feat: add SaaS recovery and blueprint community footers

Make Founding Customer certificates unlimited and document the production deliverables.

Author: venelouis

.github/workflows/deploy-saas-production.yml

@@ -11,6 +11,14 @@ on:
         description: 'Full Git commit SHA of the image currently accepted in SaaS staging'
         required: true
         type: string
+      password_reset_mode:
+        description: 'Enable only after the production Resend domain and protected key are ready'
+        required: true
+        default: disabled
+        type: choice
+        options:
+          - disabled
+          - resend
 
 concurrency:
   group: saas-production
@@ -42,13 +50,18 @@ jobs:
           NEXUS_USERNAME: ${{ secrets.SAAS_PRODUCTION_NEXUS_USERNAME }}
           NEXUS_PASSWORD: ${{ secrets.SAAS_PRODUCTION_NEXUS_PASSWORD }}
           STAGING_COMMIT: ${{ inputs.staging_commit }}
+          PASSWORD_RESET_MODE: ${{ inputs.password_reset_mode }}
+          RESEND_API_KEY: ${{ secrets.SAAS_PRODUCTION_RESEND_API_KEY }}
         run: |
           [[ "$STAGING_COMMIT" =~ ^[0-9a-f]{40}$ ]]
           test "${DATABASE_URL#postgres}" != "$DATABASE_URL"
           test "${DATABASE_URL#*sslmode=require}" != "$DATABASE_URL"
           test "${#APP_KEY}" -ge 32
           test -n "$NEXUS_USERNAME"
           test "${#NEXUS_PASSWORD}" -ge 16
+          if [ "$PASSWORD_RESET_MODE" = 'resend' ]; then
+            test "${RESEND_API_KEY#re_}" != "$RESEND_API_KEY"
+          fi
 
       - name: Log in to Azure with a short-lived production OIDC token
         uses: azure/login@v3
@@ -116,6 +129,9 @@ jobs:
               DEPLOYMENT_TIER=production \
               NEXUS_TRUSTED_TLS_TERMINATION=azure-container-apps \
               MIGRATE_ON_STARTUP=true \
+              PASSWORD_RESET_MODE=disabled \
+              ACCOUNT_PUBLIC_BASE_URL=https://saas.rullst.win \
+              ACCOUNT_MAIL_FROM=security@mail.rullst.win \
               PAYMENTS_MODE=disabled \
               BILLING_PROVIDER=stripe \
               BILLING_EXPECTED_CURRENCY=BRL \
@@ -132,6 +148,21 @@ jobs:
             --transport auto \
             --only-show-errors --output none
 
+      - name: Enable production password recovery
+        if: ${{ inputs.password_reset_mode == 'resend' }}
+        shell: bash
+        env:
+          RESEND_API_KEY: ${{ secrets.SAAS_PRODUCTION_RESEND_API_KEY }}
+        run: |
+          az containerapp secret set --name "$PRODUCTION_CONTAINER_APP" --resource-group "$RESOURCE_GROUP" \
+            --secrets resend-api-key="$RESEND_API_KEY" \
+            --only-show-errors --output none
+          az containerapp update --name "$PRODUCTION_CONTAINER_APP" --resource-group "$RESOURCE_GROUP" \
+            --set-env-vars \
+              PASSWORD_RESET_MODE=resend \
+              RESEND_API_KEY=secretref:resend-api-key \
+            --only-show-errors --output none
+
       - name: Verify the immutable revision and production database
         shell: bash
         env:

.github/workflows/deploy-saas-staging.yml

@@ -20,6 +20,14 @@ on:
         options:
           - disabled
           - test
+      password_reset_mode:
+        description: 'Enable only after the staging Resend domain and protected key are ready'
+        required: true
+        default: disabled
+        type: choice
+        options:
+          - disabled
+          - resend
 
 concurrency:
   group: saas-staging
@@ -103,13 +111,18 @@ jobs:
           NEXUS_PASSWORD: ${{ secrets.SAAS_STAGING_NEXUS_PASSWORD }}
           STRIPE_KEY: ${{ secrets.STRIPE_TEST_SECRET_KEY }}
           STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_TEST_WEBHOOK_SECRET }}
+          PASSWORD_RESET_MODE: ${{ inputs.password_reset_mode }}
+          RESEND_API_KEY: ${{ secrets.SAAS_STAGING_RESEND_API_KEY }}
         run: |
           test "${DATABASE_URL#postgres}" != "$DATABASE_URL"
           test "${#APP_KEY}" -ge 32
           test -n "$NEXUS_USERNAME"
           test "${#NEXUS_PASSWORD}" -ge 16
           test "${STRIPE_KEY#sk_test_}" != "$STRIPE_KEY"
           test "${STRIPE_WEBHOOK_SECRET#whsec_}" != "$STRIPE_WEBHOOK_SECRET"
+          if [ "$PASSWORD_RESET_MODE" = 'resend' ]; then
+            test "${RESEND_API_KEY#re_}" != "$RESEND_API_KEY"
+          fi
 
