Production release: free-only MVP

.dockerignore

@@ -0,0 +1,38 @@
+# Dependencies
+node_modules/
+
+# Version control and agent configuration
+.git/
+.github/
+.claude/
+.agents/
+.remember/
+.playwright-mcp/
+skills-lock.json
+
+# Environment and secrets
+.env
+.env*
+.env.local
+
+# Vercel deployment cache
+.vercel/
+
+# Local MCP runtime state, screenshots and audit logs
+.mcp/
+
+# Test output and reports
+test-results/
+playwright-report/
+coverage/
+*.log
+
+# Operating system and temporary artifacts
+.DS_Store
+Thumbs.db
+*.db
+*.sqlite
+data/
+public/img/review/
+research_notes/
+reports/

.env.example

@@ -23,19 +23,13 @@ TG_CHAT_ID_TIER_2=
 TG_CHAT_ID_TIER_3=
 TG_CHAT_ID_EVENTS=
 
-# Payments (tickets)
-PAYMENT_PROVIDER=razorpay
-RAZORPAY_KEY_ID=
-RAZORPAY_KEY_SECRET=
-RAZORPAY_WEBHOOK_SECRET=
-CASHFREE_APP_ID=
-CASHFREE_SECRET_KEY=
+# Payments
+# Tickets are bought on SuperProfile (no card gateway keys here). ENABLE_LIVE_PAYMENTS only labels
+# Telegram Stars membership payments as test/live.
 ENABLE_LIVE_PAYMENTS=false
-# Organiser ticket tiers: paid checkout stays OFF unless explicitly set to true (and provider keys exist).
-# Free tiers work without it. Leave unset until an approved payment provider is configured.
-TICKET_CHECKOUT_ENABLED=
 
-# Membership via SuperProfile (Zapier/Pabbly webhook shared secret, 24+ chars)
+# SuperProfile notifications (tickets + memberships) via Zapier/Pabbly: shared secret sent as X-Webhook-Secret, 24+ chars
+# Endpoint: POST /api/webhooks/superprofile
 SUPERPROFILE_WEBHOOK_SECRET=
 
 # Site
@@ -49,10 +43,20 @@ GRIEVANCE_EMAIL=
 # Database operations
 # Vercel builds migrate only in Production. Set true on Preview ONLY if Preview has its own database.
 MIGRATE_ON_PREVIEW=
+# Explicitly proves database isolation in Preview deployments. Required for preview migrations & writes.
+ISOLATED_PREVIEW_DB=
+# Dedicated Preview database connection URL (Preview scope only; never in Production).
+PREVIEW_DATABASE_URL=
 # Allow `npm run seed:demo` against a non-local database (a dedicated preview DB only; never production).
 SEED_ALLOW_REMOTE=
 PG_POOL_MAX=
 
+# Preview isolation and test safeguards (Preview scope only; never in Production)
+PREVIEW_TELEGRAM_BOT_TOKEN=
+ALLOW_PREVIEW_TELEGRAM=
+ALLOW_PREVIEW_PAID_CHECKOUT=
+PREVIEW_PUBLIC_SITE_URL=
+
 # Optional
 DISABLE_WEB_ANALYTICS=
 

.github/workflows/ci.yml

@@ -0,0 +1,65 @@
+name: CI
+
+# Runs on every PR and on pushes to the long-lived branches. Needs no secrets: tests use a throwaway
+# Postgres service container and stubbed external APIs (no Telegram, SuperProfile or Vercel calls).
+on:
+  pull_request:
+  push:
+    branches: [main, launch-mvp]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: lint, unit, e2e
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: sm_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      CI: 'true'
+      PGPASSWORD: postgres
+      TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/sm_test
+      E2E_DATABASE_URL: postgres://postgres:postgres@localhost:5432/sm_e2e
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - name: Lint
+        run: npm run lint
+      - name: Unit and integration tests (real Postgres)
+        run: npm test
+      - name: Create the e2e database
+        run: psql -h localhost -U postgres -c 'CREATE DATABASE sm_e2e'
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+      - name: Browser tests (Playwright + axe)
+        run: npm run test:e2e
+      - name: Upload Playwright report and screenshots
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-failure
+          path: |
+            playwright-report/
+            test-results/
+          retention-days: 7

