Let Signed-In Customers Manage Orders Without Email Verification

// app/account/portal/route.ts
import { NextResponse } from "next/server";
import { WaffoPancake } from "@waffo/pancake-ts";
import { getSignedInUser } from "@/lib/auth"; // your own session check

const client = new WaffoPancake({
  merchantId: process.env.WAFFO_MERCHANT_ID!,
  privateKey: process.env.WAFFO_PRIVATE_KEY!,
});

export async function GET(request: Request) {
  const user = await getSignedInUser(request);
  if (!user) {
    return NextResponse.redirect(new URL("/login", request.url), 302);
  }

  try {
    // portalUrl already includes #token=...
    const { portalUrl } = await client.auth.createCustomerPortalLink({
      storeId: process.env.WAFFO_STORE_ID!,
      buyerIdentity: user.id, // same value used at checkout
    });

    const response = NextResponse.redirect(portalUrl, 302);
    response.headers.set("Cache-Control", "no-store");
    response.headers.set("Referrer-Policy", "no-referrer");
    return response;
  } catch (err) {
    // Log the error, never the portal URL
    console.error("customer portal link failed", err);
    return new NextResponse("The customer portal is unavailable. Please try again.", { status: 502 });
  }
}

// app/account/portal/route.ts
// Signature summary — see the @waffo/pancake-nextjs reference for the exact types
import { createCustomerPortalRedirect } from "@waffo/pancake-nextjs/server";
import { getSignedInUser } from "@/lib/auth"; // your own session check

export const GET = createCustomerPortalRedirect(
  {
    merchantId: process.env.WAFFO_MERCHANT_ID!,
    privateKey: process.env.WAFFO_PRIVATE_KEY!,
  },
  {
    // Resolve the customer from YOUR session, never from the request body or query
    resolveAuthenticatedCustomer: async (request) => {
      const user = await getSignedInUser(request);
      return user ? { storeId: process.env.WAFFO_STORE_ID!, buyerIdentity: user.id } : null;
    },
    // Fixed path you control; without loginUrl, signed-out visitors get a 401
    loginUrl: "/login?returnTo=/account/portal",
  },
);

import express from "express";
import { WaffoPancake } from "@waffo/pancake-ts";

const client = new WaffoPancake({
  merchantId: process.env.WAFFO_MERCHANT_ID!,
  privateKey: process.env.WAFFO_PRIVATE_KEY!,
});

const app = express();

// req.user is set by your own auth middleware; typed here for the example
type SignedInRequest = express.Request & { user?: { id: string } };

app.get("/account/portal", async (req: SignedInRequest, res) => {
  const user = req.user;
  if (!user) return res.redirect(302, "/login");

  try {
    const { portalUrl } = await client.auth.createCustomerPortalLink({
      storeId: process.env.WAFFO_STORE_ID!,
      buyerIdentity: user.id,
    });
    res.set("Cache-Control", "no-store");
    res.set("Referrer-Policy", "no-referrer");
    res.redirect(302, portalUrl);
  } catch (err) {
    // Log the error, never the portal URL
    console.error("customer portal link failed", err);
    res.status(502).send("The customer portal is unavailable. Please try again.");
  }
});

// Snippet, not a full program: mount portalHandler on your own server.
// signedInUser is your own session lookup, e.g.
//   func signedInUser(r *http.Request) (user User, ok bool)
// Exact types: https://pkg.go.dev/github.com/waffo-com/waffo-pancake-sdk-go
import (
	"log"
	"net/http"
	"os"

	pancake "github.com/waffo-com/waffo-pancake-sdk-go"
)

func portalHandler(client *pancake.Client) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		user, ok := signedInUser(r) // your own session check
		if !ok {
			http.Redirect(w, r, "/login", http.StatusFound)
			return
		}

		link, err := client.Auth.CreateCustomerPortalLink(r.Context(), pancake.CreateCustomerPortalLinkParams{
			StoreID:       os.Getenv("WAFFO_STORE_ID"),
			BuyerIdentity: user.ID, // same value used at checkout
		})
		if err != nil {
			log.Printf("customer portal link failed: %v", err) // never log link.PortalURL
			http.Error(w, "The customer portal is unavailable. Please try again.", http.StatusBadGateway)
			return
		}

		// link.PortalURL already includes #token=...
		w.Header().Set("Cache-Control", "no-store")
		w.Header().Set("Referrer-Policy", "no-referrer")
		http.Redirect(w, r, link.PortalURL, http.StatusFound)
	}
}