developer/scrabble-game
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat(vk): embed the game as a VK Mini App #140

Merged
developer merged 1 commits from feature/vk-embedding into development 2026-06-27 11:23:44 +00:00
Conversation 1 Commits 1 Files Changed 43
+1175 -50
developer commented 2026-06-27 09:38:00 +00:00
Owner
Copy Link
Copy Source

Mirror the Telegram Mini App wrapper for VK — the minimum to run the game in VK test mode. The SPA loads at a new /vk/ entry, authenticates from VK's signed launch parameters, and provisions a vk platform identity.

What

  • Gateway: in-process signature verify (internal/vkauth: HMAC-SHA256 over the sorted vk_* params under GATEWAY_VK_APP_SECRET, base64url — a pure offline check, no side-service). New auth.vk op (gated on the secret), backendclient.VKAuth, /vk/ SPA mount.
  • Backend: KindVK + ProvisionVK/vkSeed, /sessions/vk handler, identities kind widened to 'vk' (migration 00005, expand-contract).
  • UI: src/lib/vk.ts (VK Bridge, lazy-imported), bootVK + the /vk/ boot dispatch, encodeVKLogin + authVK. The display name is read client-side via VKWebAppGetUserInfo (VK omits it from the signed params) — unsigned, cosmetic seed only.
  • Deploy: /vk in the edge Caddyfile; GATEWAY_VK_APP_SECRET through compose + .env.example + CI (TEST_) + prod-deploy (PROD_).
  • Admin: VK user id (link to the VK profile) next to the Telegram id on the user card.
  • Docs: ARCHITECTURE §12/§13, FUNCTIONAL (+ _ru), gateway README; VK reference under .claude/.

Verified

Signature confirmed against dev.vk.com + independent Node/Python references (+ a %2C edge-case vector). Local: full Go suite (39 pkgs), ProvisionVK integration (migration applies, 'vk' accepted, confirmed=true), UI check/test(342)/build/bundle-gate(95.7/100), gofmt, compose validate.

Owner actions to exercise VK on the contour

  1. Set the VK app's «Защищённый ключ» as Gitea secret TEST_GATEWAY_VK_APP_SECRET (+ PROD_) — without it auth.vk stays unregistered.
  2. Point the VK app Web iframe URL at the contour's public /vk/; add yourself as a tester.

Deferred (out of this MVP)

VK theme/viewport/swipe fine-tuning (needs the live VK client), VKWebAppShare, deep-links, payments, VITE_VK_APP_ID, vk-identity account-linking.

Mirror the Telegram Mini App wrapper for VK — the minimum to run the game in VK **test mode**. The SPA loads at a new `/vk/` entry, authenticates from VK's signed launch parameters, and provisions a `vk` platform identity. ## What - **Gateway**: in-process signature verify (`internal/vkauth`: HMAC-SHA256 over the sorted `vk_*` params under `GATEWAY_VK_APP_SECRET`, base64url — a pure offline check, no side-service). New `auth.vk` op (gated on the secret), `backendclient.VKAuth`, `/vk/` SPA mount. - **Backend**: `KindVK` + `ProvisionVK`/`vkSeed`, `/sessions/vk` handler, identities `kind` widened to `'vk'` (migration 00005, expand-contract). - **UI**: `src/lib/vk.ts` (VK Bridge, lazy-imported), `bootVK` + the `/vk/` boot dispatch, `encodeVKLogin` + `authVK`. The display name is read client-side via `VKWebAppGetUserInfo` (VK omits it from the signed params) — unsigned, cosmetic seed only. - **Deploy**: `/vk` in the edge Caddyfile; `GATEWAY_VK_APP_SECRET` through compose + `.env.example` + CI (`TEST_`) + prod-deploy (`PROD_`). - **Admin**: VK user id (link to the VK profile) next to the Telegram id on the user card. - **Docs**: ARCHITECTURE §12/§13, FUNCTIONAL (+ _ru), gateway README; VK reference under `.claude/`. ## Verified Signature confirmed against dev.vk.com + independent Node/Python references (+ a `%2C` edge-case vector). Local: full Go suite (39 pkgs), `ProvisionVK` integration (migration applies, `'vk'` accepted, confirmed=true), UI check/test(342)/build/bundle-gate(95.7/100), gofmt, compose validate. ## Owner actions to exercise VK on the contour 1. Set the VK app's **«Защищённый ключ»** as Gitea secret `TEST_GATEWAY_VK_APP_SECRET` (+ `PROD_`) — without it `auth.vk` stays unregistered. 2. Point the VK app **Web iframe URL** at the contour's public `/vk/`; add yourself as a tester. ## Deferred (out of this MVP) VK theme/viewport/swipe fine-tuning (needs the live VK client), `VKWebAppShare`, deep-links, payments, `VITE_VK_APP_ID`, vk-identity account-linking.
developer added 1 commit 2026-06-27 09:38:00 +00:00
feat(vk): embed the game as a VK Mini App
CI / changes (pull_request) Successful in 2s
Details
CI / unit (pull_request) Successful in 10s
Details
CI / integration (pull_request) Successful in 14s
Details
CI / ui (pull_request) Successful in 1m0s
Details
CI / gate (pull_request) Successful in 0s
Details
CI / deploy (pull_request) Successful in 1m19s
Details
65c194264c 
Mirror the Telegram Mini App wrapper for VK: the SPA loads at a new /vk/
entry, authenticates from VK's signed launch parameters, and provisions a
'vk' platform identity — the minimum to run the game in VK test mode.

- Gateway verifies the launch signature in-process (internal/vkauth:
  HMAC-SHA256 over the sorted vk_* params under GATEWAY_VK_APP_SECRET,
  base64url) — a pure offline check, no side-service. New auth.vk op
  (gated on the secret), backendclient.VKAuth, /vk/ SPA mount.
- Backend: KindVK + ProvisionVK/vkSeed, /sessions/vk handler, identity
  kind widened to include 'vk' (migration 00005, expand-contract).
- UI: src/lib/vk.ts (VK Bridge, lazy-imported), bootVK + the /vk/ boot
  dispatch, encodeVKLogin + authVK across transport/client/mock. VK omits
  the name from the signed params, so the client reads it via
  VKWebAppGetUserInfo as an unsigned display seed.
- Deploy: /vk in the edge Caddyfile, GATEWAY_VK_APP_SECRET wired through
  compose + .env.example + CI (TEST_) + prod-deploy (PROD_).
- Admin console: surface the VK user id (link to the VK profile) next to
  the Telegram id on the user card.
- Docs: ARCHITECTURE §12/§13, FUNCTIONAL (+ _ru), gateway README; VK
  integration reference under .claude/.

Signature algorithm verified against dev.vk.com plus independent Node/Python
references and a %2C edge-case vector.
owner approved these changes 2026-06-27 11:21:30 +00:00
developer merged commit d9ede77e2f into development 2026-06-27 11:23:44 +00:00
developer deleted branch feature/vk-embedding 2026-06-27 11:23:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
owner
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
owner (Ilia) developer
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: developer/scrabble-game#140
Delete Branch "feature/vk-embedding"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?