Update pricing UX, billing flows, and API rules

env-migration-checklist.md

@@ -0,0 +1,117 @@
+# .env Migration Checklist
+
+Use this to map legacy `dewemoji-live-backend/public_html/config/env.php` into NativePHP app `app/.env`.
+
+## 1) Local development (safe default)
+
+```env
+APP_ENV=local
+APP_DEBUG=true
+APP_URL=http://127.0.0.1:8000
+
+DB_CONNECTION=sqlite
+
+DEWEMOJI_BILLING_MODE=sandbox
+DEWEMOJI_LICENSE_ACCEPT_ALL=false
+DEWEMOJI_PRO_KEYS=
+
+DEWEMOJI_ALLOWED_ORIGINS=http://127.0.0.1:8000,http://localhost:8000
+DEWEMOJI_FRONTEND_HEADER=web-v1
+DEWEMOJI_FREE_DAILY_LIMIT=30
+
+DEWEMOJI_GUMROAD_ENABLED=false
+DEWEMOJI_MAYAR_ENABLED=false
+```
+
+## 2) Staging (real provider test)
+
+```env
+APP_ENV=staging
+APP_DEBUG=false
+APP_URL=https://staging.your-domain.com
+
+DB_CONNECTION=mysql
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_DATABASE=dewemojiAPI_DB
+DB_USERNAME=...
+DB_PASSWORD=...
+
+DEWEMOJI_BILLING_MODE=live
+DEWEMOJI_LICENSE_ACCEPT_ALL=false
+DEWEMOJI_PRO_KEYS=
+
+DEWEMOJI_ALLOWED_ORIGINS=https://staging.your-domain.com,https://dewemoji.com,https://www.dewemoji.com,https://emoji.dewe.pw
+DEWEMOJI_FRONTEND_HEADER=web-v1
+DEWEMOJI_FREE_DAILY_LIMIT=30
+
+DEWEMOJI_GUMROAD_ENABLED=true
+DEWEMOJI_GUMROAD_VERIFY_URL=https://api.gumroad.com/v2/licenses/verify
+DEWEMOJI_GUMROAD_PRODUCT_IDS=qfvcuT7RwcDn5Oi4KQcOBQ==,t8Kq1G5wzrd1KcYOgukpzw==
+
+DEWEMOJI_MAYAR_ENABLED=true
+DEWEMOJI_MAYAR_API_BASE=https://api.mayar.id
+DEWEMOJI_MAYAR_ENDPOINT_VERIFY=/v1/license/verify
+DEWEMOJI_MAYAR_SECRET_KEY=...
+```
+
+## 3) Production
+
+```env
+APP_ENV=production
+APP_DEBUG=false
+APP_URL=https://dewemoji.com
+
+DB_CONNECTION=mysql
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_DATABASE=dewemojiAPI_DB
+DB_USERNAME=...
+DB_PASSWORD=...
+
+DEWEMOJI_BILLING_MODE=live
+DEWEMOJI_LICENSE_ACCEPT_ALL=false
+DEWEMOJI_PRO_KEYS=
+
+DEWEMOJI_ALLOWED_ORIGINS=https://dewemoji.com,https://www.dewemoji.com
+DEWEMOJI_FRONTEND_HEADER=web-v1
+DEWEMOJI_FREE_DAILY_LIMIT=30
+
+DEWEMOJI_GUMROAD_ENABLED=true
+DEWEMOJI_GUMROAD_VERIFY_URL=https://api.gumroad.com/v2/licenses/verify
+DEWEMOJI_GUMROAD_PRODUCT_IDS=qfvcuT7RwcDn5Oi4KQcOBQ==,t8Kq1G5wzrd1KcYOgukpzw==
+
+DEWEMOJI_MAYAR_ENABLED=true
+DEWEMOJI_MAYAR_API_BASE=https://api.mayar.id
+DEWEMOJI_MAYAR_ENDPOINT_VERIFY=/v1/license/verify
+DEWEMOJI_MAYAR_SECRET_KEY=...
+```
+
+## 4) Legacy -> NativePHP key map
+
+- `gateway_mode` -> `DEWEMOJI_BILLING_MODE`
+- `allowed_origins[]` -> `DEWEMOJI_ALLOWED_ORIGINS` (comma-separated)
+- `frontend_header` -> `DEWEMOJI_FRONTEND_HEADER`
+- `free_daily_limit` -> `DEWEMOJI_FREE_DAILY_LIMIT`
+- `gumroad.product_ids[]` -> `DEWEMOJI_GUMROAD_PRODUCT_IDS` (comma-separated)
+- `gumroad.verify_url` -> `DEWEMOJI_GUMROAD_VERIFY_URL`
+- `mayar.api_base` -> `DEWEMOJI_MAYAR_API_BASE`
+- `mayar.endpoint_verify` -> `DEWEMOJI_MAYAR_ENDPOINT_VERIFY`
+- `mayar.secret_key` -> `DEWEMOJI_MAYAR_SECRET_KEY`
+
+## 5) Final checks
+
+1. Run: `php artisan config:clear`
+2. Run: `php artisan migrate --force`
+3. Test verify endpoint with real key (Gumroad and Mayar)
+4. Confirm `/v1/license/activate` + `/v1/license/deactivate`
+5. Confirm frontend pages: `/`, `/browse`, `/support`, `/pricing`, `/api-docs`
+
+## 6) Security note
+
+Legacy `env.php` contains exposed secrets. Rotate all production credentials before final cutover:
+- DB password
+- Mayar key
+- Turnstile keys
+- OpenRouter key
+- Redis password