# Morele Upstream Inventory

> Verified from `src/inject.ts`, safe HTTP probes, and mirror implementation (2026-06).
> Live thank-you HTML should still be confirmed in browser DevTools after a real paid order.

## Known hosts

| Role | Host | Local prefix |
|------|------|--------------|
| Main site (HTML / SSR) | `www.morele.net` | `/` (root) |
| Static assets / JS / CSS | `b.morele.net` | `/_a/b` |
| Product / promo / news images | `images.morele.net` | `/_a/image` |
| Secure pages (account/checkout) | `secure.morele.net` | `/_a/secure` |
| Tracking / analytics | `an1.morele.net` | `/_a/an1` |
| Live chat / WebSocket | `live.morele.net` | `/_a/live` |

## Checkout flow (native mirror)

| Step | URL | Notes |
|------|-----|-------|
| Cart page | `GET /koszyk/` | HTML + XHR JSON (`products`, `value`, …) |
| Checkout (verified upstream) | `GET /dostawa-i-platnosc/` | Main order form on morele.net (302 → login when guest) |
| Legacy / wrong on upstream | `GET /zamowienie/`, `/podsumowanie/`, `/koszyk/platnosc/` | Return 404 on morele.net — mirror redirects `/zamowienie` → `/dostawa-i-platnosc/` |
| Submit (candidates) | `POST /api/basket/checkout/`, `POST /api/basket/checkoutproduct*`, `POST /zamowienie/submit/`, `POST /api/checkout/submit/` | Intercepted in inject when fallback; proxied when native |
| Thank you (candidate) | `GET /zamowienie/potwierdzenie/` | Default `MORELE_THANK_YOU_PATH`; confirm in DevTools |
| Fallback local checkout (mirror-only) | `GET /__mirror/checkout-fallback/` | `MORELE_USE_NATIVE_CHECKOUT=false` or `?mirror_checkout=fallback` — **not** `/dostawa-i-platnosc/` |

## Cart / basket API

| Action | URL | Status |
|--------|-----|--------|
| Get cart JSON | `GET /koszyk/` | Verified (XHR) |
| Basket API prefix | `/api/basket/*` | Proxied via `moreleApiProxy` |
| Checkout API prefix | `/api/checkout/*` | Proxied |
| User API | `/api/user/*`, `/api/cart/*` | Proxied |

## Auth

| Action | URL |
|--------|-----|
| Login page | `GET /login/`, `/logowanie/` |
| Register | `GET /register/`, `/rejestracja/` |
| OAuth | `GET /connect/google`, `/connect/facebook`, `/connect/apple` |
| Login POST | `POST /login`, `/logowanie` (pass-through, never logged) |

## PSP hosts (blocked on mirror)

Rewrite / bridge blocks navigation and JSON redirects to:

- `payu.com`, `secure.payu.com`, `go.payu.com`
- `przelewy24.pl`, `secure.przelewy24.pl`
- `paypo.pl`, `papay.pl`
- `felopay.com` (optional live redirect when `CHECKOUT_PAY_ENABLED=true`)

Mirror payment API: `POST/GET /api/checkout/order/*` (same contract as Sinsay `app/docs/checkout-api.md`).

## Cookies

- `PHPSESSID` / session cookies — forwarded on API proxy (`preserveClientCookies`)
- `m_user`, `m_uid` — logged-in probe for `GET /api/checkout/session`
- Mirror `sid` — local order/payment state (not sent upstream)

## Mirror env

| Variable | Default | Purpose |
|----------|---------|---------|
| `MORELE_USE_NATIVE_CHECKOUT` | `true` | Proxied `/zamowienie/` checkout; no Felopay hijack |
| `CHECKOUT_PAY_ENABLED` | `false` | Felopay redirect from `/api/checkout/order/payment/*` |
| `MORELE_THANK_YOU_PATH` | `/zamowienie/potwierdzenie/` | Thank-you + JSON redirect rewrite target |

## Checkout strategies

**Native (default):** proxied upstream checkout UI; PSP URLs replaced in JSON + `checkoutPaymentBridge`; pay via `/api/checkout/order/*`.

**Fallback:** inject hijacks “Zamów i zapłać” → `/dostawa-i-platnosc/` → Felopay `/checkout/redirect` (legacy).

## Not proxied / not stored

- Login/register bodies (sensitive paths)
- Upstream passwords or card data (card capture only in Redis when using mirror API)