release: promote development → master (v1.21.0) #272

Merged

developer merged 15 commits from development into master 2026-07-14 20:29:05 +00:00

Conversation 0 Commits 15 Files Changed 82

+1308 -106

developer commented 2026-07-14 20:23:48 +00:00

Owner

Copy Link

Copy Source

Promote the current development integration branch to the production trunk. Cut a v1.21.0 tag on master after merge, then dispatch prod-deploy.

Ships

• #270 fix(gateway): native WebView CORS — unblocks the packaged app's online path (was stuck offline; 405 on the Connect preflight).
• #271 android icons (adaptive mark −25% into the safe zone, legacy square → full-bleed master) + the profileless client defaults to Erudit only (matches the backend new-account default).
• #266 feat(payments): per-channel Robokassa shops on the direct rail — dormant (falls back to the web shop when no _ANDROID_* config).
• #267 feat(payments): live payment-availability kill switch + per-account override — dormant / fail-open (switch off by default).
• #268 chore(android): RuStore signing secrets renamed ANDROID_* → ANDROID_RUSTORE_* (CI/docs).
• #269 android: ANDROID_PLAN refresh + pin build-tools 36.

Schema

• 00015_orders_shop.sql — ADD COLUMN payments.orders.shop (default '').
• 00016_payment_availability.sql — new payments.rail_status + payments.account_payment_override tables.

Both expand-only / backward-compatible → image rollback stays DB-safe. The prod deploy opens a maintenance window + takes a consistent pg_dump for the schema step. Verified: full CI green on the constituent PRs; contour deployed.

Promote the current `development` integration branch to the production trunk. Cut a `v1.21.0` tag on `master` after merge, then dispatch prod-deploy. ## Ships - **#270** fix(gateway): native WebView CORS — unblocks the packaged app's online path (was stuck offline; 405 on the Connect preflight). - **#271** android icons (adaptive mark −25% into the safe zone, legacy square → full-bleed master) + the profileless client defaults to **Erudit only** (matches the backend new-account default). - **#266** feat(payments): per-channel Robokassa shops on the direct rail — **dormant** (falls back to the web shop when no `_ANDROID_*` config). - **#267** feat(payments): live payment-availability kill switch + per-account override — **dormant / fail-open** (switch off by default). - **#268** chore(android): RuStore signing secrets renamed `ANDROID_*` → `ANDROID_RUSTORE_*` (CI/docs). - **#269** android: ANDROID_PLAN refresh + pin build-tools 36. ## Schema - `00015_orders_shop.sql` — `ADD COLUMN payments.orders.shop` (default ''). - `00016_payment_availability.sql` — new `payments.rail_status` + `payments.account_payment_override` tables. Both **expand-only / backward-compatible** → image rollback stays DB-safe. The prod deploy opens a maintenance window + takes a consistent `pg_dump` for the schema step. Verified: full CI green on the constituent PRs; contour deployed.

developer added 15 commits 2026-07-14 20:23:49 +00:00

feat(payments): per-channel Robokassa shops on the direct rail ... eef90a152e

Split the single Robokassa direct rail into one merchant shop per channel
(web / android; ios later), chosen by the trusted X-Platform subtype, while
every shop still credits the one `direct` wallet — merchant-account separation
for accounting and receipts, not a new wallet.

- config: a channel-keyed shops registry (web seeds from the legacy vars or
  _WEB_*, android from _ANDROID_*); an empty shop leaves the rail dormant;
  per-shop validation.
- intake: the order picks its shop by subtype (unknown falls back to web); the
  per-shop Result callback is verified by that shop's own Password2 at
  /pay/robokassa/result/<channel> (the gateway extracts the channel; Caddy's
  /pay/* glob already forwards it — no Caddyfile change).
- persistence: an additive `shop` column on the order (migration 00015),
  recorded from the payment context, surfaced per entry in the admin report.
- standalone apps sign in by email only, so a direct purchase keeps its email
  anchor.
- docs: PAYMENTS (+ru) topology, deploy env vars + compose mapping, the
  decisions log (D41 revised for the ИП / 54-ФЗ move; D42-D44), the plan.