       - name: Log in to Azure with a short-lived GitHub OIDC token
         uses: azure/login@v3
@@ -156,6 +169,9 @@ jobs:
               DEPLOYMENT_TIER=staging \
               NEXUS_TRUSTED_TLS_TERMINATION=azure-container-apps \
               MIGRATE_ON_STARTUP=true \
+              PASSWORD_RESET_MODE=disabled \
+              ACCOUNT_PUBLIC_BASE_URL=https://saas-staging.rullst.win \
+              ACCOUNT_MAIL_FROM=security@staging-mail.rullst.win \
               PAYMENTS_MODE="$PAYMENTS_MODE" \
               BILLING_PROVIDER=stripe \
               BILLING_PRICE_ID="$STRIPE_TEST_PRICE_ID" \
@@ -170,6 +186,21 @@ jobs:
               STRIPE_WEBHOOK_SECRET=secretref:stripe-test-webhook-secret \
             --only-show-errors --output none
 
+      - name: Enable staging password recovery
+        if: ${{ inputs.password_reset_mode == 'resend' }}
+        shell: bash
+        env:
+          RESEND_API_KEY: ${{ secrets.SAAS_STAGING_RESEND_API_KEY }}
+        run: |
+          az containerapp secret set --name "$CONTAINER_APP" --resource-group "$RESOURCE_GROUP" \
+            --secrets resend-api-key="$RESEND_API_KEY" \
+            --only-show-errors --output none
+          az containerapp update --name "$CONTAINER_APP" --resource-group "$RESOURCE_GROUP" \
+            --set-env-vars \
+              PASSWORD_RESET_MODE=resend \
+              RESEND_API_KEY=secretref:resend-api-key \
+            --only-show-errors --output none
+
       - name: Verify immutable revision and database readiness
         shell: bash
         env:

.github/workflows/enable-saas-live.yml

@@ -173,7 +173,6 @@ jobs:
               MERCHANT_COUNTRY=BR \
               SUPPORT_EMAIL=officialrullst@gmail.com \
               REFUND_WINDOW_DAYS=14 \
-              FOUNDING_CUSTOMER_LIMIT=100 \
             --only-show-errors --output none
 
       - name: Verify live revision health without creating a payment

README.md

@@ -29,10 +29,14 @@ example is also governed by the engineering
 
 Welcome to the official showcase and blueprints repository for the **Rullst Framework (`12.0.0`)**. This repository demonstrates how to architect, build, and deploy production-grade, sovereign web applications in pure Rust without JavaScript framework lock-in.
 
-This monorepository contains three live cloud applications:
+This monorepository contains four live cloud applications, with the SaaS
+blueprint deliberately split into staging and production deployments:
 1. **🌐 Rullst Showcase App:** Demonstrates the **5 Frontend Paradigms**, Active Record ORM, WAF security layers, Prompt Injection Shield, and Omni cross-platform capabilities.
 2. **🎓 Rullst Academy (LMS Blueprint):** A full-featured, real-world educational platform with 13 SQLite migrations, course catalog, Argon2 authentication, monotonic lesson progress tracking, quizzes, certifications, and integrated **Nexus Admin CMS** + **Studio Dev Cockpit**.
 3. **💼 Rullst Portfolio Blueprint:** An ultra-fast, modern developer portfolio featuring dark glassmorphic UI, HTMX SSR, project showcase, experience timeline, skills matrix, and **Nexus Admin CMS**.
+4. **Rullst SaaS Blueprint:** An audited one-time Stripe checkout with separate
+   sandbox and live databases, provider objects, secrets, entitlements,
+   downloadable artifacts, certificates, refunds and reconciliation.
 
 ---
 
@@ -53,6 +57,8 @@ All applications run in **Microsoft Azure Container Apps** on the **Azure for St
 | **🌐 Rullst Showcase** | [showcase.rullst.win](https://showcase.rullst.win) | 5 Web Paradigms, WAF Defense, LiveView, Active Record, Groq AI Copilot | 🛡️ **Nexus Admin:** [/nexus](https://rullst-showcase.redpond-24d9228d.eastus.azurecontainerapps.io/nexus)<br>🚀 **Studio:** [/studio](https://rullst-showcase.redpond-24d9228d.eastus.azurecontainerapps.io/studio)<br>**Public demo login:** `rullst_demo`<br>**Password:** `RullstDemoAccess2026!`<br>🤖 **Groq AI:** GPT-OSS 120B & Prompt Shield<br>📖 [Showcase Guide](docs/showcase-nexus-studio-ai-guide.md) |
 | **🎓 LMS Academy** | [lms.rullst.win](https://lms.rullst.win) | Courses, Real Argon2 Auth, Lesson Player, Quizzes, Certificates | 🛡️ **Nexus Admin:** [/nexus](https://rullst-lms.redpond-24d9228d.eastus.azurecontainerapps.io/nexus)<br>🚀 **Studio:** [/studio](https://rullst-lms.redpond-24d9228d.eastus.azurecontainerapps.io/studio)<br>*(Protected by HTTP Basic Auth configured via container environment variables)* |
 | **💼 Portfolio** | [portfolio.rullst.win](https://rullst-portfolio.redpond-24d9228d.eastus.azurecontainerapps.io/) | Dark Glassmorphic UI, HTMX SSR, Project Showcase, Experience Timeline | 🛡️ **Nexus Admin:** [/nexus](https://rullst-portfolio.redpond-24d9228d.eastus.azurecontainerapps.io/nexus)<br>🚀 **Studio:** [/studio](https://rullst-portfolio.redpond-24d9228d.eastus.azurecontainerapps.io/studio)<br>**Public demo login:** `rullst_demo`<br>**Password:** `RullstDemoAccess2026!`<br>📖 [Portfolio Guide](docs/BLUEPRINT_PORTFOLIO.md) |
+| **SaaS Staging** | [saas-staging.rullst.win](https://saas-staging.rullst.win) | Permanent Stripe sandbox, test report and Sandbox Pioneer certificate; no real charge | Private Nexus credentials; no production Studio process |
+| **SaaS Production** | [saas.rullst.win](https://saas.rullst.win) | Real one-time Stripe checkout, private guide, unlimited Founding Customer certificates, refunds and reconciliation | Private Nexus credentials; no production Studio process |
 
 ---
 
@@ -113,6 +119,13 @@ deployments also use separate persistent PostgreSQL databases, webhook secrets,
 Price IDs, application keys and private administration credentials. No private
 credential is included in this repository.
 
+The sandbox flow grants a downloadable test report and a clearly test-only
+`Rullst Sandbox Pioneer` certificate. Every reconciled production purchase
+grants the private Stripe implementation guide and a `Rullst Founding Customer`
+certificate; the certificate has no quantity limit.
+Refunds and disputes revoke the corresponding access after provider
+confirmation.
+
 See the [SaaS blueprint guide](blueprints/saas/README.md) for setup and the
 [framework improvement report](saas-improvements-needed.md) for the full
 provider-by-provider and Rullst Mail account-lifecycle audit.

blueprints/lms/src/migrations/mod.rs

@@ -3024,7 +3024,11 @@ mod tests {
         assert!(rendered_catalog.contains("nonce=\"catalog-csp-nonce\""));
         assert!(rendered_catalog.contains("<script>"));
         assert!(!rendered_catalog.contains("<script>alert(1)</script>"));
-        assert!(!rendered_catalog.contains("https://"));
+        assert!(!rendered_catalog.contains("src=\"https://"));
+        assert!(!rendered_catalog.contains("rel=\"stylesheet\" href=\"https://"));
+        assert!(rendered_catalog.contains(
+            "href=\"https://discord.gg/2ntKFtsSjw\" target=\"_blank\" rel=\"noopener noreferrer\""
+        ));
 
         let rendered_video = crate::pages::lms::lesson_player_page(
             "Memory safety <essentials>",

blueprints/lms/src/pages/lms.rs

@@ -4,6 +4,20 @@ use crate::models::category::Category;
 use crate::models::course::Course;
 use crate::models::lesson::Lesson;
 
