Use branded <dn>/… links for bid + affiliate on tenant pages (#16)

Inside a masked parked-domain iframe, the bid link was a relative /?bid=<dn>, so
it navigated the iframe to moshcoding.com/?bid=<dn> — which refuses to be framed
(no ?dn → CSP frame-ancestors blocks it): 'moshcoding.com refused to connect'.
And the affiliate share link exposed moshcoding.com/?dn=<dn>&ref=<code>.

Both now use the branded domain URL:
- Bid link → https://<dn>/?bid=<dn> with target=_top (breaks out of the iframe
  to the branded domain instead of loading moshcoding.com in-frame)
- Affiliate share link → https://<dn>/?ref=<code>
- middleware also auto-allows the ?bid=<domain> as a frame-ancestor (like ?dn),
  so a forwarded bid page renders in-frame

Note: the domain's forwarding must pass query params through (Porkbun masked
forwarding with path/query, or param forwarding) for ?ref/?bid to reach the app;
safeDomain already handles the appended-query case.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

app/api/affiliate/join/route.ts

@@ -35,8 +35,10 @@ export async function POST(req: NextRequest) {
     dn,
     code: aff.code,
     commission_pct: aff.commission_pct,
-    // Domain-scoped share link: lands on <dn>'s page and sets the 90-day cookie.
-    shareUrl: `${baseUrl()}/?dn=${encodeURIComponent(dn)}&ref=${encodeURIComponent(aff.code)}`,
+    // Branded share link on the domain itself. The visit's ?ref rides through the
+    // domain's forwarding onto ?dn=<dn>&ref=… (see safeDomain), setting the
+    // 90-day mc_ref cookie. Requires the domain to forward query params.
+    shareUrl: `https://${dn}/?ref=${encodeURIComponent(aff.code)}`,
     manageUrl: `${baseUrl()}/dashboard`,
   });
 }

components/Tenant.tsx

@@ -114,7 +114,7 @@ export default function Tenant({ cfg }: { cfg: TenantConfig }) {
 
         <AffiliateJoin dn={cfg.dn} />
 
-        <a className="t-bid" href={`/?bid=${encodeURIComponent(cfg.dn)}`}>💰 Bid on this domain</a>
+        <a className="t-bid" href={`https://${cfg.dn}/?bid=${encodeURIComponent(cfg.dn)}`} target="_top" rel="noopener">💰 Bid on this domain</a>
 
         {cfg.adSlot && <CrawlProofAd slot={cfg.adSlot} format={cfg.adFormat} />}
 

middleware.ts

@@ -9,12 +9,14 @@ function frameAncestors(req: NextRequest): string {
   const allow = ["'self'", ...parked];
 
   // Auto-allow the parked domain currently being rendered. A masked-forwarded
-  // domain frames moshcoding.com/?dn=<self>, so the frame request carries its
-  // own ?dn; trust it to iframe just its own tenant page. This means new parked
-  // domains work without hand-editing FRAME_ANCESTORS for each one.
-  const dn = (req.nextUrl.searchParams.get("dn") || "").trim().toLowerCase();
-  if (dn.length <= 253 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/.test(dn)) {
-    allow.push(`https://${dn}`, `https://www.${dn}`);
+  // domain frames moshcoding.com/?dn=<self> (tenant page) or ?bid=<self> (its bid
+  // page), so the frame request carries its own domain; trust it to iframe just
+  // its own pages. New parked domains work without hand-editing FRAME_ANCESTORS.
+  const isDomain = (d: string) =>
+    d.length <= 253 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/.test(d);
+  for (const key of ["dn", "bid"]) {
+    const d = (req.nextUrl.searchParams.get(key) || "").trim().toLowerCase();
+    if (isDomain(d)) allow.push(`https://${d}`, `https://www.${d}`);
   }
   return allow.join(" ");
 }