Repository navigation
Production release: free-only MVP - #17
Open
Satelink-Protocol wants to merge 76 commits into
Open
Satelink-Protocol wants to merge 76 commits into
Satelink-Protocol wants to merge 76 commits into
Conversation
They pass alone in ~28s but exceeded the 30s default in a full run. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- migration 010: events.superprofile_url/product_id/checkout_mode, checkout_intents, external_orders, bookings.source, users.email_hash/claim_prompt_until - single PaymentProvider superprofile_link (createCheckout = URL with ref, verifyWebhook = constant-time shared secret, refund = NOT_SUPPORTED_IN_APP); https + superprofile.bio allowlist - GET /checkout/:slug records an intent and redirects (works signed out); web-only, hidden in the Mini App - /api/webhooks/superprofile: purchase/refund/cancelled orders, idempotent on order_id, fail-closed amount check, unmatched/flagged orders alert admins, refund-after-check-in keeps the record - Telegram claim flow (/claim, /start claim): one claim per order, 5/hour, generic errors - admin: Orders tab (finance links, support views, keyset pagination), SuperProfile fields on events - remove the old ticket checkout/hold/reconcile paths and the provider webhook route Adapter files, docs and env example are cleaned in the next commit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nd docs Removes lib/payments/razorpay.js and cashfree.js, PAYMENT_PROVIDER / RAZORPAY_* / CASHFREE_* / TICKET_CHECKOUT_ENABLED from .env.example, and rewrites PAYMENTS_DECISION, GO_LIVE, RUNBOOK and the other docs for SuperProfile as the only checkout. A grep test keeps them out. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- .github/workflows/ci.yml (Node 24, postgres:16, lint, unit, Playwright e2e) - POST /api/reconcile/superprofile + diffOrders for the daily Claude Code task - e2e for Book Tickets link, redirect, Mini App hiding, 320/375; local seed events - docs/SUPERPROFILE_OPS.md; purchases without a product are stored, not rejected - review fixes: bad-secret rate limit, lower(order_id) index, SuperProfile revenue in insights Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…I-only null boundingBox) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SuperProfile as the only ticket checkout (P1) + CI + reconciliation
…, de-flake wizard e2e; preview audit - feeds: undici Agent with a validating connect.lookup so a rebound DNS answer can never be the address we connect to; isPrivateIp on net.BlockList incl. NAT64/6to4/Teredo/doc/site-local ranges - session: refuse (503) before inserting a user_sessions row when SESSION_SECRET is missing - checkout: a started multi-day event can no longer be bought via /checkout/:slug (same rule as free tiers) - e2e: poll wizard control measurements across autosave re-renders (fixes launch-mvp CI run 40938995707) - engines.node pinned to 24.x; undici 7.30.1 (exact) - docs/PREVIEW_RECOVERY_AUDIT.md: git/Vercel/Neon findings, test evidence, PASS/FAIL/BLOCKED matrix Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… for this branch; zod v4 plan - createFeedDispatcher(lookup) so a test can pin to a local HTTPS server: right hostname 200, wrong hostname ERR_TLS_CERT_ALTNAME_INVALID, untrusted issuer refused - safeFetch: https->http redirect refused before the http request; loops capped at 4 - vercel.json: git.deploymentEnabled false for fix/preview-recovery-audit only, so pushing runs CI without building a Preview on the shared Production DB - audit doc: follow-up verification, zod 4 trial and migration plan Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tion gate, telegram silencing & audit update
…logging, and Vercel preview protection
