gem "stripe", "~> 18.3"
+gem "resend", "~> 0.12"
gem "dotenv-rails", "~> 3.2"
class ApplicationController < ActionController::Base
+ helper_method :current_customer
+
+ private
+
+ def current_customer
+ @current_customer ||= Customer.find_by(id: session[:customer_id])
+ end
+
+ def require_auth
+ unless current_customer
+ session[:return_to] = request.fullpath
+ redirect_to login_path
+ end
+ end
+
+ def redirect_after_auth
+ path = session.delete(:return_to) || dashboard_path
+ redirect_to path
+ end
end
+require "net/http"
+require "uri"
+require "json"
+
class CheckoutController < ApplicationController
skip_before_action :verify_authenticity_token, only: [:webhook]
+ before_action :require_auth, only: [:start]
+
+ # GET /checkout/start — create Stripe session and redirect
+ def start
+ # Already subscribed — send to dashboard
+ if current_customer.subscribed?
+ return redirect_to dashboard_path
+ end
- def create_session
- session = Stripe::Checkout::Session.create(
- mode: "subscription",
- line_items: [{ price: ENV.fetch("STRIPE_PRICE_ID"), quantity: 1 }],
- success_url: "#{ENV.fetch("BASE_URL")}/dashboard?session_id={CHECKOUT_SESSION_ID}",
- cancel_url: "#{ENV.fetch("BASE_URL")}/",
+ stripe_session = Stripe::Checkout::Session.create(
+ customer_email: current_customer.email,
+ mode: "subscription",
+ line_items: [{ price: ENV.fetch("STRIPE_PRICE_ID"), quantity: 1 }],
+ success_url: "#{ENV.fetch("BASE_URL")}/dashboard",
+ cancel_url: "#{ENV.fetch("BASE_URL")}/pricing",
+ metadata: { customer_id: current_customer.id }
)
- render json: { url: session.url }
+
+ redirect_to stripe_session.url, allow_other_host: true
rescue Stripe::StripeError => e
- render json: { error: e.message }, status: :bad_request
+ redirect_to pricing_path, alert: e.message
end
+ # POST /checkout/webhook
def webhook
payload = request.body.read
sig_header = request.headers["HTTP_STRIPE_SIGNATURE"]
if event["type"] == "checkout.session.completed"
sess = event["data"]["object"]
+ # Find the customer we created at signup via metadata
+ customer = Customer.find_by(id: sess.dig("metadata", "customer_id"))
+ customer ||= Customer.find_by(email: sess.dig("customer_details", "email"))
+
+ return render json: { status: "ok" } unless customer
+
uri = URI("#{ENV.fetch("INFRA_SERVICE_URL")}/instances")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"
req.body = {
stripe_customer_id: sess["customer"],
stripe_subscription_id: sess["subscription"],
- email: sess.dig("customer_details", "email")
+ email: customer.email
}.to_json
- res = http.request(req)
-
+ res = http.request(req)
body = JSON.parse(res.body)
- Customer.find_or_create_by(stripe_customer_id: sess["customer"]) do |c|
- c.stripe_subscription_id = sess["subscription"]
- c.email = sess.dig("customer_details", "email")
- c.slug = body["slug"]
- c.status = body["status"] || "provisioning"
- end
+
+ customer.update!(
+ stripe_customer_id: sess["customer"],
+ stripe_subscription_id: sess["subscription"],
+ slug: body["slug"],
+ status: body["status"] || "provisioning"
+ )
end
render json: { status: "ok" }
class DashboardController < ApplicationController
+ before_action :require_auth
+
def show
- if params[:session_id].present?
- stripe_session = Stripe::Checkout::Session.retrieve(params[:session_id])
- @customer = Customer.find_by(stripe_customer_id: stripe_session.customer)
- elsif params[:email].present?
- @customer = Customer.find_by(email: params[:email])
- else
- redirect_to root_path
- end
- rescue Stripe::StripeError
- redirect_to root_path
+ @customer = current_customer
end
end
--- /dev/null
+class SessionsController < ApplicationController
+ def new
+ redirect_to dashboard_path if current_customer
+ end
+
+ def create
+ email = params[:email].to_s.strip.downcase
+
+ unless email.match?(URI::MailTo::EMAIL_REGEXP)
+ flash.now[:alert] = "Please enter a valid email address."
+ return render :new, status: :unprocessable_entity
+ end
+
+ customer = Customer.find_or_initialize_by(email: email)
+ customer.generate_magic_token!
+
+ CustomerMailer.magic_link(customer).deliver_now
+
+ # In development, log the link so you don't need a real email service
+ if Rails.env.development?
+ Rails.logger.info "MAGIC LINK: #{verify_url(token: customer.magic_token)}"
+ end
+
+ redirect_to login_sent_path
+ end
+
+ def sent
+ end
+
+ def verify
+ customer = Customer.find_by(magic_token: params[:token])
+
+ if customer.nil? || !customer.magic_token_valid?
