Repository navigation
feat(web): the plans page on production, US prices, buy buttons disabled - #26
Merged
Merged
Conversation
… buy button disabled /plans shows the four plans as US monthly and yearly prices before tax (Lite, Standard, Premium, Exclusive; a year is ten times the month), Standard marked as opening first, the price formula, and "regional prices follow" with no figure. Each row's buy control is a real disabled button that reads "Coming soon" (Thai: "เร็ว ๆ นี้"): no link, no form, no checkout code, no payment script. No Free plan is named, no token count, no model name. The page has no preview banner and no noindex; it carries the production shell and footer of the home page and links only to pages production has. It is listed in the sitemap and declared a shipped asset; the CSP gains the one hash for its own inline style block (its script and noscript style are byte-identical to the home page's). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…uy on a production page Two clauses on the pages the site serves. (a) No tracked web page, preview or production, names a Free plan or a free tier in either language: the preview rule's Free check, read over every page. (b) A production page carries no live buy control: every button is disabled (the two language-toggle buttons are the one allowance), no form or submit-type input, no link that reads as a buy control, no Paddle script or global, and no URL attribute naming a Paddle host, a checkout path or a _ptxn query. Each shape has one clause that owns it, so a mutant removing one lets its own fixture through and no other. Red first: against the gate as it stood, 21 of the 24 live fixtures slipped through; with the rule, all 24 are refused or passed as wanted and all 6 mutants reproduce the miss. A production page that holds no button at all is a finding, not a pass. The stated limits of each clause sit in the rule's comment. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…tion plans page and rule 17 The CHANGELOG records the production /plans page (static US prices, disabled Coming soon buttons, indexable, one extra style hash) and rule 17. docs/DEPLOY.md names the two production pages and what the sitemap and robots.txt mean for /plans. governance/policies.md lists the rule's two classes, with the script as the list of record. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The attribute test was built from a plain string, where '\w' is only the letter w, so the pattern refused a neighbour of w or a hyphen and not a longer attribute name. A live button written with notdisabled or disabledx passed as disabled. The backslashes are now doubled, and every other RegExp built from a string in this file was checked: none had the same slip. Red first: both witnesses passed the gate before the fix and are refused after; a bare disabled, disabled="disabled" and the no-attribute, aria-, title= and data- cases behave as before, and the single-backslash form put back lets both witnesses through. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a bilingual ChangesPlans page and surface checks
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Feature Merge Risk: 🔵 Low · up to The new plans page itself looks safe, with disabled buy buttons and no payment code. The CI check meant to keep it that way has a few gaps that could let a live buy control through, or wrongly reject a valid page. Tightening those patterns is a small follow-up and is worth doing soon.
Comment |
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://lwk-k5-plans-prod-kolwen.hetcreep.workers.dev (commit f08aa4b)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Organization UI
- Review profile: CHILL
- Plan: Essentials
- Run ID:
237cffe5-4f77-4f7a-b7d3-5dafabff5206
📒 Files selected for processing (7)
CHANGELOG.mddocs/DEPLOY.mdgovernance/policies.mdscripts/surface-check.mjsweb/_headersweb/plans.htmlweb/sitemap.xml
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Workers Builds: kolwen
🧰 Additional context used
📓 Path-based instructions (6)
Kolwen's page served from Cloudflare Workers, and its deploy-kit master in .github.
⚙️ CodeRabbit configuration file
Files:
web/sitemap.xmlweb/_headersweb/plans.html
Keep a Changelog.
⚙️ CodeRabbit configuration file
Files:
CHANGELOG.md
ISO/IEC 27001:2022 and 42001:2023 control-family records that state what is TRUE today; they are not a certification.
⚙️ CodeRabbit configuration file
Files:
governance/policies.md
Repo gates and CLIs.
⚙️ CodeRabbit configuration file
Files:
scripts/surface-check.mjs
House style is the UNSPACED em dash, an owner ruling, so do not suggest spaced dashes.
⚙️ CodeRabbit configuration file
Files:
governance/policies.mdCHANGELOG.mddocs/DEPLOY.md
Context for every file.
⚙️ CodeRabbit configuration file
Files:
web/sitemap.xmlgovernance/policies.mdweb/_headersCHANGELOG.mddocs/DEPLOY.mdscripts/surface-check.mjsweb/plans.html
🪛 GitHub Check: CodeQL
scripts/surface-check.mjs
[failure] 726-726: Bad HTML filtering regexp
This regular expression does not match script end tags like </script >.
🔇 Additional comments (4)
web/plans.html (1)
1-183: LGTM!web/_headers (1)
71-74: LGTM!Also applies to: 101-101
web/sitemap.xml (1)
8-12: LGTM!governance/policies.md (1)
24-24: 🗄️ Data Integrity & IntegrationThe checker applies the Free-plan rule to every tracked HTML page under
web/and applies the purchase-control checks only to production pages. The policy scope matches; no correction is needed.
…text closed with whitespace The tag filter ended each skipped block at a bare closing tag, so "</script >" or "</svg >" (which the HTML parser closes on, and which rule 13's own pattern allows) left the block's text in the visible text: a Free-looking word inside it was refused as if the page said it, and CodeQL flagged the filter as a bad HTML filtering regexp. The pattern now closes on the same tag name followed by a word boundary and any attributes. Red first: an svg with the text "Free plan" closed by "</svg >" was refused before and passes after; a visible "Free plan" after such a tag, and in plain text, is still refused; the old pattern put back refuses the first fixture again. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… as the disabled attribute The test that a button is disabled removed quoted values before looking for the name, but an unquoted value stayed: data-state=disabled, or data-x = disabled, left the word in the text and the live button passed as disabled. Values are now removed after any "=", quoted or not. Red first: three live buttons (an unquoted value on a data attribute, with spaces round the "=", and on aria-label) passed before and are refused after; a real disabled written "disabled/", after an unquoted value, and as disabled="disabled" still pass; the old function put back lets the first one through. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…e alt as well as its text An icon-only link such as <a aria-label="Buy now"><svg></svg></a> has no text for the buy-word test to read, and its URL need not look like a checkout, so a live buy link passed. The test now reads the link's aria-label and title and the alt of an image inside it beside its text, in both languages. A link named only by aria-labelledby or CSS content is still not read; that limit is in the rule's comment. Red first: four linked fixtures (aria-label, title, a Thai aria-label, an image alt) passed before and are refused after; a link labelled "Contact us" and the page's own "Kolwen home" link still pass; the label check removed lets the first fixture through. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
web/plans.htmlbecomes a production page athttps://kolwen.com/plans. It shows the four US monthly prices before tax (Lite $8, Standard $20, Premium $100, Exclusive $200) and the annual price at 10× monthly. Standard opens first; the others open later. Every row carries a disabled "Coming soon" button (Thai: "เร็ว ๆ นี้"). The page has no checkout code, no payment script and no form, and no "Free" plan. It is in English with a Thai twin, uses the production shell, and has no noindex and no preview banner. Regional prices follow.web/sitemap.xmllists/plans, andweb/_headerscarries its CSP hash.scripts/surface-check.mjsrule 17: no web page may name a Free plan, and no production page may carry a buy control that is not disabled, a payment script or a checkout URL. The attribute check readsdisabledas a whole attribute name.docs/DEPLOY.mdandgovernance/policies.md.Proof
disabledboundary is red-first:notdisabledanddisabledxare now refused, and a mutant brings that miss back.🤖 Generated with Claude Code
Summary by CodeRabbit
/planswith monthly and yearly US pricing for four plans, plus details about annual pricing, taxes, and existing subscription prices.