.gitignore

@@ -12,3 +12,9 @@ research_notes/
 reports/
 test-results/
 playwright-report/
+.mcp/
+public/img/review/
+.agents/
+.claude/
+skills-lock.json
+

Dockerfile.mcp

@@ -0,0 +1,26 @@
+# Dockerfile.mcp - Container runtime for StrangersMeetup Control MCP with Playwright Chromium support
+# Base image includes all Linux dependencies for headless Chromium, Firefox and WebKit
+FROM mcr.microsoft.com/playwright:v1.64.1-noble
+
+WORKDIR /app
+
+ENV NODE_ENV=production \
+    PORT=3333 \
+    MCP_PORT=3333 \
+    MCP_HOST=0.0.0.0 \
+    MCP_LOG_STDOUT=true
+
+# Copy package manifests first for efficient layer caching
+COPY package*.json ./
+
+# Install production dependencies
+RUN npm ci
+
+# Copy project source files
+COPY . .
+
+# Expose MCP HTTP port
+EXPOSE 3333
+
+# Start the MCP server
+CMD ["node", "mcp/server.js"]

README.md

@@ -8,15 +8,15 @@ Small hosted meetups, dinners, dating mixers and weekend trips for adults 21+ ac
 - Zero-build Node 24. One Vercel function (`api/index.js` → `lib/router.js`) renders pages and serves the API; `public/` holds static CSS/JS/images.
 - Postgres (`pg`), migrations in `migrations/NNN_*.sql`, tracked in `schema_migrations`.
 - Telegram Bot API (webhook), Telegram Login (OIDC) + Mini App `initData`.
-- Payments: Razorpay Payment Links for tickets; Telegram Stars subscriptions for membership. See `docs/PAYMENTS_DECISION.md`.
+- Payments: SuperProfile hosted checkout for tickets (linked from the site, confirmed by SuperProfile notifications); Telegram Stars subscriptions for membership inside Telegram. See `docs/PAYMENTS_DECISION.md`.
 