+ flash[:alert] = "That link has expired or is invalid. Request a new one."
+ return redirect_to login_path
+ end
+
+ customer.verify_email!
+ session[:customer_id] = customer.id
+
+ redirect_after_auth
+ end
+
+ def destroy
+ session.delete(:customer_id)
+ redirect_to root_path
+ end
+end
--- /dev/null
+class ApplicationMailer < ActionMailer::Base
+ default from: ENV.fetch("MAILER_FROM", "hello@crimata.com")
+ layout "mailer"
+end
--- /dev/null
+class CustomerMailer < ApplicationMailer
+ def magic_link(customer)
+ @customer = customer
+ @url = verify_url(token: customer.magic_token)
+ @expires = "15 minutes"
+
+ mail(to: @customer.email, subject: "Your Crimata sign-in link")
+ end
+end
class Customer < ApplicationRecord
+ TOKEN_TTL = 15.minutes
+
+ def generate_magic_token!
+ self.magic_token = SecureRandom.urlsafe_base64(32)
+ self.magic_token_expires_at = TOKEN_TTL.from_now
+ save!
+ magic_token
+ end
+
+ def magic_token_valid?
+ magic_token.present? && magic_token_expires_at&.future?
+ end
+
+ def verify_email!
+ update!(
+ email_verified_at: Time.current,
+ magic_token: nil,
+ magic_token_expires_at: nil
+ )
+ end
+
+ def email_verified?
+ email_verified_at.present?
+ end
+
+ def subscribed?
+ stripe_customer_id.present?
+ end
end
--- /dev/null
+<p>Click the button below to sign in to Crimata. This link expires in <%= @expires %>.</p>
+
+<p style="margin: 32px 0;">
+ <a href="<%= @url %>" class="btn">Sign in to Crimata</a>
+</p>
+
+<p class="muted">
+ If you didn't request this, you can safely ignore this email.<br />
+ This link can only be used once.
+</p>
--- /dev/null
+Sign in to Crimata
+
+Click the link below to sign in. This link expires in <%= @expires %>.
+
+<%= @url %>
+
+If you didn't request this, you can safely ignore this email.
+This link can only be used once.
<%= link_to "Crimata", root_path, class: "logo" %>
<nav>
<%= link_to "Pricing", pricing_path %>
+ <% if current_customer %>
+ <%= link_to "Dashboard", dashboard_path %>
+ <%= link_to "Sign out", logout_path %>
+ <% else %>
+ <%= link_to "Sign in", login_path %>
+ <% end %>
</nav>
</header>
<main>
--- /dev/null
+<!DOCTYPE html>
+<html>
+<head>
+ <meta charset="UTF-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+ <style>
+ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #f9f9f9; color: #111; margin: 0; padding: 40px 16px; }
+ .card { background: #fff; border: 1px solid #eee; border-radius: 12px; max-width: 480px; margin: 0 auto; padding: 40px; }
+ .logo { font-size: 1.2rem; font-weight: 700; letter-spacing: -0.5px; margin-bottom: 32px; }
+ .btn { display: inline-block; background: #111; color: #fff; text-decoration: none; padding: 14px 32px; border-radius: 8px; font-weight: 600; font-size: 0.95rem; }
+ .muted { color: #888; font-size: 0.85rem; margin-top: 24px; }
+ </style>
+</head>
+<body>
+ <div class="card">
+ <div class="logo">Crimata</div>
+ <%= yield %>
+ </div>
+</body>
+</html>
--- /dev/null
+<%= yield %>
<li>Fully managed hosting</li>
<li>Cancel anytime</li>
</ul>
- <button class="btn" id="checkout-btn" style="width:100%">Get Started</button>
+ <%= link_to "Get Started", checkout_start_path, class: "btn", style: "width:100%; text-align:center; display:block;" %>
<p class="sub">No setup fees.</p>
</div>
</div>
-
-<script>
- document.getElementById('checkout-btn').addEventListener('click', async () => {
- const btn = document.getElementById('checkout-btn')
- btn.disabled = true
- btn.textContent = 'Redirecting...'
- try {
- const res = await fetch('/checkout/create_session', { method: 'POST', headers: { 'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content } })
- const data = await res.json()
- window.location.href = data.url
- } catch {
- btn.disabled = false
- btn.textContent = 'Get Started'
- alert('Something went wrong. Please try again.')
