Make ScrollCraft fully open source: no accounts, no database, no payments - #345
Merged
Merged
Conversation
…ents ScrollCraft is now a browser tool. Pick a template, edit it, export a ZIP. There is nothing to sign up for, nothing to pay, and nothing to configure: it boots with an empty environment, verified by starting it with `env -i`. Removed: - Authentication entirely - Auth.js, both OAuth providers, the session proxy, the sign-in page and the route guards. Production held one account, the owner's own test login, so no user data was at stake. - The database - Prisma, the schema, every migration, the generated client, and the User, Site, Account, Session, Payment, ExportPurchase, TemplatePurchase, PromoCode and ContactMessage models. - All payments - Razorpay, Lemon Squeezy, subscription plans, per-site export purchases and premium template purchases, with their webhooks and clients. - Premium template gating. The eight templates that were sold individually have their withheld sections folded back into the public catalogue, so all 21 are free and complete. - The dashboard, saved-site API and hosted /s/ publishing, which all required an account to attach a site to. - Eight dependencies: next-auth, prisma, @prisma/client, @prisma/adapter-pg, @auth/prisma-adapter, pg, @types/pg and razorpay. Kept, by moving the work to the browser: - Video frame extraction. It was a server route that downloaded up to 500 MB and shelled out to ffmpeg; unauthenticated that is a way to run up someone else's bill. It now runs on the machine that already has the file, which also means the footage never leaves the device. The paste-a-URL path is gone with it: a canvas cannot read a cross-origin video. - Saving. "Save" now writes the document to IndexedDB and the editor restores it when opened cold, so work survives a reload without an account. Documents that described the old shape have been corrected rather than left to rot. The privacy policy claimed a Postgres database, OAuth sign-in and two payment processors; it now states plainly that nothing reaches the server except export requests and ordinary access logs. The cookie policy listed three session cookies that no longer exist - the app now sets none at all. The terms described non-refundable subscription fees. The contact form posted to a route that no longer exists, so it composes the message in the visitor's own mail client instead, which is honest about what it can deliver. The changelog keeps its dated history and records this as v1.0.0, rather than rewriting entries that were accurate when written.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ScrollCraft becomes a browser tool. Pick a template, edit it, export a ZIP. Nothing to sign up for, nothing to pay, nothing to configure.
Verified it boots with an empty environment — started with
env -i(no.env, no keys, no database):/,/templates,/create,/editor,/contactand/api/healthall 200, health reportsconfig: ok, no startup warnings.I checked production before deleting anything: 1 user (your own test account), 1 site, 0 published, 0 payments, 0 purchases. No user data was at stake.
Removed
User,Site,Account,Session,Payment,ExportPurchase,TemplatePurchase,PromoCodeandContactMessagemodels./s/publishing — all needed an account to attach a site to.next-auth,prisma,@prisma/client,@prisma/adapter-pg,@auth/prisma-adapter,pg,@types/pg,razorpay.Net: −30,187 lines.
Kept, by moving the work into the browser
Two features would otherwise have been collateral damage:
Documents corrected, not left to rot
These described a product that no longer exists, and two of them were legal texts making false statements:
authjs.*session cookies. The app now sets none at all..env.example,docs/DEPLOY.md,docs/WATCHDOG.md, the watchdog checks (the published-route and OAuth-provider probes are gone), and the CI/migrate workflows.The changelog keeps its dated history and records this as v1.0.0 rather than rewriting entries that were true when written.
Verified
tsc,eslint,next buildclean; suite 212 passed (down from 528 — the removed tests covered removed code).