+fn render_community_footer() -> String {
+    html! {
+        <footer class="community-footer">
+            <div class="community-footer-mark" aria-hidden="true">"R"</div>
+            <div class="community-footer-copy">
+                <p class="community-footer-eyebrow">"Learn, build, contribute"</p>
+                <h2>"Join our community on Discord"</h2>
+                <p>"Meet Rullst builders, share what you are learning, and help shape the framework."</p>
+            </div>
+            <a href="https://discord.gg/2ntKFtsSjw" target="_blank" rel="noopener noreferrer">"Join the Rullst Discord"</a>
+        </footer>
+    }
+}
+
 pub fn index_page(
     categories: Vec<Category>,
     courses: Vec<Course>,
@@ -102,7 +116,15 @@ pub fn index_page(
                     .card h2 { margin: 0 0 .75rem; font-size: 1.35rem; }
                     .card p { flex: 1; margin: 0 0 1.25rem; color: #cbd5e1; line-height: 1.6; }
                     .empty { grid-column: 1 / -1; border: 1px dashed #64748b; border-radius: 1rem; padding: 2rem; text-align: center; }
-                    @media (max-width: 48rem) { header { flex-direction: column; } .search { grid-template-columns: 1fr; } }
+                    .community-footer { display: grid; grid-template-columns: auto minmax(0, 1fr) auto; align-items: center; gap: 1.25rem; max-width: 70rem; margin: 3rem auto 0; padding: 1.35rem 1.5rem; border: 1px solid rgba(88, 101, 242, .5); border-radius: 1.25rem; background: linear-gradient(135deg, rgba(88, 101, 242, .2), rgba(15, 23, 42, .96) 58%, rgba(52, 211, 153, .13)); box-shadow: 0 18px 50px rgba(0, 0, 0, .28); }
+                    .community-footer-mark { display: grid; width: 3.25rem; height: 3.25rem; place-items: center; border-radius: 1rem; background: linear-gradient(145deg, #5865f2, #34d399); color: #fff; font-size: 1.4rem; font-weight: 900; box-shadow: 0 10px 28px rgba(88, 101, 242, .35); }
+                    .community-footer h2, .community-footer p { margin: 0; }
+                    .community-footer h2 { margin: .1rem 0 .25rem; font-size: clamp(1.2rem, 3vw, 1.55rem); }
+                    .community-footer-copy > p:not(.community-footer-eyebrow) { color: #cbd5e1; line-height: 1.55; }
+                    .community-footer-eyebrow { color: #a5b4fc; font-size: .75rem; font-weight: 800; letter-spacing: .12em; text-transform: uppercase; }
+                    .community-footer a { padding: .8rem 1rem; border: 1px solid rgba(255, 255, 255, .16); border-radius: .8rem; background: #5865f2; color: #fff; font-weight: 800; text-align: center; text-decoration: none; transition: transform 160ms ease, background 160ms ease; }
+                    .community-footer a:hover { background: #4752c4; transform: translateY(-2px); }
+                    @media (max-width: 48rem) { header { flex-direction: column; } .search { grid-template-columns: 1fr; } .community-footer { grid-template-columns: auto minmax(0, 1fr); padding: 1.15rem; } .community-footer a { grid-column: 1 / -1; width: 100%; } }
                     @media (prefers-reduced-motion: reduce) { * { scroll-behavior: auto !important; } }
                     "
                 </style>
@@ -143,6 +165,7 @@ pub fn index_page(
                         </div>
                     </main>
                 </div>
+                {rullst::html::RawHtml(render_community_footer())}
                 {rullst::html::RawHtml(render_lms_ai_widget(csrf_token))}
                 <script nonce={csp_nonce}>
                     "if ('serviceWorker' in navigator) { window.addEventListener('load', () => navigator.serviceWorker.register('/sw.js').catch(console.error)); }"
@@ -918,3 +941,15 @@ fn render_lms_ai_widget(csrf_token: &str) -> String {
     "##.replace("__CSRF_TOKEN__", &rullst::html::escape_str(csrf_token))
 }
 
+#[cfg(test)]
+mod community_footer_tests {
+    use super::render_community_footer;
+
+    #[test]
+    fn footer_links_to_discord_safely() {
+        let footer = render_community_footer();
+        assert!(footer.contains("Join our community on Discord"));
+        assert!(footer.contains("https://discord.gg/2ntKFtsSjw"));
+        assert!(footer.contains("rel=\"noopener noreferrer\""));
+    }
+}

blueprints/portfolio/src/pages/home.rs

@@ -552,7 +552,31 @@ fn cv_styles() -> String {
         40% { transform: scale(1.1); opacity: 1; }
     }
 
