01. Challenge

Payment stays on the website

The app calls POST /cart/checkout and gets a /app/checkout/‹48 chars› URL. The code is single-use, stored in cache only as a sha256, contains no basket token and does not sign anyone in. Opening the link adopts the basket in the browser and moves on to the regular checkout.

Three reasons: the app never sees a card, there is one payment flow to maintain, and Apple does not require In-App Purchase for physical goods. A wrong or old code leads to the basket with a sentence, not an error.

CheckoutHandoffController.phpCopy$token = $handoff->redeem($code);
$cart  = $token ? Cart::query()->where('token', $token)->first() : null;

if (! $cart || $cart->items()->doesntExist()) {
    return $this->private(redirect()->route('cart')
        ->with('notice', 'הקישור לתשלום כבר לא בתוקף. אפשר להמשיך מכאן.'));
}

CartManager::adopt($cart->token);

return $this->private(redirect()->route('checkout'));

Tokens bound to the device

Two tokens: access for 30 minutes, and a 60-day refresh token that is single-use and rotating. Reusing an old refresh token returns 401 and disconnects the device. Every request carries X-Install-Id, and a token copied to another phone is rejected.

On the app side, the client refreshes once even when five requests fail in the same second. A refresh that is refused ends the session. A refresh that never reached the server signs nobody out.

EnsureTokenMatchesDevice.phpCopyif (! $device || ! hash_equals((string) $device->install_id, $info->installId)) {
    return response()->json([
        'code'    => 'session_invalid',
        'message' => 'ההתחברות כבר לא בתוקף. יש להתחבר מחדש.',
    ], 401);
}

src/api/client.tsCopyasync request<T>(method: string, path: string, o: Options = {}): Promise<T> {
  const auth = o.auth ?? true;

  let res = await this.send(method, path, o, auth);

  if (res.status === 401 && auth && this.d.session.tokens) {
    const refreshed = await this.refresh();
    if (refreshed) res = await this.send(method, path, o, auth);
  }

  return this.parse<T>(res);
}

A home screen the server composes

/home returns the slider, the club banner and the gift-card banner from the same settings the website reads. No campaign is duplicated into the app: a change in the panel shows on the next open.

Two switches in the panel (club.home_banner, giftcard.home_banner) turn each banner off. A request that carries a token never enters a shared cache.

HomeController.phpCopyreturn response()->json(['data' => [
    'slides'    => $this->slides(),
    'club'      => setting('club.home_banner', true) ? $this->club($club, $user) : null,
    'gift_card' => setting('giftcard.home_banner', true) ? $this->giftCard() : null,
]])
    ->header('Cache-Control', $user ? 'private, max-age=60' : 'public, max-age=120')
    ->header('Vary', 'Authorization');

Push policy: delay, never give up

The Sabbath is closed to everything, from Friday 14:00 to Saturday 21:00. Offers go only between 09:00 and 20:00 and no more than two a week per phone. "Your order is ready" goes out whenever it is true, except on the Sabbath. An app-update notice is the only message that leaves immediately.

The function never refuses. It returns the next moment that is allowed, and sending is delayed to it. The logic is covered by tests.

PushPolicy.phpCopy// A few passes settle every combination (Shabbat end → before 09:00 → …).
for ($i = 0; $i < 6; $i++) {
    $moved = $this->afterShabbat($at);

    if ($category === 'promos' || $category === 'cart') {
        $moved = $this->withinHours($moved, ...$this->hoursFor($category));
        $moved = $this->afterShabbat($moved);
    }

    if ($moved->equalTo($at)) {
        return $at;
    }

    $at = $moved;
}

"Buy now" without touching the basket

A temporary basket is an ordinary row in the carts table with is_buy_now. The website keeps the real basket aside, and a middleware restores it the moment the customer leaves checkout for any other page. Images, scripts and prefetch do not count as leaving.

Abandoned-basket reminders and reports skip these baskets, so the numbers stay clean.

Abandoned baskets, in sequence and with manners

First reminder after 6 hours, then every 24, and stop after 72. Only between 09:00 and 20:00, never on the Sabbath, and never to a customer who paid in the meantime. A basket touched after a reminder counts as a new abandonment.

The stamp is written before sending (stamp-before-send), so a double send cannot happen even if the job runs twice. On the way a bug surfaced in the unpaid-order link, and it was fixed with a signed, expiring link.

Windows: what the guides do not say

A Hebrew user name got into sdk.dir and broke prefab. The fix: SDK in C:\Android\Sdk and a short GRADLE_USER_HOME. Then ninja failed on a 278-character path, because the ninja 1.10 that ships with CMake 3.22 is not long-path aware. The fix: LongPathsEnabled and ninja 1.12.1 in its place.

All of it became four scripts in the project folder, so the next build is one command, not a day of investigation.

PowerShellninja: error: mkdir(…/react_codegen_rngesturehandler_codegen.dir/C_/b/node_modules/
react-native-gesture-handler/shared/shadowNodes/react/renderer/components/…)

fix-hebrew-paths.ps1       SDK → C:\Android\Sdk, GRADLE_USER_HOME
build-in-short-path.ps1    project copy → C:\b
enable-long-paths.ps1      LongPathsEnabled=1 + ninja 1.12.1
refresh-build-copy.ps1     clean copy after a package rename