Merge pull request #410 from nursetechie/feat/unified-contributions

Author: therealjhay

app/(merchant)/dashboard/page.tsx

@@ -295,6 +295,11 @@ export default function DashboardPage() {
                 {payments.slice(0, 3).map((link) => {
                   const baseUrl = process.env.NEXT_PUBLIC_API_URL ?? '';
                   const linkUrl = `${baseUrl}/pay/${link.id}`;
+                  const clicks = link.clicks ?? 0;
+                  const converted = link.converted ?? 0;
+                  const conversionRate = clicks > 0 ? (converted / clicks) * 100 : 0;
+                  const rateLabel = clicks > 0 ? `${conversionRate.toFixed(0)}%` : 'No data';
+
                   return (
                     <Link
                       key={link.id}
@@ -309,9 +314,11 @@ export default function DashboardPage() {
                         <p className="text-xs text-muted-foreground font-mono truncate">{linkUrl}</p>
                         <div className="flex items-center gap-2 mt-1.5">
                           <div className="flex-1 h-1.5 bg-muted rounded-full overflow-hidden">
-                            <div className="h-full bg-amber-400 rounded-full" style={{ width: '50%' }} />
+                            {clicks > 0 && (
+                              <div className="h-full bg-amber-400 rounded-full" style={{ width: `${conversionRate}%` }} />
+                            )}
                           </div>
-                          <span className="text-xs text-muted-foreground font-medium">—</span>
+                          <span className="text-xs text-muted-foreground font-medium">{rateLabel}</span>
                         </div>
                       </div>
                       <div className="flex flex-col items-end gap-1 flex-shrink-0">

app/api/auth/session/route.ts

@@ -75,5 +75,9 @@ export async function DELETE() {
     'Set-Cookie',
     `csrf_token=; Path=/; Max-Age=0; SameSite=Strict${secureFlag}`
   );
+  res.headers.append(
+    'Set-Cookie',
+    `merchant_onboarded=; Path=/; Max-Age=0; SameSite=Lax${secureFlag}`
+  );
   return res;
 }

app/api/contact/route.ts

@@ -96,9 +96,19 @@ export async function POST(req: Request) {
 
     // 2. Enforce Rate Limiting
     if (!checkRateLimit(ip)) {
+      const record = rateLimitMap.get(ip);
+      const oldestTimestamp = record && record.timestamps.length > 0 ? record.timestamps[0] : Date.now();
+      const resetTimeMs = oldestTimestamp + 3600000;
+      const remainingSeconds = Math.max(0, Math.ceil((resetTimeMs - Date.now()) / 1000));
+
       return NextResponse.json(
         { error: "Too many submissions. Please try again in an hour." },
-        { status: 429 }
+        {
+          status: 429,
+          headers: {
+            "Retry-After": remainingSeconds.toString(),
+          },
+        }
       );
     }
 

app/onboarding/page.tsx

@@ -103,6 +103,8 @@ export default function OnboardingPage() {
         webhookUrl: data.webhookUrl || null,
       });
       localStorage.setItem("onboardingCompleted", "true");
+      const secureFlag = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+      document.cookie = `merchant_onboarded=true; Path=/; SameSite=Lax; Max-Age=86400${secureFlag}`;
       notify.success("Your merchant profile is ready!");
       router.push("/dashboard");
     } catch (error) {

app/pay/[linkId]/page.tsx

@@ -31,6 +31,16 @@ import { WalletModalFallback } from "@/components/wallet/WalletModalFallback";
 import { WalletModalErrorBoundary } from "@/components/wallet/WalletModalErrorBoundary";
 import { QRCodeModal } from "@/components/payments/QRCode";
 
+function hexToUint8Array(hexString: string): Uint8Array {
+  const cleanHex = hexString.startsWith('0x') ? hexString.slice(2) : hexString;
+  const len = cleanHex.length;
+  const result = new Uint8Array(len / 2);
+  for (let i = 0; i < len; i += 2) {
+    result[i / 2] = parseInt(cleanHex.substring(i, i + 2), 16);
+  }
+  return result;
+}
+
 export default function PaymentLinkPage() {
   const router = useRouter();
   const { isConnected, connect, address } = useWalletStore();
@@ -132,7 +142,7 @@ export default function PaymentLinkPage() {
           new Contract(contractId).call(
             "store_payment_reference",
             nativeToScVal(merchantAddress, { type: "address" }),
-            nativeToScVal(Buffer.from(referenceHex, "hex")),
+            nativeToScVal(hexToUint8Array(referenceHex)),
             nativeToScVal(stroopAmount, { type: "i128" }),
           ),
         )

lib/api/hooks.ts

@@ -21,6 +21,7 @@ export interface ApiPayment {
   stellarOpId?: string | null;
   url?: string;
   clicks?: number;
+  converted?: number;
 }
 
 export interface ApiSettlement {

lib/hooks/useLogin.ts

@@ -51,6 +51,8 @@ export function useLogin() {
       if (meRes.ok) {
         const merchantData = await meRes.json();
         if (merchantData.name === 'My Business') {
+          const secureFlag = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+          document.cookie = `merchant_onboarded=false; Path=/; SameSite=Lax; Max-Age=86400${secureFlag}`;
           router.push('/onboarding');
           return;
         }
@@ -59,6 +61,8 @@ export function useLogin() {
       // ignore
     }
 
+    const secureFlag = process.env.NODE_ENV === 'production' ? '; Secure' : '';
+    document.cookie = `merchant_onboarded=true; Path=/; SameSite=Lax; Max-Age=86400${secureFlag}`;
     router.push(user.role === 'admin' ? '/overview' : '/dashboard');
   }, [apiBase, login, router, success, error]);
 

middleware.ts

@@ -49,13 +49,20 @@ export function middleware(request: NextRequest) {
     return NextResponse.redirect(new URL('/auth/login', request.url));
   }
 
+  // Redirect onboarded merchants away from onboarding page
+  const isOnboarded = request.cookies.get('merchant_onboarded')?.value === 'true';
+  if (request.nextUrl.pathname === '/onboarding' && isOnboarded) {
+    return NextResponse.redirect(new URL('/dashboard', request.url));
+  }
+
   // Role-based protection
   if (isAdminRoute && role !== 'admin') {
     return NextResponse.redirect(new URL('/dashboard', request.url)); // redirect merchants from admin
   }
 
   // Protect merchant routes from admins
-  const isMerchantRoute = request.nextUrl.pathname === '/dashboard' ||
+  const isMerchantRoute = request.nextUrl.pathname === '/onboarding' ||
+                          request.nextUrl.pathname === '/dashboard' ||
                           request.nextUrl.pathname.startsWith('/payments') ||
                           request.nextUrl.pathname === '/transactions' ||
                           request.nextUrl.pathname === '/settlement' ||