feat: add /donate page with Stripe embedded checkout and Cloudflare Worker backend#118

Closed

alexwolson wants to merge 33 commits into

mainfrom

Commits on May 4, 2026

Add donation campaign page design spec

alexwolson
and
claude
committed

Commits on May 5, 2026

Add donation campaign implementation plan

alexwolson
and
claude
committed
feat: scaffold Cloudflare Worker for donation campaign
alexwolson
committed
feat: implement validateAmount with tests
alexwolson
committed
feat: implement incrementTotal and verifyStripeSignature with tests
alexwolson
committed
feat: implement Worker routing and endpoint handlers
alexwolson
committed
feat: add donation campaign page with embedded Stripe checkout
alexwolson
committed
chore: inject Stripe public key and Worker URL at build time
alexwolson
committed
chore: set real Cloudflare KV namespace ID
alexwolson
committed
Update dependencies
alexwolson
committed
fix: allow 127.0.0.1 CORS origin; derive return_url from request origin
alexwolson
committed
fix: copy updates and amount correction for donate page

alexwolson
and
claude
committed
chore: gitignore .wrangler/ cache directory

alexwolson
and
claude
committed
Delete docs/superpowers/specs/2026-05-04-donation-campaign-design.md
alexwolson
authored
Update maximum donation limit to $3,500.00
alexwolson
authored
Update test for maximum donation limit
alexwolson
authored
chore: remove unused native build dependencies from worker

alexwolson
and
claude
committed
fix: use constant-time HMAC verification for Stripe webhook signatures

alexwolson
and
claude
committed
fix: update stale $10,000 maximum test to match $3,500 limit

alexwolson
and
claude
committed
test: add unit tests for verifyStripeSignature

alexwolson
and
claude
committed
fix: omit CORS header for disallowed origins instead of reflecting civictech.ca

alexwolson
and
claude
committed
fix: handle invalid JSON in webhook body with 400 instead of 500

alexwolson
and
claude
committed
fix: validate /total response and clamp progress bar to goal

alexwolson
and
claude
committed
fix: harden Stripe signature header parsing and enforce timestamp tolerance

alexwolson
and
claude
committed
Potential fix for pull request finding

alexwolson
and
Copilot
authored
fix: fail CI fast when donate page secrets are missing

alexwolson
and
claude
committed
fix: guard against malformed hex in Stripe signature v1 values

alexwolson
and
claude
committed
fix: treat corrupted KV total as 0 instead of propagating NaN

alexwolson
and
claude
committed
fix: deduplicate Stripe webhook events using event.id in KV

alexwolson
and
claude
committed
fix: validate amount_total before incrementing KV total

alexwolson
and
claude
committed
fix: return 200 + log on invalid amount_total instead of 400

alexwolson
and
claude
committed
fix: guard against missing Stripe config before initialising SDK

alexwolson
and
claude
committed
fix: add aria-pressed to amount selection buttons for screen readers

alexwolson
and
claude
committed