+    .community-footer {
+        display: grid;
+        grid-template-columns: auto minmax(0, 1fr) auto;
+        align-items: center;
+        gap: 1.25rem;
+        width: min(calc(100% - 2rem), 1350px);
+        margin: 0 auto 2.5rem;
+        padding: 1.35rem 1.5rem;
+        border: 1px solid rgba(88, 101, 242, 0.48);
+        border-radius: 20px;
+        background: linear-gradient(135deg, rgba(88, 101, 242, 0.18), rgba(15, 15, 20, 0.94) 58%, rgba(0, 255, 204, 0.1));
+        box-shadow: 0 18px 50px rgba(0, 0, 0, 0.3);
+    }
+    .community-footer-mark { display: grid; width: 52px; height: 52px; place-items: center; border-radius: 16px; background: linear-gradient(145deg, #5865f2, #00bfa5); color: #fff; font-size: 1.4rem; font-weight: 900; box-shadow: 0 10px 28px rgba(88, 101, 242, .35); }
+    .community-footer h2, .community-footer p { margin: 0; }
+    .community-footer h2 { margin: 2px 0 4px; font-size: clamp(1.2rem, 3vw, 1.55rem); }
+    .community-footer-copy > p:not(.community-footer-eyebrow) { color: var(--text-muted); }
+    .community-footer-eyebrow { color: #a5b4fc; font-size: .75rem; font-weight: 800; letter-spacing: .12em; text-transform: uppercase; }
+    .community-footer a { padding: .8rem 1rem; border: 1px solid rgba(255, 255, 255, .16); border-radius: 12px; background: #5865f2; color: #fff; font-weight: 800; text-align: center; text-decoration: none; transition: transform 160ms ease, background 160ms ease; }
+    .community-footer a:hover { background: #4752c4; transform: translateY(-2px); }
+    .community-footer a:focus-visible { outline: 3px solid var(--accent); outline-offset: 3px; }
+
     @media (max-width: 640px) {
+        .community-footer { grid-template-columns: auto minmax(0, 1fr); padding: 1.15rem; }
+        .community-footer a { grid-column: 1 / -1; width: 100%; }
         .ai-crab-launcher {
             bottom: max(16px, env(safe-area-inset-bottom));
             right: max(16px, env(safe-area-inset-right));
@@ -695,6 +719,20 @@ fn render_content(projects: &[Project], experiences: &[Experience]) -> String {
     }
 }
 
+fn render_community_footer() -> String {
+    html! {
+        <footer class="community-footer">
+            <div class="community-footer-mark" aria-hidden="true">"R"</div>
+            <div class="community-footer-copy">
+                <p class="community-footer-eyebrow">"Connect with the builders"</p>
+                <h2>"Join our community on Discord"</h2>
+                <p>"Share projects, discuss Rust architecture, and help shape the Rullst ecosystem."</p>
+            </div>
+            <a href="https://discord.gg/2ntKFtsSjw" target="_blank" rel="noopener noreferrer">"Join the Rullst Discord"</a>
+        </footer>
+    }
+}
+
 fn render_ai_widget(csrf_token: &str) -> String {
     r##"
     <div id="ai-crab-launcher" class="ai-crab-launcher" onclick="toggleAiDrawer()" role="button" tabindex="0" aria-label="Ask me anything!">
@@ -899,8 +937,22 @@ pub fn render(
                     { rullst::html::RawHtml(render_content(projects, experiences)) }
                 </div>
 
+                { rullst::html::RawHtml(render_community_footer()) }
                 { rullst::html::RawHtml(render_ai_widget(csrf_token)) }
             </body>
         </html>
     }
 }
+
+#[cfg(test)]
+mod community_footer_tests {
+    use super::render_community_footer;
+
+    #[test]
+    fn footer_links_to_discord_safely() {
+        let footer = render_community_footer();
+        assert!(footer.contains("Join our community on Discord"));
+        assert!(footer.contains("https://discord.gg/2ntKFtsSjw"));
+        assert!(footer.contains("rel=\"noopener noreferrer\""));
+    }
+}

blueprints/saas/.env.example

@@ -11,6 +11,15 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/rullst_saas
 NEXUS_ADMIN_USERNAME=
 NEXUS_ADMIN_PASSWORD=
 
+# Password recovery is fail-closed until a transactional provider is configured.
+# Verify the sending domain with Resend, create a sending-only/domain-scoped API
+# key, and use the exact public origin for this deployment. Never share a key
+# between staging and production.
+PASSWORD_RESET_MODE=disabled
+ACCOUNT_PUBLIC_BASE_URL=http://localhost:3000
+ACCOUNT_MAIL_FROM=
+RESEND_API_KEY=
+
 # Billing mode: disabled, test or live. Keep disabled until the matching
 # environment-specific acceptance gate documented in README.md is complete.
 PAYMENTS_MODE=disabled
@@ -38,7 +47,6 @@ PAID_ARTIFACT_URL=
 PAID_ARTIFACT_STORAGE_ACCOUNT=
 PAID_ARTIFACT_SHA256=
 PAID_ARTIFACT_FILENAME=rullst-stripe-production-guide-v1.md
-FOUNDING_CUSTOMER_LIMIT=100
 
 # Public merchant and refund notice fields required by live mode. Store their
 # values only in the deployment secret manager, never in this file or Git.