feat: Add authentication, payments, and claim flow for detailed reports

[sungmanch]

Summary

This PR introduces a complete monetization and user account system for NoMoreAISlop:

• Authentication: Supabase OAuth integration with callback handling and middleware
• Payments: Polar.sh integration for purchasing detailed analysis reports
• Claim Flow: Users can claim anonymous analysis results to their account
• App Router Restructure: Migrated to (app) route group for consistent layouts
• CLI Improvements: Better caching, verbose mode, and cleaner output

Changes

Database

• Add user_id column to analysis_results table for ownership tracking

API Endpoints

• POST /api/analysis/claim - Claim anonymous analysis to user account
• GET /api/analysis/user - Fetch user's claimed analysis history
• GET /api/analysis/results/[id] - Enhanced with auth and unlock support
• POST /api/payments/checkout - Initiate Polar checkout session
• GET /api/payments/success - Handle post-payment redirect

Authentication

• /auth/callback route for OAuth completion
• Middleware for session management and protected routes

UI Components

• UnlockButton component for detailed report purchases
• Enhanced PublicResultPage with claim/unlock flow
• Updated PersonalDashboardPage with analysis history
• Improved navigation and auth context

CLI

• Simplified cache implementation
• Added -v/--verbose flag for detailed output
• Better cost estimation and formatting

Test plan

• Test OAuth login flow with GitHub/Google
• Test anonymous analysis → claim flow
• Test Polar checkout and payment success redirect
• Test detailed report unlock after payment
• Test CLI with --verbose flag
• Verify protected routes redirect to login

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
no-more-ai-slop	Ready	Preview, Comment	Jan 17, 2026 6:53am

[sungmanch]

Code review

Found 2 issues:

1. Authorization bypass in payment success handler - The database update at lines 68-75 marks an analysis result as paid using only result_id from checkout metadata, without verifying the result belongs to the authenticated user. An attacker could create a checkout with a victim's resultId in metadata, complete payment, and mark the victim's result as paid.

https://github.com/sungmanch/no-more-AI-slop/blob/d30d4f9d77024e477a611b876a2f29638b0f7964/app/api/payments/success/route.ts#L65-L76

2. Missing environment variable documentation (CLAUDE.md lists env vars in "Environment Variables" table) - The PR adds POLAR_ACCESS_TOKEN and POLAR_PRODUCT_ID as required environment variables in src/lib/polar/client.ts, but these are not documented in README.md's Environment Variables section.

https://github.com/sungmanch/no-more-AI-slop/blob/d30d4f9d77024e477a611b876a2f29638b0f7964/src/lib/polar/client.ts#L19-L26

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[sungmanch]

Code review

Found 4 issues:

1. Missing Polar environment variables in documentation (CLAUDE.md says "Environment Variables" section should list required variables)

The code in src/lib/polar/client.ts requires POLAR_ACCESS_TOKEN and POLAR_PRODUCT_ID, but these are not documented in CLAUDE.md's Environment Variables section.

https://github.com/sungmanch/no-more-AI-slop/blob/b59ac39f8039670bee9022d378b3b5700d523b7f/CLAUDE.md#L28-L35

2. Inconsistent environment variable naming in .env.example (CLAUDE.md specifies NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY)

The .env.example file uses SUPABASE_URL and SUPABASE_ANON_KEY instead of the NEXT_PUBLIC_ prefixed versions specified in CLAUDE.md. This would break Next.js client-side Supabase access.

https://github.com/sungmanch/no-more-AI-slop/blob/b59ac39f8039670bee9022d378b3b5700d523b7f/.env.example#L17-L22

3. Race condition in analysis claim route (TOCTOU vulnerability)

The claim handler has a check-then-update pattern where two concurrent claims can both pass the initial check. Supabase's .update().is('user_id', null) returns no error when 0 rows are affected, so both users receive success despite only one actually claiming. Add .select().single() after update to verify a row was affected.

https://github.com/sungmanch/no-more-AI-slop/blob/b59ac39f8039670bee9022d378b3b5700d523b7f/app/api/analysis/claim/route.ts#L86-L122

4. No validation of checkout metadata integrity (Authorization bypass)

The payment success handler trusts checkout.metadata?.resultId without verifying the result exists or that the user owns it. A malicious user could potentially unlock any result by manipulating checkout metadata. Verify result ownership before marking as paid.

https://github.com/sungmanch/no-more-AI-slop/blob/b59ac39f8039670bee9022d378b3b5700d523b7f/app/api/payments/success/route.ts#L55-L76

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}