Your AI-built app looks finished. See what's hiding underneath.

// app/checkout.tsx (runs in the browser)
const stripe = new Stripe("sk_live_...");

// server only, key kept out of the browser
const stripe = new Stripe(
  process.env.STRIPE_SECRET_KEY
);

-- table is reachable from the browser
create table orders (
  id uuid primary key,
  user_id uuid,
  total numeric
);

alter table orders
  enable row level security;

create policy "own orders" on orders
  for select
  using (auth.uid() = user_id);

app.get("/orders/:id", async (req, res) => {
  res.json(await Order.findById(req.params.id));
});

app.get("/orders/:id", auth, async (req, res) => {
  const order = await Order.findOne({
    _id: req.params.id,
    userId: req.user.id,
  });
  if (!order) return res.sendStatus(404);
  res.json(order);
});

const event = JSON.parse(req.body);
if (event.type === "checkout.session.completed") {
  await markPaid(event.data.object);
}

const event = stripe.webhooks.constructEvent(
  rawBody,
  req.headers["stripe-signature"],
  process.env.STRIPE_WEBHOOK_SECRET
);

const orders = await Order.find({ userId });
for (const order of orders) {
  order.items = await Item.find({
    orderId: order.id,
  });
}

const orders = await Order
  .find({ userId })
  .limit(50);
const items = await Item.find({
  orderId: { $in: orders.map((o) => o.id) },
});

app.post("/ask", async (req, res) => {
  res.json(await ai.chat(req.body.prompt));
});

app.post("/ask", auth, rateLimit({ max: 20 }),
  async (req, res) => {
    res.json(await ai.chat(req.body.prompt, {
      maxTokens: 800,
    }));
  });