- }
- })
-</script>
--- /dev/null
+<% content_for :title, "Sign in — Crimata" %>
+
+<style>
+ .auth-wrap { max-width: 400px; margin: 0 auto; padding-top: 2rem; }
+ .auth-wrap h1 { font-size: 1.75rem; font-weight: 700; letter-spacing: -0.5px; margin-bottom: 0.5rem; }
+ .auth-wrap p { color: #555; margin-bottom: 2rem; font-size: 0.95rem; }
+ .auth-wrap input[type=email] {
+ width: 100%; padding: 0.875rem 1rem;
+ border: 1px solid #ddd; border-radius: 8px;
+ font-size: 1rem; margin-bottom: 1rem; outline: none;
+ transition: border-color 0.15s;
+ }
+ .auth-wrap input[type=email]:focus { border-color: #111; }
+ .auth-wrap .btn { width: 100%; text-align: center; }
+ .alert { color: #c0392b; font-size: 0.875rem; margin-bottom: 1rem; }
+</style>
+
+<div class="auth-wrap">
+ <h1>Create your account</h1>
+ <p>Enter your email and we'll send you a sign-in link — no password needed.</p>
+
+ <% if flash[:alert] %>
+ <p class="alert"><%= flash[:alert] %></p>
+ <% end %>
+
+ <%= form_with url: login_path, method: :post do |f| %>
+ <%= f.email_field :email,
+ placeholder: "you@example.com",
+ autofocus: true,
+ autocomplete: "email",
+ required: true %>
+ <%= f.submit "Send sign-in link", class: "btn" %>
+ <% end %>
+</div>
--- /dev/null
+<% content_for :title, "Check your email — Crimata" %>
+
+<style>
+ .sent-wrap { max-width: 400px; margin: 0 auto; padding-top: 2rem; text-align: center; }
+ .sent-wrap .icon { font-size: 3rem; margin-bottom: 1.5rem; }
+ .sent-wrap h1 { font-size: 1.75rem; font-weight: 700; letter-spacing: -0.5px; margin-bottom: 0.75rem; }
+ .sent-wrap p { color: #555; font-size: 0.95rem; line-height: 1.6; margin-bottom: 1rem; }
+ .sent-wrap a { color: #111; font-weight: 500; }
+</style>
+
+<div class="sent-wrap">
+ <div class="icon">✉</div>
+ <h1>Check your email</h1>
+ <p>We sent a sign-in link to your inbox. Click it to continue — the link expires in 15 minutes.</p>
+ <p>Wrong address? <a href="<%= login_path %>">Go back</a> and try again.</p>
+</div>
require "active_record/railtie"
# require "active_storage/engine"
require "action_controller/railtie"
-# require "action_mailer/railtie"
+require "action_mailer/railtie"
# require "action_mailbox/engine"
# require "action_text/engine"
require "action_view/railtie"
# Raise error when a before_action's only/except options reference missing actions
config.action_controller.raise_on_missing_callback_actions = true
+
+ # Mailer — don't actually send in dev; magic link is logged to Rails logger
+ config.action_mailer.delivery_method = :test
+ config.action_mailer.default_url_options = { host: "localhost", port: 3000 }
end
require "active_support/core_ext/integer/time"
+require "uri"
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.
# Do not dump schema after migrations.
config.active_record.dump_schema_after_migration = false
+ # Mailer
+ config.action_mailer.delivery_method = :resend
+ config.action_mailer.default_url_options = {
+ host: URI.parse(ENV.fetch("BASE_URL", "https://crimata.com")).host,
+ protocol: "https"
+ }
+
# Enable DNS rebinding protection and other `Host` header attacks.
# config.hosts = [
# "example.com", # Allow requests from example.com
--- /dev/null
+Resend.api_key = ENV.fetch("RESEND_API_KEY", "")
Rails.application.routes.draw do
root "pages#home"
- get "/pricing", to: "pages#pricing"
- get "/success", to: "pages#success"
- get "/dashboard", to: "dashboard#show"
+ get "/pricing", to: "pages#pricing"
- post "/checkout/create_session", to: "checkout#create_session"
- post "/checkout/webhook", to: "checkout#webhook"
+ # Auth
+ get "/login", to: "sessions#new", as: :login
+ post "/login", to: "sessions#create"
+ get "/login/sent", to: "sessions#sent", as: :login_sent
+ get "/verify", to: "sessions#verify", as: :verify
+ get "/logout", to: "sessions#destroy", as: :logout
+
+ # Dashboard (requires auth)
+ get "/dashboard", to: "dashboard#show"
+
+ # Checkout
+ get "/checkout/start", to: "checkout#start", as: :checkout_start
+ post "/checkout/webhook", to: "checkout#webhook"
get "up" => "rails/health#show", as: :rails_health_check
end
--- /dev/null
+class AddAuthFieldsToCustomers < ActiveRecord::Migration[7.1]
+ def change
+ add_column :customers, :magic_token, :string
+ add_column :customers, :magic_token_expires_at, :datetime
+ add_column :customers, :email_verified_at, :datetime
+
+ add_index :customers, :magic_token, unique: true
+ add_index :customers, :email, unique: true
+ end
+end
projects / crimata-website / commitdiff