eminux/MatchLiveTv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix PCI Stripe e anteprima regia; checkout sempre hosted.

Browse Source 
Blocca l'invio di numeri carta dall'API server, usa Checkout anche per i cambi piano e nasconde correttamente il placeholder video in regia.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Emiliano Frascaro
2026-05-29 08:00:28 +02:00
parent f4b7be0f80
commit 148402a97c
12 changed files with 294 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/PRODUCT_PREMIUM.md
View File

@@ -34,4 +34,7 @@ STRIPE_PREMIUM_FULL_PRICE_ID=price_...
STRIPE_WEBHOOK_SECRET=whsec_...
```
Checkout: `GET /teams/:id/checkout?plan=premium_light|premium_full`
Checkout (PCI-safe, redirect Stripe Hosted): `GET /clubs/:id/checkout?plan=premium_light|premium_full`
**Sicurezza pagamenti:** non inviare mai `card[number]`, CVC o scadenza all'API Stripe dal backend.
Usare solo Checkout/Customer Portal. I test locali vanno fatti con carta `4242…` **sulla pagina Stripe**, non con `PaymentMethod.create` in `rails runner`.