MyPetID-Home

Clydius-maintained rebuild for the MyPetID NFC/QR pet profile, tracker, Dog Pack, and customer tag-purchase app.

What works now

• Dual-host Next.js app:
  • Vercel mode keeps server API routes for Stripe checkout, checkout confirmation, email verification codes, admin membership/coupon grants, admin Stripe/Patreon provider control, Google upload sync, uploads, and Dog Pack invite creation.
  • GitHub Pages mode uses BUILD_STATIC_EXPORT=1 and deploys a static export through .github/workflows/deploy-pages.yml.
• Marketing/home page explaining the MyPetID product and linking customers to /shop/.
• /shop/ and /subscribe/ explain the purchase/subscription process and show the two physical tag products:
  • Basic NFC Tag — $10.00, blank NFC card plus QR-code sticker.
  • ID NFC Tag Card — $15.00, license-style ID card with NFC + QR-code camera fallback.
• Stripe products/prices are created and saved in Supabase tag_products; Vercel API checkout creates tag_orders and returns secure Stripe Checkout sessions.
• Stripe monthly memberships are created for Basic/Silver/Gold/Diamond and mirrored in Supabase membership_tiers; Vercel APIs now expose membership summaries, Stripe Billing Portal sessions, server-side tag activation checks, Dog Pack invite limit checks, admin membership grants, random coupon-code generation/redemption, and admin Stripe provider controls. User account pages show private source/status; public pet profiles use only the tier.
• Stripe webhook endpoint reconciles Checkout, subscription, invoice, and refund events into Supabase orders/membership records.
• Payment success page confirms the Stripe Checkout session and marks matching Supabase orders paid when running on Vercel.
• Supabase Auth and dashboard workspace for signed-in account profile edits, email verification status/codes, pet create/update, physical tag claim, trusted browser records, owner scan logging, scan history, and admin tag/profile inventory.
• Saving a dog profile creates QR destination records for:
  • the public pet profile (pet_qr_codes), and
  • account/Dog Pack sharing (account_qr_codes).
• Public profile supports /pet/?tag=<tag_code> and /pet/?pet=<pet_id>.
• Upload UI is present, but original photo/document cloud persistence is paused while Supabase is quota-restricted. The staged next path is Google Photos/Drive first, with lightweight database references later.
• Dog Pack invite API creates shareable invite links.
• Demo public pet scan page at /pet/?tag=demo-tag-001 and scan consent gate at /scan/?tag=demo-tag-001.
• Supabase migration for commerce/QR/uploads/provider credentials: docs/migrations/2026-06-commerce-qr-uploads.sql.

Local setup

pnpm install
pnpm build                  # Vercel/server API mode
BUILD_STATIC_EXPORT=1 pnpm build  # GitHub Pages/static mode; app/api and proxy.ts must be moved aside for static export

Copy .env.example to .env.local and add only browser-safe public values locally. Private provider secrets belong in deployment/profile env stores, never in the repo.

Deployment

• Vercel project mypetid is the functional app host for server routes and provider callbacks.
• GitHub Pages remains a static export fallback/marketing host.
• .github/workflows/deploy-pages.yml temporarily moves app/api and proxy.ts during the GitHub Pages static build and restores them afterward.
• The GitHub Pages build sets NEXT_PUBLIC_API_BASE_URL (default https://mypetid.vercel.app, overridable with a repository variable) so server features call the Vercel API. The Vercel build allows those origins via CORS on /api/* (next.config.mjs; override with CORS_ALLOWED_ORIGINS, comma-separated).
• Vercel should set NEXT_PUBLIC_APP_BASE_URL=https://mypetid.vercel.app so Stripe/OAuth return URLs use the production domain.
• /api/* routes answer with and without a trailing slash (no 308), so the Stripe webhook works at either URL; pages still redirect to the trailing-slash form (proxy.ts).
• Database security: apply docs/migrations/2026-10-security-hardening.sql and check it with node scripts/verify-rls.mjs (anon key only). See docs/migrations/2026-10-security-hardening.README.md.

Provider status

• Supabase: live project ryyaefxszkmibcnngnfg is currently restricted by exceed_egress_quota; auth/data features that depend on Supabase are degraded until the quota/spend-cap issue is resolved.
• Stripe: Basic NFC Tag and ID NFC Tag Card products/prices are configured; Basic/Silver/Gold/Diamond monthly subscription prices are configured; checkout/session confirmation/webhook/Billing Portal APIs are implemented for Vercel. Admin can view/create/archive Stripe products/prices and create coupons/promotion codes from the MyPetID dashboard. Admin app coupons can also optionally attempt matching Stripe 100%-off promotion-code creation while MyPetID app coupons remain the source of truth for comp access.
• Patreon: routes/env scaffolding exist, but live token refresh/reconnect is deferred. Patreon is not currently treated as an up service.
• Google: Vercel Google OAuth env and /api/google/status/ are healthy; Photos/Drive/Docs/Calendar server helpers and scopes are staged. User-level Google connection still waits on Supabase-backed token storage being available.
• Email verification: Yahoo SMTP credentials verify successfully and Vercel routes are implemented; final code storage/verification still depends on Supabase availability. Support/admin/help addresses remain separate; automated SMS/phone PIN verification is not planned.

Security notes

• Never commit .env, service-role keys, PATs, Stripe keys, Patreon tokens, Google OAuth secrets, Mongo URLs, passwords, or Supabase access tokens.
• Supabase anon/publishable keys are public by design, but RLS must enforce access.
• MyPetID now uses server-side Vercel membership checks for tag activation and Dog Pack invite slot limits. Admin/CAK3D accounts remain unrestricted for active testing.