Guard payments to allowed hosts and show checkout context

frontend/app/api/payments/intents/route.ts

@@ -3,6 +3,7 @@ import {
   applyAuthResponseCookies,
   buildBackendRequestHeaders,
 } from "@/lib/backend-auth";
+import { isPaymentHostAllowed } from "@/lib/payment-host";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
 
@@ -13,6 +14,20 @@ export async function POST(req: NextRequest) {
       { status: 500 },
     );
   }
+  const requestHost =
+    req.headers.get("x-forwarded-host") ||
+    req.headers.get("host") ||
+    req.nextUrl.hostname;
+  if (!isPaymentHostAllowed(requestHost)) {
+    return NextResponse.json(
+      {
+        error:
+          "Payments are disabled on this host. Please return to the main production site and retry.",
+        host: requestHost,
+      },
+      { status: 409 },
+    );
+  }
   try {
     const body = await req.json();
     const auth = await buildBackendRequestHeaders(req);