mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-08-02 12:05:43 +00:00
pezkuwichain
9c6af146e6
* ops: let a function be retired, not just deployed The guarded deploy could create and update, never remove. rsync runs without --delete on purpose, so one project cannot wipe another's functions — but the consequence was that nothing ever left. A function deleted from its repository kept serving traffic, and nobody would know. Found the concrete case on 2026-08-01: email-verification had been removed from pwap on 2026-07-30 and was still live and reachable with only the anon key, running under the service-role key with Access-Control-Allow-Origin *. Its verify path sets profiles.email_verified for whatever user_id a token maps to. It was not exploitable — the send path calls getUserByEmail, which the SDK does not have, so no tokens could be minted and the table was empty. Broken is not the same as safe; it was protected by a bug, not by design. - --audit compares the volume against the registry both directions and exits 1 on drift. Runs after every deploy too, so a leftover is stated rather than invisible. - --retire moves functions into /opt/supabase-self-hosted/retired-functions/ with a timestamp. Quarantined, not deleted: retiring the wrong thing has to be one command to undo, and that copy is the only remaining record of what was serving traffic. - _cloud_hosted names now count as declared. They live on the cloud project and are owned by nobody here, so without this the audit would have offered to retire ask and telegram-bot, which look live. Applied: email-verification retired and dropped from the registry; the audit is clean; two-factor-auth and the miniapp's check-deposits both still answer. * ops: catch the function a project still serves but no longer ships The retire mechanism closed the second half of the problem. This closes the first: nothing could detect that email-verification needed retiring. It was never an orphan. The registry listed it as owned and current, the volume agreed, and both were right about each other — the repository was the one that had dropped it. Volume-vs-registry compares two of the three and cannot see a disagreement in the third. It only became visible as drift because I removed it from the registry by hand, which means the mechanism did not find it; I did. A deploy is the one moment we hold the project's actual source next to the registry and the volume, so it is the only place all three can be compared. Anything the project owns, that is on disk, and that is absent from what it just shipped, is now named with the command to retire it. Warns rather than refuses: deleting a function and shipping an unrelated change in the same commit is ordinary, and blocking that deploy until someone retires would punish the correct move. It is printed in the deploy output and recorded as an ABANDONED line in the deploy log. Verified against a source tree missing eight of pwap-web's functions: all eight named, deploy still allowed.
Pezkuwi Telegram Mini App
Telegram Mini App for Pezkuwichain - Forum, Announcements, Rewards, and Wallet integration.
Tech Stack
- Frontend: React 18 + TypeScript + Vite
- Styling: Tailwind CSS + shadcn/ui patterns
- State: TanStack Query (React Query)
- Backend: Supabase (PostgreSQL + Auth + Edge Functions)
- Testing: Vitest + Testing Library
- CI/CD: GitHub Actions
Getting Started
Prerequisites
- Node.js >= 18
- npm >= 9
- Supabase account
Installation
# Clone the repo
git clone https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
cd pezkuwi-telegram-miniapp
# Install dependencies
npm install
# Copy environment template
cp .env.example .env
# Add your Supabase credentials to .env
Development
# Start dev server
npm run dev
# Run tests
npm run test
# Type check
npm run typecheck
# Lint
npm run lint
# Format code
npm run format
# Full validation (typecheck + lint + test + build)
npm run validate
Build
npm run build
Output will be in dist/ directory.
Project Structure
src/
├── contexts/ # React contexts (Auth)
├── hooks/ # Custom hooks (Supabase, Telegram)
├── lib/ # Utilities (env, supabase client)
├── sections/ # Main app sections
│ ├── Announcements.tsx
│ ├── Forum.tsx
│ ├── Rewards.tsx
│ └── Wallet.tsx
├── test/ # Test setup
├── types/ # TypeScript types
├── App.tsx # Main app component
└── main.tsx # Entry point
Database Schema
Tables (prefixed with tg_ to avoid conflicts):
tg_users- Telegram userstg_announcements- Admin announcementstg_announcement_reactions- Like/dislike reactionstg_threads- Forum threadstg_thread_likes- Thread likestg_replies- Thread repliestg_reply_likes- Reply likes
Environment Variables
| Variable | Description |
|---|---|
VITE_SUPABASE_URL |
Supabase project URL |
VITE_SUPABASE_ANON_KEY |
Supabase anon/public key |
Telegram Setup
- Create bot via @BotFather
- Enable Mini App in bot settings
- Set Mini App URL to deployment URL
- Deploy
telegram-authEdge Function to Supabase
License
MIT