Fix PR #9 CI, MCP security and deployment blockers
Prepare StrangersMeetup website and MCP for cloud deployment
fix(deploy): align Render Docker runtime, Playwright base image, and .dockerignore
…igation, and empty states
feat(ux): enhance event discovery search, card ergonomics, mobile navigation, and empty states
… venue presentation, instant discovery, and preview reviewer testing
…wer rate limiting
feat(attendee): synthetic preview seeding, free booking flow, mystery venue presentation, and instant discovery
feat(organiser): Polish organiser onboarding, event wizard and dashboard
… safety email fallback
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
docs(launch): P0 ground truth
feat(brand): customer-facing rebrand from StrangersMeetup to NIGHTLIFEZ
…ermission gate (P2) Migration 012 adds user_identities, organisations, capabilities, org_memberships, user_capabilities, venues and event_team, with an idempotent backfill: one telegram identity per user, a personal org + owner membership + organise_events capability for every existing organiser, and events.organiser_org_id. lib/services/permissions.js: can(user, action, scope) / authorize() is the single gate for organiser, org and venue routes. Outsiders get 404, members with too low a role 403. manageableEvent, guest lists, approvals and the organiser event list now go through it; behaviour for existing personal organisers and event admins is unchanged. New routes: /api/me/orgs, /api/orgs/:id[/members|/venues], /api/venues/:id and /api/admin/orgs (super_admin). zod-validated, CSRF + rate limit on writes, audited, paginated. Local personas gain a team org (owner/manager/staff), a venue org, a DJ and a finance admin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(orgs): identities, organisations, scoped memberships and can() (P2)
The wizard re-renders its step when a debounced autosave returns, so boundingBox() can return null between 'visible' and 'measured'. The desktop test already polled; the mobile loops did not, and failed once on launch-mvp (run 41394847468, @430). Expected sizes are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
test(e2e): poll every wizard tap-target measurement
…atial discovery & permission fix
…archive Add docs/PROJECT_STATE.md as the single source of truth: branch model, current refs, open PRs with CI, migrations per environment (from Vercel build logs), live vs Preview-only, worktrees, owner gates, branch classification and a deletion proposal (nothing deleted). Move the 13 phase-* reports from docs/launch/ to docs/history/ (git mv) with a README index, and copy in the two docs-only Phase 5.4/5.5 reports from fix/preview-recovery-audit byte-for-byte (blobs 05d545c, 9cb973f). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
docs(state): M1 repository truth — PROJECT_STATE.md and history archive
…limiting, bbox index & privacy bands - H-01: Auto-resolve canonical cities, localities, and coordinates across publishDraft, admin create/update, and feed approval; add migration 014 with coords_provenance and DB trigger dual guard. - H-02: Implement secure rate limiting (60 req/min), trusted proxy IP evaluation, category validation, and CDN caching on GET /api/events/nearby. - M-01: Add bounding-box pre-filtering in findNearbyEvents with pole & antimeridian wrap safety, achieving 7.9x query speedup with active idx_events_coords index scan. - M-02 & L-01: Protect mystery venue privacy by suppressing raw distanceKm, providing coarse distance bands, and suppressing exact coordinates when coords_provenance !== 'venue'. - L-02: Document official LGD data provenance, alias dictionary, unsupported city policy, and expansion roadmap in docs/GEOGRAPHIC_COVERAGE.md; update docs/PROJECT_STATE.md.
feat(location): P3 Location Intelligence V1 — Official LGD Foundation & Discovery
…nch archiving, Phase 5.6/5.7 reports
ops: owner addendum — dynamic prod DB block list, branch archiving, Phase 5.6/5.7 reports
feat(deploy): M3 Deployment & Database Migration Architecture
feat(payments): M4 payment, booking and revenue readiness audit
…rified payments - Add additive migration 015_upi_payment_integration.sql extending payment types and introducing immutable payment_audits ledger - Implement zero-dependency pure SVG QR code generator (Model 2, Reed-Solomon EC) in lib/upi/qr.js - Implement provider-neutral payment adapter interface with PhonePe PG primary and MockUpi sandbox adapter in lib/upi/adapter.js - Support mobile generic upi://pay intent and deep links for Google Pay, PhonePe, Paytm, CRED, and BHIM - Support desktop scannable dynamic QR with live 15m countdown timer and 3.5s status polling - Implement strict deterministic payment state machine with atomic booking confirmation in lib/services/upi-payments.js - Add constant-time SHA256 webhook signature verification with replay protection and idempotency - Maintain strict safety boundary: ENABLE_LIVE_PAYMENTS=false across all environments - Add comprehensive test suite in test/upi-checkout.test.js (13/13 passing) - Author docs/arch/UPI_PAYMENT_INTEGRATION.md and docs/launch/UPI_READINESS_REPORT.md
feat(payments): M4.1 UPI-first checkout, dynamic QR, and verified payments
…sment for M4.1 UPI integration - Author docs/UPI_SECURITY_AUDIT.md detailing 2 Critical, 3 High, 2 Medium, and 2 Low findings: * SEC-01 (Critical): Real PhonePe webhook signature calculation mismatch (hashes raw body instead of Base64 response) * FIN-01 (Critical): Missing amount verification on webhook ingestion (underpayment vulnerability) * DATA-01 (High): Unauthenticated guest checkout crashes on webhook (NOT NULL bookings.user_id constraint) * CONCUR-01 (High): Simultaneous checkout intent capacity bypass (overbooking risk) * AUTH-01 (High): Unauthenticated information disclosure & polling IDOR on /api/checkout/upi/status/:id * QR-01 (Medium): QR generator overwrites ISO 18004 Dark Module and drops Version 8 codewords * UI-01 (Medium): Missing viewport CSS isolation renders mobile buttons and desktop QR simultaneously - Author docs/UPI_PROVIDER_READINESS.md classifying PhonePe PG as mock/uninitiated, PayU as not implemented, and issuing readiness verdict of NOT READY FOR LIVE PAYMENTS - Update docs/PROJECT_STATE.md with M4.2 milestone tracking and document links - Maintain strict safety boundary: ENABLE_LIVE_PAYMENTS=false
docs(audit): M4.2 independent UPI payment security and production readiness audit
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production Release: Free-Only MVP
This PR releases the completed Free-Only MVP marketplace journey to Production.
1. Migrations to Execute on Empty Production DB
During the Vercel production build,
scripts/migrate.jswill execute migrations 003–011 under advisory lockpg_advisory_xact_lock(hashtext('sm_migrations')):003_identity_events_bookings.sql: Users (Telegram identity, 21+ flag), events, ticket tiers, bookings, and media.004_payments_entitlements_admin.sql: Payments, entitlements, admin users, audit logging.005_audit_and_indexes.sql: Performance indexes and operational audit logs.006_stars_and_reconciliation.sql: Telegram Stars and financial reconciliation schema.007_user_personas.sql: User status and persona tracking.008_admin_superprofile_orders.sql: SuperProfile orders tracking and admin audit.009_guest_ticketing_and_mystery_venues.sql: Guest ticketing, tier capacity, mystery venue redaction.010_host_applications.sql: Host onboarding applications and approval queue.011_trust_safety_remediation.sql: Website safety reporting (reports), attendee mutual blocking (user_blocks), moderation lifecycle.2. Environment Variables Required for Production
The following environment variables must be configured in Vercel Production before merging:
DATABASE_URL: Production connection pooler string (Configured)DATABASE_URL_UNPOOLED: Production direct unpooled string (Configured)TELEGRAM_BOT_TOKEN: Canonical bot token for HMAC login verification (Configured)SESSION_SECRET: High-entropy string (≥ 32 bytes) for HMAC session cookie signingCRON_SECRET: High-entropy token (≥ 16 bytes) for authenticated Vercel cron jobsADMIN_BOOTSTRAP_TELEGRAM_ID: Owner's Telegram numeric User ID for initial super-admin accessPUBLIC_SITE_URL: Canonical site URL (https://strangersmeetup-virid.vercel.app)LEGAL_ENTITY_NAME: Registered business entity name (Consumer Protection Rules 2020)GRIEVANCE_OFFICER_NAME: Appointed Grievance Redressal Officer (IT Rules 2021)GRIEVANCE_EMAIL: Official grievance officer contact email3. Rollback Plan
5c6652aproduction deployment.