 ## Layout
 ```
 api/index.js            single serverless entry
 lib/router.js           route table (pages + API)
 lib/handlers/*          HTTP handlers (pages, auth, bookings, payments, telegram, cron, admin, leads)
 lib/services/*          domain logic (events, bookings, membership, invites, notifications, refunds, users)
-lib/payments/*          PaymentProvider adapters (razorpay, cashfree)
+lib/payments/*          PaymentProvider (superprofile_link) + SuperProfile URL allowlist
 lib/telegram/*          Bot API client, auth validation, bot command routing
 lib/views/*             server-rendered HTML (auto-escaping `html` tag)
 migrations/             Postgres migrations (legacy SQLite files kept in migrations/legacy-sqlite/)

docs/AUDIT.md

@@ -101,7 +101,7 @@ Scope: live site `https://strangersmeetup-virid.vercel.app/`, repo `Jakuraa/Stra
 
 ### P0 — blocks the money loop
 1. No persistent database in production (SQLite in `/tmp`). → Managed Postgres + migration runner.
-2. No ticket payment path at all; "booking" is free and unverified. → `PaymentProvider` + Razorpay/Cashfree sandbox + webhook-driven confirmation.
+2. No ticket payment path at all; "booking" is free and unverified. → `PaymentProvider` + SuperProfile hosted checkout + notification-driven confirmation.
 3. Auth bypass when bot token missing (S1); no sessions. → Strict initData/Login Widget validation, signed httpOnly session.
 4. IDOR on entitlements/invite links and cancel (S2, S3). → Session-scoped endpoints only.
 5. Webhook processing non-transactional, non-retryable (S8); hardcoded fallback secret (S5).

docs/FIRST_EVENT_RUNBOOK.md

@@ -0,0 +1,85 @@
+# First Revenue Event Runbook: SuperProfile Link-Out
+
+This runbook guides the platform owner through publishing and running the first revenue-generating event on **StrangersMeetup** using the zero-gateway-liability **SuperProfile link-out** mechanism.
+
+---
+
+## Architecture Summary
+
+* **Payment Processing:** 100% handled externally on **SuperProfile**. StrangersMeetup handles zero card data, stores zero payment credentials, and incurs zero gateway compliance liability.
+* **Redirection Gate in Production:**
+  In `lib/payments/availability.js`, the production redirect is enabled purely by:
+  `event.checkout_mode = 'superprofile'` and `Boolean(event.superprofile_url)`.
+  * `ENABLE_LIVE_PAYMENTS` is **NOT** required.
+  * No secret keys or payment API credentials are required in the app.
+* **Venue & Group Delivery:** Handled immediately via SuperProfile's post-purchase confirmation screen and connected Telegram group.
+* **Database Tracking (Optional):** When the webhook is active, sales are automatically logged in `orders`. Even without the webhook, Event 1 runs safely because SuperProfile manages ticket stock, attendee payment, and group delivery.
+
+---
+
+## Step-by-Step Owner Instructions
+
+### Step 1: Create the Event Product on SuperProfile
+1. Log in to your **SuperProfile** dashboard (https://superprofile.bio).
+2. Create a new **Event / Ticket Product**:
+   - **Title:** Match your event title (e.g., *Friday Night Social Mixer*).
+   - **Price:** Set your ticket price in INR (e.g., ₹499).
+   - **Inventory / Capacity:** Set the maximum number of tickets available (e.g., 25).
+   - **Post-Purchase Delivery:** Connect your private Telegram group or enter the secret venue details to be revealed upon purchase.
+3. **Publish** the product on SuperProfile.
+4. Copy the public product link (e.g., `https://superprofile.bio/event/friday-night-mixer`).
+
+---
+
+### Step 2: Publish the Event on StrangersMeetup Admin Console
+1. Navigate to `https://strangersmeetup-virid.vercel.app/admin` (or your custom domain).
+2. Sign in with your bootstrapped `super_admin` Telegram account.
+3. Go to **Events** → **New Event** (or edit an existing draft):
+   - **Title, City, Date & Time:** Enter details.
+   - **Category:** Choose Nightlife, Dinner, Social Mixer, etc.
+   - **Venue Privacy:** Set to **Secret Venue** (renders neighborhood teaser publicly; exact address remains hidden).
+   - **Checkout Mode:** Select **SuperProfile**.
+   - **SuperProfile Link:** Paste the link copied from Step 1 (`https://superprofile.bio/...`).
+   - **Status:** Set to **Published**.
+4. Save the event.
+5. Verify on `https://strangersmeetup-virid.vercel.app/events/<slug>`:
+   - The event displays the **Book Tickets** button.
+   - Clicking **Book Tickets** routes through `/checkout/<slug>` and redirects directly to your SuperProfile page with an attached `?ref=...` tracking code.
+
+---
+
+### Step 3: Test Purchase & Refund (Dry-Run)
+1. Open the event page in an incognito window or on your mobile device.
+2. Click **Book Tickets** and complete a test purchase on SuperProfile using a personal card or UPI.
+3. Confirm that:
+   - SuperProfile displays the purchase confirmation.
+   - You receive the Telegram group invite / secret venue details.
+4. In the SuperProfile dashboard, locate your test order and issue a **Refund**.
+
+---
+
+### Step 4: (Optional) Connect Automated Purchase Webhook
+To sync SuperProfile purchases into StrangersMeetup's `/admin` Orders table automatically:
+1. In Vercel, set a high-entropy secret:
+   ```bash
+   vercel env add SUPERPROFILE_WEBHOOK_SECRET production
+   ```
+2. In Zapier, Pabbly, or SuperProfile Webhook settings, configure a webhook trigger for new purchases targeting:
+   ```
+   POST https://strangersmeetup-virid.vercel.app/api/webhooks/superprofile
+   ```
+   * Header: `X-SuperProfile-Signature: <hex HMAC-SHA256 of payload>`
+   * Payload format:
+     ```json
+     {
+       "event": "payment.success",
+       "data": {
+         "order_id": "SP-123456",
+         "custom_fields": { "ref": "<ref from checkout URL>" },
+         "amount": 49900,
+         "currency": "INR",
+         "buyer_email": "attendee@example.com"
+       }
+     }
+     ```
+3. *Note:* If running Event 1 without the webhook, your event still runs smoothly: SuperProfile caps capacity and invites guests to the Telegram group, while you can view your guest list directly in the SuperProfile dashboard.