01a03535 - Add invite and promo landing pages

[JonnyLuca]

Summary / Zusammenfassung

EN. Invite and promo landing pages on realunit.app (Offerte Entwurf 3, point 3): public lookup, store badges, copy, Universal Links / App Links, Play Install Referrer. Language × device × state visuals are covered. This branch supersedes #27 with clean, signed, tool-neutral commits; the tree is byte-identical to the reviewed #27 head.

DE. Einladungs- und Promo-Landings auf realunit.app (Offerte Entwurf 3, Ziff. 3): öffentlicher Lookup, Store-Badges, Kopieren, Universal Links / App Links, Play Install Referrer. Sprache × Gerät × Zustand visuell abgedeckt. Dieser Branch ersetzt #27 mit sauberen, signierten, werkzeugneutralen Commits; der Baum ist byte-identisch zum reviewten #27-Head.

Scope, measurements, blockers

Scope

• /invite/{code} personal greeting from public lookup; /promo/{code} campaign text (promo Aktionstext 1:1).
• Public lookup GET /v1/realunit/referral/code/:code consumes backend inviterName / inviteeName (CORS on realunit.app). NestJS unmounted Cannot GET is unavailable, not invalid.
• Universal Links / App Links: AASA + Digital Asset Links as HTTP 200 on apex and www (no 301 on .well-known/). Extra AASA alias /apple-app-site-association as HTTP 200 (www included).
• Referral code reflected into the crawler HTML is escaped at the text sinks with a function replacer; the production Digital Asset Links no longer carry the Android debug-keystore fingerprint.
• Store badges, copy code/link, iOS re-tap hint, Android Play Install Referrer (attached during lookup).
• Playwright tests/site.spec.mjs + tests/behavior.spec.mjs + tests/visual.spec.mjs. Visual matrix in tests/pages.mjs (invite/promo × ok/loading/invalid/unavailable/spent/missing-code/fallback × DE/EN × desktop/tablet/iOS/Android as applicable). Baselines via e2e:docker:update only.

Measured (native host; content identical to the reviewed #27 head)

Check	Result
npm run check	Prettier OK; html-validate OK; check-site 6 HTML / 54 refs; vitest 144/144; 100% lines/statements/branches/functions
npm run e2e:docker	234 passed, 282 project-inapplicable skipped, 0 failed; check-visual 112/112 baselines present

Post-merge / operator actions

• Backend rollout: DFXswiss/backend#5415 implements and tests the matching lookup route and fields; live deployment remains human-owned.
• Human: merge this PR so production realunit.app AASA, assetlinks and /invite/* stop 404ing.
• Human: Play App Signing fingerprint if it differs from the GitHub APK.

Related: RealUnitCH/intern#3 (do not auto-close).

[JonnyLuca]

Finalisation (double-review + CI green)

This branch supersedes #27 with clean, signed, tool-neutral commits and adds the review hardening on top.

• Cross-vendor double-review (Claude Opus 5 + Codex, conformity + logic) run to 0 findings: the crawler-HTML sinks escape a reflected referral code at every text sink (og/twitter/<title>, image-alt, description) with a function replacer so a $ in the code is never a backreference; a plain-text Cannot GET 404 maps to unavailable; a 2xx with a non-JSON body now also falls through to unavailable instead of a false success; the production Digital Asset Links no longer carry the Android debug fingerprint.
• CI green on this head: Quality (prettier + html-validate + check-site + 144/144 unit tests, 100% coverage) and Visual regression (265 Playwright tests, check-visual OK) both pass. Locally reproduced via npm run check and npm run e2e:docker.
• mergeable = MERGEABLE, no open review threads.

Ready for human review and merge.

[TaprootFreakAI]

EN. This PR carried no formal review — the only evidence was a self-posted comment. A full double review (conformity + logic) was run against the real head; unlike its sibling RealUnitCH/app#966 the CI here was honest and the suite genuinely green, so the findings are real defects rather than a broken baseline. Five of them could credit a referral to the wrong person or send the app the wrong programme; all five are fixed and each is covered by a test that fails when the fix is reverted. Remaining findings are quality items with no user-facing harm and follow in a separate PR.

DE. Dieser PR hatte kein formales Review — der einzige Beleg war eine Selbstauskunft. Es lief ein vollständiges Doppelreview am echten Head. Anders als beim Schwester-PR RealUnitCH/app#966 war die CI hier ehrlich und die Suite wirklich grün, die Funde sind also echte Defekte. Fünf davon konnten eine Empfehlung dem Falschen gutschreiben oder der App die falsche Programmart übergeben; alle fünf sind behoben und jeweils durch einen Test abgesichert, der ohne die Korrektur rot wird. Der Rest sind Qualitätsthemen ohne Nutzerschaden und kommt als eigener PR nach.

