Repository navigation
Consolidate M4–M10 (supersedes #30–#40) - #41
Merged
Satelink-Protocol merged 27 commits intoNov 10, 2026
Merged
Conversation
…ings (SEC-01 - DB-01) - SEC-01: Extract Base64 response for PhonePe S2S webhook signature calculation - FIN-01: Enforce strict webhook amount verification and dispute ledger transition - DATA-01: Gate checkout with sign-in redirect, store guestToken, and add claim API - CONCUR-01: Hold unexpired intent capacity and re-verify inventory at confirmation - AUTH-01: Enforce session and guestToken authorization on payment status API - QR-01: Preserve ISO 18004 Dark Module at (size - 8, 8) and fix V8 block interleaving - UI-01: Add responsive media queries to isolate mobile intent and desktop QR - LOG-01: Namespace PhonePe rate limits to phonepe_hook: and phonepe_bad_sig: - DB-01: Add migration 016 with append-only database trigger on payment_audits - Update test suite with 8 dedicated M4.3 audit tests (453/453 tests passing) - Update audit reports and project state docs
… on PR #30 - REV-01: Correct ISO/IEC 18004 QR alignment patterns, RS polynomial generator, Table 12 Format Info, and BCH(18,6) Version Info across V1-V14 with independent jsQR validation - REV-02: Prevent duplicate active bookings at intent creation, confirmation locked tx, guest claims, and handle SQLSTATE 23505 via defensive savepoints - REV-03: Enable operational recovery for refund_pending payments, isolate gateway calls outside holding transactions, and support manual finance reconciliation - REV-04: Enforce strict safe positive integer paise amount matching, exact currency match, and merchant association, preventing underpayment attacks - REV-05: Expand QR capacity to V14 (362B), enforce byte-length checks, and return HTTP 400 QrPayloadTooLargeError without truncating payment details - REV-06: Strictly verify webhook merchantId against configured identity, rejecting missing or mismatched IDs with 401 - REV-07: Add additive migration 017 with idx_payments_active_tier_holds index, verified via EXPLAIN Bitmap Index Scan - docs: update UPI_SECURITY_AUDIT.md, UPI_PROVIDER_READINESS.md, and PROJECT_STATE.md with M4.3.1 remediation matrix
…nt identity, secure manual refund reconciliation & state transition verification
…ency defaults & status merchant fallback
…& milestone M4 closure
…rational workflows
…heck-in - Implement comprehensive organiser workspace: event overview, readiness checklist, ticket inventory & capacity, attendee lookup & cancellations, and event announcements. - Add event-scoped staff roles and permissions: organiser, event_manager, door_staff, guest_list_manager, assistant with tokenized invites, immediate access revocation, and audit logging. - Build server-authoritative QR ticket engine: HMAC-SHA256 signed payloads (NLZ1:<ticketCode>:<HMAC>) bound to event and confirmed booking without attendee PII leakage. - Deliver mobile-first door check-in scanner: camera BarcodeDetector/canvas detection, manual ticket code fallback, atomic duplicate scan and replay prevention, attendance KPIs, and scan history. - Add database migration 019: event_team audit enhancement, event_staff_invites, tickets, ticket_scans, event_announcements, and existing booking ticket backfill. - Comprehensive automated test suite in test/m6-organiser-workspace.test.js with 15/15 passing tests and 642 passing regression tests. - Update docs/PROJECT_STATE.md and add arch/ORGANISER_WORKSPACE_AND_QR_CHECKIN.md.
… empty state locator in organiser overview
…aved events & hub
…hours & operational comms
…nd roadmap update
…dit, mobile tap target remediation and preview automation runbook
…cceptance checklist
…ent preview configuration
multi-role-acceptance.spec.js (M9) submits real venue leads in the desktop and mobile projects; with one shared e2e database those rows reach the responsive project, so the 'Status of venue lead' combobox matched 3 rows and failed strict mode at every viewport. Target the seeded lead's row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Author
|
CI green on head 02bfdba — run https://github.com/Jakuraa/StrangersMeetup/actions/runs/42791819075
|
This was referenced Nov 10, 2026
Closed
Closed
This was referenced Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the 11-deep stack #30 → #40 into one merge into
launch-mvp. Feature freeze: no new features. The only new commit is a test-isolation fix (see below).launch-mvp(c71ec8d, PR #29 merge) is an ancestor of this head. Every superseded PR head below is an ancestor of this head (merge-base --is-ancestor, checked 2026-11-10).Superseded PRs
Added on top of #40's last CI'd head:
ea0f5e5(preview reviewer env detection; previously local-only) and02bfdba(e2e fix).Migrations new to
launch-mvp(015 is already on
launch-mvpvia #29. There is no 021.)payment_auditsappend-only trigger (blocks UPDATE/DELETE) + active-hold indexevent_team),ticketstable, QR check-inticketsrow for each existing booking (INSERT … SELECT)saved_events+ discovery indexesWhy CI was red on #37–#40
One test,
e2e/admin-responsive.spec.js"moderation", failed at all 5 viewports with a strict-mode violation.multi-role-acceptance.spec.js(added in M9) submits real venue leads in the desktop and mobile projects into the shared e2e DB, so the "Status of venue lead" locator matched 3 rows. This was a test-isolation bug, not a product bug. Fix: target the seeded lead's row (02bfdba).Tests (full suites, CI job
lint, unit, e2e)CI runs
npm run lint, the fullnpm testand the fullnpm run test:e2e(all Playwright projects: desktop, mobile, responsive × 5 viewports). See the CI result comment below for final counts.02bfdba: lint 153/153 files OK;npm test695 tests, 693 pass, 0 fail, 2 skipped.142cc62: e2e 182 total = 166 passed, 11 skipped, 5 failed (the single test above).Rollback
Revert the merge commit on
launch-mvp(revert -m 1 <merge-sha>). Migrations 016–020 are additive. Leaving them applied after a code revert is safe, because the old code ignores the new tables, columns, indexes and the audit trigger.🤖 Generated with Claude Code