to an invoice

ed2f9dd

implement api for tag deletion

53d4bc4

feat: implement routes-d endpoints davedumto#331 davedumto#332 davedu…

0c6e0a0

…mto#335 davedumto#340

Merge pull request davedumto#468 from Fran19-09/feature/wave-issues-fran

7f0c039

feat: implement routes-d endpoints davedumto#331 davedumto#332 davedumto#335 davedumto#340

fix: correct prisma import path in offramp webhook route

552c4de

`@/lib/prisma` does not exist in this project; the correct path is `@/lib/db`. This was causing the production build to fail with a module-not-found error. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: await params as Promise in routes-b dynamic handlers

f493fbb

bank-accounts/[id], transactions/[id], and invoices/[id]/remind were using the old synchronous params pattern, breaking the Next.js 16 TypeScript build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge pull request davedumto#469 from KevinMB0220/feat/routes-b-delet…

235675f

…e-invoice-tag-446 feat: DELETE /api/routes-b/invoices/[id]/tags/[tagId] — remove tag from invoice

Merge pull request davedumto#395 from Demilade01/main

fe93728

Merge pull request davedumto#463 from Demilade01/invoice-preview

5d2b850

feat: add routes-d dashboard and bank account APIs

7cda9be

feat(davedumto#487): Add GET handler for listing tags on an invoice

70ec073

feat(davedumto#476): Add GET handler for retrieving a single withdraw…

64477ff

…al by ID

feat(davedumto#486): Add DELETE handler for removing a tag

de70370

davedumto and others added 28 commits March 30, 2026 09:30

Merge pull request davedumto#497 from Nwanne-san/feat/323-routes-d-in…

d8c8af8

…voice-remind feat(api): POST routes-d invoice payment reminder (davedumto#323)

issues solved

5a66aec

feat(api): add patch handlers for account and invoice routes

dbf0ba2

Merge branch 'main' into delete-tag

05ac3a5

Merge branch 'main' into create-tag-list

ed6a491

Merge branch 'main' into tag-list

7e61ecc

fix: add HMAC-SHA256 signature verification to MoonPay webhook

0264b4a

test: add verification script for MoonPay webhook signature

974260b

Merge pull request davedumto#467 from OnyemaAnthony/delete-tag

0b0ec9c

implement api for tag deletion

Merge branch 'main' into apply-tag

30f676d

Merge pull request davedumto#466 from OnyemaAnthony/apply-tag

0c86b69

implement apply a tag to an invoice

Merge pull request davedumto#465 from OnyemaAnthony/create-tag-list

498102e

implement tag creation routes

Merge branch 'main' into tag-list

47e9075

Merge pull request davedumto#464 from OnyemaAnthony/tag-list

9c54790

Merge pull request davedumto#507 from ebubechi-ihediwa/fix-moonpay-we…

f4bbb53

…bhook-signature-verification [Security] Add HMAC-SHA256 Signature Verification to MoonPay Webhook

feat: add routes-b invoice duplication endpoint

ae635fe

chore: sync lockfile with declared dependencies

3a1cc48

Merge pull request davedumto#508 from floxxih/feat/routes-b-duplicate…

3fac271

…-invoice-371

Merge pull request davedumto#506 from FrostGraphix/codex/routes-311-4…

b6fc641

…49-452-471 feat: add PATCH handlers for routes-b and routes-d APIs

Merge branch 'main' into display_name

a6020e3

feat: add routes-b detail GET handlers

7617e4d

# Conflicts: # app/api/routes-b/tags/[id]/route.ts

Merge pull request davedumto#429 from okekefrancis112/display_name

84d6080

Merge branch 'main' into main

95f08f8

Merge pull request davedumto#505 from Peolite001/main

cfff946

issues solved

Merge pull request davedumto#501 from Jay-Peter-Egemasi/codex/routes-…

bc76e8b

…b-get-endpoints-477-485-488-489

feat: implement routes-b stale exchange fallback, authz helper, PAT e…

702c874

…ndpoints, and notification preferences

fix(api): use @/lib/db, verifyAuthToken, and Promise<params> on new r…

9f92c63

…outes Resolves module-not-found and Promise<params> type errors that broke the build. 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>

Themancalledpg closed this May 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: routes-b exchange-rate resilience, PAT flow, authz helper, and notification preferences#2

feat: routes-b exchange-rate resilience, PAT flow, authz helper, and notification preferences#2
Themancalledpg wants to merge 77 commits into
mainfrom
codex/routes-b-549-565-569-570

Themancalledpg commented Apr 28, 2026 •

edited

Loading

Uh oh!

Themancalledpg commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

Conversation

Themancalledpg commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes proposed

What were you told to do?

What did I do?

Exchange Rate Resilience

AuthZ + PAT

Notification Preferences

Check List (Check all the applicable boxes)

Screenshots / Testing Evidence

Uh oh!

Themancalledpg commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

Themancalledpg commented Apr 28, 2026 •

edited

Loading