Skip to content

Develop - #53

Merged
nlklfor merged 7 commits into
mainfrom
develop
Aug 20, 2026
Merged

Develop#53
nlklfor merged 7 commits into
mainfrom
develop

Conversation

@nlklfor

@nlklfor nlklfor commented Aug 20, 2026

Copy link
Copy Markdown
Owner

No description provided.

nlklfor and others added 7 commits August 19, 2026 11:06
…rement

- Move order creation server-side (create-order edge function): re-prices
  every line item from products, validates stock, decrements it atomically
  via the new create_order() RPC, and auto-restocks on cancellation via a
  DB trigger — closes the client-trusted-total hole (FIXES.md #1).
- Replace the Ukraine city/branch text inputs with a searchable combobox
  (AsyncCombobox) backed by a new nova-poshta-search edge function, using
  Nova Poshta's classic API (api.novaposhta.ua) for city/warehouse lookup
  and live delivery-cost calculation.
- Rename the Switzerland zone to International with free-text country/city
  fields; automatic delivery cost stays Ukraine-only for now.
- Vendor track-order and nova-poshta-track into the repo (previously only
  in the Supabase dashboard) and fix nova-poshta-track's hardcoded empty
  apiKey, which had silently broken tracking in production.
- Fix a regression in the post-checkout Telegram notification call that
  dropped its required auth headers, causing it to fail silently.
Brings notify-telegram into version control (previously only in the
Supabase dashboard) and strips the bot_users/generate-acquisition-record
lookup — that customer-DM flow was never fully built (no registration
path ever wrote to bot_users, and generate-acquisition-record was never
deployed), so every order silently 404'd on that call. The admin Telegram
alert itself is unchanged.
Add rate limiting (reusing the lookup_attempts pattern from track-order),
length caps on name/message, type validation, and Telegram Markdown
escaping to close the open-relay hole in backlog item #2. Also correct
docs/backlog.md to reflect items #1, #3, #5, #8 already shipped earlier.
…tional

Documents the live RLS state for products/orders/reviews as a reviewable
migration (backlog #4). Drops a stray public INSERT policy on orders that
let the anon key bypass create-order's server-side pricing. Also pins the
missing search_path on set_is_international, closing a Supabase advisor
warning, and logs its pre-existing inverted-logic bug as a follow-up item.
@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
metallurg Ready Ready Preview Aug 20, 2026 9:13pm

@nlklfor
nlklfor merged commit bb032e1 into main Aug 20, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant