feat(n8n): W5 footer purchase-check webhook (公开只读) + docs

- W5 gets username ?u= → Customers→CustomerProducts → {username,known,purchases}
- 无 HMAC(密钥会下发客户端): 改用 CORS 限 drive.digikedai.com + 最小数据 + CF WAF 建议
- 复用现有 NOCODB_* env, 零新增 env
- 2 节点: webhook(GET, lastNode, CORS 头) + Code(w5-body.js)
- footer v2.6 动态行数据源; 待手动导入 n8n
- docs: N8N_WORKFLOWS + PROJECT_STATE 记录 W5 + 导入步骤

n8n/gen_w5.js

@@ -1,9 +1,9 @@
 // Builds n8n/W5-purchase-check.json — public footer purchase/expiry webhook.
-// Query: GET /dk-purchase-check?u=<username>&s=<hmac-sha256(username,dkey)>
-//   dkey = DK_HOST_KEY ($env.DK_HOST_KEY) — a per-instance shared key; the
-//   signature prevents username enumeration + forged requests from off-domain.
+// Trigger: GET /webhook/dk-purchase-check?u=<username>
 // Response (JSON, CORS: https://drive.digikedai.com):
-//   { username, known, purchases: [{product, product_id, expires_at, status, display_state}] }
+//   { username, known, purchases: [{product, expires_at, display_state}] }
+// No HMAC (key would ship client-side = theatre). Access control = CORS +
+// Cloudflare WAF rate-limit/Origin rule (documented in delivery guide).
 // Run: node n8n/gen_w5.js
 const fs = require('fs');
 const path = require('path');
@@ -17,8 +17,16 @@ const workflow = {
       parameters: {
         httpMethod: 'GET',
         path: 'dk-purchase-check',
-        responseMode: 'responseNode',
-        options: {}
+        responseMode: 'lastNode',
+        options: {
+          responseCode: 200,
+          responseHeaders: {
+            entries: [
+              { name: 'Access-Control-Allow-Origin', value: 'https://drive.digikedai.com' },
+              { name: 'Content-Type', value: 'application/json' }
+            ]
+          }
+        }
       },
       id: 'trigger-webhook',
       name: 'Footer Purchase Check (Webhook)',
@@ -27,51 +35,19 @@ const workflow = {
       position: [0, 0],
       webhookId: 'dk-purchase-check'
     },
-    {
-      parameters: {
-        jsCode: "// Extract + validate query params; verify HMAC signature.\n// u = username, s = HMAC-SHA256(username, $env.DK_HOST_KEY) hex.\nconst crypto = require('crypto');\n\nfunction sigOf(u) {\n  return crypto.createHmac('sha256', $env.DK_HOST_KEY).update(u).digest('hex');\n}\n\nconst q = $input.item.json.query ?? {};\nconst username = String(q.u || '').trim();\nconst supplied = String(q.s || '').toLowerCase();\n\n// username must be non-empty; signature must match (timing-safe-ish)\nconst expected = sigOf(username);\nconst ok = username.length > 0 && supplied.length === 64 &&\n  crypto.timingSafeEqual(Buffer.from(supplied), Buffer.from(expected));\n\nif (!ok) {\n  return { json: { status: 403, body: { error: 'forbidden', username: '' } } };\n}\n\nreturn { json: { username, _ok: true } };\n"
-      },
-      id: 'extract-validate',
-      name: 'Extract & Validate Query',
-      type: 'n8n-nodes-base.code',
-      typeVersion: 2,
-      position: [220, 0]
-    },
-    {
-      parameters: {
-        jsCode: "// load env (Code node reads $env reliably only here) and pass through\nconst prev = $input.item.json;\nreturn { json: {\n  username: prev.username,\n  NOCODB_URL: $env.NOCODB_URL,\n  NOCODB_TOKEN: $env.NOCODB_TOKEN,\n  NOCODB_TABLE_CUSTOMERS: $env.NOCODB_TABLE_CUSTOMERS,\n  NOCODB_TABLE_CUSTOMERPRODUCTS: $env.NOCODB_TABLE_CUSTOMERPRODUCTS,\n} };\n"
-      },
-      id: 'load-env',
-      name: 'Load Env',
-      type: 'n8n-nodes-base.code',
-      typeVersion: 2,
-      position: [440, 0]
-    },
     {
       parameters: { jsCode: body },
-      id: 'compute',
+      id: 'lookup',
       name: 'Lookup Purchases',
       type: 'n8n-nodes-base.code',
       typeVersion: 2,
-      position: [660, 0]
-    },
-    {
-      parameters: {
-        jsCode: "// Wrap in CORS + always-200 JSON envelope. On error return empty purchases.\nconst d = $input.item.json;\nreturn { json: {\n  body: {\n    username: d.username ?? '',\n    known: d.known ?? false,\n    purchases: d.purchases ?? [],\n  }\n} };\n"
-      },
-      id: 'respond',
-      name: 'Respond JSON',
-      type: 'n8n-nodes-base.code',
-      typeVersion: 2,
-      position: [880, 0]
+      position: [220, 0]
     }
   ],
   connections: {
-    'Footer Purchase Check (Webhook)': { main: [[{ node: 'Extract & Validate Query', type: 'main', index: 0 }]] },
-    'Extract & Validate Query': { main: [[{ node: 'Load Env', type: 'main', index: 0 }]] },
-    'Load Env': { main: [[{ node: 'Lookup Purchases', type: 'main', index: 0 }]] },
-    'Lookup Purchases': { main: [[{ node: 'Respond JSON', type: 'main', index: 0 }]] },
-    'Respond JSON': { main: [] }
+    'Footer Purchase Check (Webhook)': {
+      main: [[{ node: 'Lookup Purchases', type: 'main', index: 0 }]]
+    }
   },
   settings: { executionOrder: 'v1' },
   pinData: {}