[Meinianda-L]

Summary

This PR fixes several ways to get drinks or balance for free, closes a few data leaks, fixes functional bugs, adds tests and CI, and redesigns the UI in a cartoon sticker style built around a beluga mascot.

Before and after

Page	Before → After
Home
Menu
Item details
Checkout
User dashboard

Home (mobile)	Menu (mobile)

New pages:

Tray	Order ticket	Item details (mobile)	Tray (mobile)

Security fixes

• Prices came from the client. Editing the cart in sessionStorage (e.g. basePrice: "0.01") changed what the server charged. Prices are now computed from the database.
• Negative amounts minted balance. One item at -1 plus a cheaper one at 1, paid with balance, increased the user's balance. Each amount must now be a positive integer.
• Free Pay Later orders. Anyone could switch an unpaid order to payLater, which put it in the staff queue without ever being paid or pruned. Changing the payment method now checks ownership and only allows online methods.
• Order data leak. getOrder returned any order, including the customer's phone number, balance and permissions. Orders are now only visible to their owner (guests via a signed HTTP-only cookie) and to admins, and only expose the user's id, name and pinyin.
• Anyone could cancel anyone's unpaid order. Cancelling now checks ownership.
• Balance double spending. Concurrent balance payments could spend the same balance twice. Balance and points updates now lock the user row.
• Login. Fixed an open redirect, added an OAuth state nonce (login CSRF), and made the access cookie HTTP-only, SameSite=Lax and Secure on HTTPS. The token only identifies the user; permissions are always read from the database.
• Payment webhooks. WeChat Pay notifications now check the result code, merchant ID and amount, with a constant-time signature check. Stripe top-ups require payment_status = paid. All fulfilment is idempotent. Payments for orders that no longer exist are refunded automatically and logged.
• Internal helpers were moved out of 'use server' files and marked server-only. Server action inputs are validated with zod. Coupon checks and order creation are rate limited.
• Upgraded Next.js (16.3.8), React, sharp and Prisma. npm audit drops from 30 to 9 findings, and the remaining ones are in build-time tooling only.

Bug fixes

• SMS notifications were sent with the acting admin's OneLogin token. They now use the recipient's token, and balance top-ups now send a notification.
• Pruning unpaid orders now returns their reserved inventory and coupon uses, and expires their Stripe session.
• Refunds can no longer run twice; they take back points and restore inventory for drinks that weren't made.
• Denying OneLogin consent caused a 500 error.
• Pay Later reminders compared only the day of the month.
• Settings were re-initialised on every read (about 15 queries each time), and a missing setting crashed the app.
• The admin user page paginated the admin's own orders instead of the user's.
• Polling intervals were never cleared.
• The Stripe client is now created on first use, so the app and next build work without STRIPE_KEY.
• The server time zone now defaults to Asia/Shanghai.
• Blocked users can no longer order, pay or top up, and admins can now block users from the user page.

Tooling

• ESLint 9 flat config (next lint was removed in Next 16).
• Vitest unit tests (49), including database tests for concurrent balance updates.
• GitHub Actions running lint, typecheck, tests and build against PostgreSQL.
• Prisma migrations are now tracked with a 0_init baseline. The generated client is no longer committed; it is generated on install.
• npm run db:seed adds demo data for development.

UI

• A cartoon sticker style that keeps the original cream and yellow palette: thick outlines, hard shadows, a self-hosted rounded font (ZCOOL KuaiLe), and a hand-drawn beluga mascot. Dark mode is supported.
• Inline cart warnings replace the hover-only popovers, which didn't work on phones.
• The design rules are in docs/DESIGN.md, and the README now has a screenshots section.

Deployment notes

1. Existing database: run npx prisma migrate resolve --applied 0_init once, then use npm run db:migrate for future migrations.
2. HOST must be https://… for the login cookie to be marked Secure.
3. Cron jobs can keep using ?key=; Authorization: Bearer <CRON_KEY> is now also supported.
4. Users who are already logged in stay logged in.

Testing

• CI (lint, typecheck, 49 tests, build against a fresh PostgreSQL) passes.
• End-to-end checks against a production build passed (18): price tampering, negative amounts, guest order access, login CSRF, cookie flags, balance payment and refund, revoked admin access, and blocked users.
• WeChat notification checks passed (14): bad signature, wrong merchant, wrong amount, idempotency, orphan payments, concurrent top-ups, cron auth, and inventory and coupon restore on prune.