Serve branded parked domains directly (Host-based tenant resolution) (#17)

* Use branded <dn>/… links for bid + affiliate on tenant pages

Inside a masked parked-domain iframe, the bid link was a relative /?bid=<dn>, so
it navigated the iframe to moshcoding.com/?bid=<dn> — which refuses to be framed
(no ?dn → CSP frame-ancestors blocks it): 'moshcoding.com refused to connect'.
And the affiliate share link exposed moshcoding.com/?dn=<dn>&ref=<code>.

Both now use the branded domain URL:
- Bid link → https://<dn>/?bid=<dn> with target=_top (breaks out of the iframe
  to the branded domain instead of loading moshcoding.com in-frame)
- Affiliate share link → https://<dn>/?ref=<code>
- middleware also auto-allows the ?bid=<domain> as a frame-ancestor (like ?dn),
  so a forwarded bid page renders in-frame

Note: the domain's forwarding must pass query params through (Porkbun masked
forwarding with path/query, or param forwarding) for ?ref/?bid to reach the app;
safeDomain already handles the appended-query case.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Resolve tenant by Host header (serve branded domains directly, no iframe)

Porkbun MASKED forwarding serves a static frameset with a FIXED src
(moshcoding.com/?dn=<self>) and drops the visitor's query — so ?ref/?bid never
reach the app. That's unfixable with masked forwarding.

Fix: when the app is served DIRECTLY on a branded custom domain (Host is not
moshcoding.com / *.railway.app / localhost), resolve the tenant from the Host
header. The domain then renders its own tenant page natively — no iframe, no
CSP, and ?ref/?bid arrive intact. ?dn still wins (keeps the masked-iframe path
working), so this is backward-compatible.

Verified: Host moshscript.com → moshscript tenant page; +?ref sets the 90-day
mc_ref cookie natively; +?bid → BidPage; Host moshcoding.com → landing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: ralyodio

app/page.tsx

@@ -1,4 +1,5 @@
 import type { Metadata } from "next";
+import { headers } from "next/headers";
 import { configFor, safeDomain } from "@/lib/config";
 import { getTenantConfig } from "@/lib/db";
 import Landing from "@/components/Landing";
@@ -8,6 +9,24 @@ import BidPage from "@/components/BidPage";
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
 
+/**
+ * The parked domain from the Host header, when the app is served DIRECTLY on a
+ * branded custom domain (not moshcoding.com / *.railway.app / localhost). Lets a
+ * domain pointed straight at this service render its own tenant page natively —
+ * no iframe, no CSP, and query params (?ref, ?bid) arrive intact. Returns null
+ * for the main app host so moshcoding.com keeps its landing page.
+ */
+async function hostTenantDn(): Promise<string | null> {
+  const h = await headers();
+  const host = (h.get("host") || "").toLowerCase().split(":")[0].replace(/^www\./, "");
+  if (!host) return null;
+  const appHost = (process.env.APP_BASE_URL || "https://moshcoding.com")
+    .replace(/^https?:\/\//, "").replace(/\/.*$/, "").toLowerCase().replace(/^www\./, "");
+  if (host === appHost || host === "localhost" || host === "127.0.0.1") return null;
+  if (/\.railway\.app$|\.up\.railway\.app$/.test(host)) return null;
+  return safeDomain(host);
+}
+
 // Per-tenant OpenGraph/Twitter with a branded, generated og:image so every
 // parked domain shares nicely. No ?dn= → the landing keeps the layout defaults.
 export async function generateMetadata({
@@ -16,7 +35,7 @@ export async function generateMetadata({
   searchParams: Promise<Record<string, string | undefined>>;
 }): Promise<Metadata> {
   const sp = (await searchParams) || {};
-  const dn = safeDomain(sp.dn);
+  const dn = safeDomain(sp.dn) || (await hostTenantDn());
   if (!dn) return {};
   const tenantOverride = await getTenantConfig(dn).catch(() => null);
   const cfg = configFor(dn, {
@@ -42,7 +61,8 @@ export default async function Page({
   const sp = (await searchParams) || {};
   const bidDn = safeDomain(sp.bid);
   if (bidDn) return <BidPage dn={bidDn} />;
-  const dn = safeDomain(sp.dn);
+  // ?dn wins (iframe/masked path); else the branded Host (direct custom domain).
+  const dn = safeDomain(sp.dn) || (await hostTenantDn());
   if (!dn) return <Landing />;
 
   // A paid/provisioned domain has a tenants row that overrides the defaults.