Findings fixed here

Wrong referrer could be credited

• unwrapNestedCode matched invite/ anywhere in the value, so an issued code containing it (PREFIXINVITE/AB12CD) collapsed onto its tail. Codes may legitimately contain a slash — tests/behavior.spec.mjs covers /invite/AB%2F12 — and there is no character validation, so this hit honest users, not just crafted links. Anchored at start-or-slash on both the browser module and the function mirror.
• codeFromReferralHostInPath accepted our host from any segment of a foreign path: example.com/r/realunit.app/invite/ATTACKER yielded ATTACKER, silently defeating the isRealUnitHost check twenty lines above it. Restricted to the marked viewer forms that actually need it (/amp/s/<host>, /c/s/<host>, /https/<host>); AMP and android-app links keep working.
• The function-side landing matcher was unbounded, so evilrealunit.app/invite/X contained our host as a substring and passed. Bounded on the left.

Wrong programme handed to the app

• The page switched its copy on the API-confirmed kind but every hand-off kept the kind from the URL path. /invite/<a promo code> therefore showed the promo text while the deeplink, the smart app banner and the Play install referrer still said invite=. A single effective kind is now re-applied once the lookup answers.

Crash and silent mangling in the cap

• Capping ran after the trailing-punctuation strip, so a cut landing on a separator left it in place (…C.). A cut through a surrogate pair left a lone surrogate, which makes encodeURIComponent throw when the code goes into the lookup URL. Both mirrored client and server.
• The 32-character cap itself was deliberately not changed to a rejection: sanitizeReferralCode in the API and the app fold identically, and diverging here would be worse than the collision it avoids.

Two tests asserted the bugs as intended behaviour — ?code=prefixinvite/AB12CD → AB12CD and example.com/%zz/realunit.app/invite/AB12CD → AB12CD. Both corrected, and the attack case added as a regression test.

Test and gate quality

• coverage.include measured the wrong file. It listed only public/js/lib, so the 100% badge was earned partly by a browser-side mirror whose two HTML transformers are referenced from tests only, while functions/lib/itunes-banner.js — the module _middleware.js actually imports — was not measured at all. It sits at 98.98% lines / 88% branches; that is now included and ratcheted, with three added tests for paths this uncovered (bare store link, unparseable lang, fragment-only code).
• Four assertions did not test the thing under test: three parser fallbacks accepted any non-empty string (a truncated or half-decoded code would have passed), the cap test accepted any 32-character output, the Play-referrer expectation was built from the same production helper it verifies, and a setAttribute stub discarded the value it received. All now assert values.
• One branch is genuinely unreachable and is marked as such with the reason, rather than lowering the gate: every caller hands unwrapNestedCode a single already-extracted segment. The only thing that ever reached its match arm was the test that asserted the folding bug.

Documentation corrected

Three ground rules described something other than the code they govern: public/ does not ship verbatim for invite/promo (the middleware rewrites those bytes), "no external resources of any kind (…, fetch)" sat next to the API lookup that connect-src explicitly allows, and the visual matrix listed three families while VIEWS carries six across 72 views.

Verification

• npm run check (format, HTML validation, check:site, unit tests + coverage): exit 0, 153 tests, coverage thresholds met.
• npx playwright test behavior.spec.mjs --project=desktop-chromium -g "invite and promo landing": 52 passed.
• Every fix above was verified by reverting it and confirming its test turns red.
• CI at this head: Quality green (the fork gate had left the runs at action_required, so they were approved first — a green check on an older head is not evidence for this one).

Deliberately not changed — carried into the follow-up PR

• Whether _redirects and _headers apply to Function-served requests is a Cloudflare platform question that cannot be settled from this repo, and there is no preview deployment for this PR. The middleware calls context.next() rather than building its own response and copies the response headers, which argues that both still apply; production also demonstrably serves CSP and X-Frame-Options today. Worth one curl -sI https://…/invite/AB12CD after deploy.
• scripts/dev-server.mjs hardcodes the invite/promo rewrite, so the Playwright suite exercises a different routing mechanism than production.
• ?lang=en without a code yields lang="en" over German title and description.
• The iPad app-card tags are emitted but asserted nowhere; check:site checks only iphone and googleplay.
• check:site and check:visual verify string presence and aggregate counts rather than behaviour, so a transformer that is imported but never called would pass.