Contour-safe: dormant until shops are configured; the migration is additive
(no wipe); no client wire change. Fiscalization (Receipt/Email) and the gateway
`direct/android` subtype follow when the ИП / RuStore are live.

Merge pull request 'feat(payments): per-channel Robokassa shops on the direct rail' (#266) from feature/robokassa-multishop into development 4b3c9d4fdd

feat(payments): live payment-availability kill switch + per-account override ... 1507ceb793

Let an operator disable purchases live from the admin — a whole rail/channel or
one account — and show the user a localized reason on their next attempt, so a
provider outage or a misconfig is explained instead of a silent dead button.

- rail kill switch (payments.rail_status, per rail direct:web / direct:android /
  vk / telegram): enabled + a per-language message, edited on the catalog page.
  Fail-open — a rail with no row stays enabled, so payments are never accidentally
  killed. The intake gate (CanPurchase in handleWalletOrder, before the order)
  returns payment_unavailable + the localized message, orthogonal to the security
  gates.
- per-account override (payments.account_payment_override, a row only for
  non-default): allow / deny / default, edited on the user card. "allow" bypasses
  ONLY the ops rail switch, never the security gates (trusted platform, the email
  anchor, the VK-iOS freeze, the min client version).
- wire: an additive ExecuteResponse.message envelope field (frozen-contract-safe);
  the gateway forwards a backend domain-error message; the client shows it on a
  payment_unavailable buy attempt.
- admin: rail toggles on the catalog page, the override control on the user card.
- tests: the pure gate (unit, TDD), the store + gate + override end-to-end
  (integration, migration 00016), the client (svelte-check / vitest).
- docs: PAYMENTS (+ru), the decisions log (D45/D46). Fiscalization stays
  cabinet-side (owner decision) — no itemized-receipt code.

Contour-safe: additive migration (two new tables, no wipe), the wire add is
additive, and fail-open so nothing is disabled until an operator acts.

Merge pull request 'feat(payments): live payment-availability kill switch + per-account override' (#267) from feature/payment-kill-switch into development 74842dc624

chore(android): rename the RuStore signing secrets ANDROID_* -> ANDROID_RUSTORE_* ... 8d3f862b41

The signing key is store-specific: RuStore self-signs (the cert is the app cert), while Google Play re-signs via Play App Signing (the uploaded key is only the upload key). Keep a separate key per store and name the secrets accordingly. Only the Gitea secret names change; build.gradle keeps the store-agnostic env contract (ANDROID_KEYSTORE_*), so the same build serves a future Google key from its own workflow. New names: ANDROID_RUSTORE_KEYSTORE_BASE64 / _KEYSTORE_PASSWORD / _KEY_ALIAS / _KEY_PASSWORD.

Merge pull request 'chore(android): rename RuStore signing secrets ANDROID_* -> ANDROID_RUSTORE_*' (#268) from feature/rustore-signing-secrets into development 0e56e4de9a

docs(android): refresh the ANDROID_PLAN RESUME block ... d0e473920c

Keystore + its Gitea secrets are set (owner) under the RuStore-specific ANDROID_RUSTORE_* names; the payments E10/E11 (#266/#267) + the signing-secret rename (#268) landed on development; the release gate is now the RuStore account + the promote/tag chain. Adds a native-notifications (push) track and the test-APK note for the next session.

fix(android): pin build-tools to 36.0.0 for all modules ... 0e11817654

AGP 8.13 defaults to build-tools 35.0.0, but the provisioned / read-only CI SDK (/opt/android-sdk) has only 36.0.0 installed, so a gradle build (the app + the cap-sync-generated Capacitor modules) fails trying to auto-install 35 into a read-only dir. Pin buildToolsVersion 36.0.0 for every Android sub-project (compileSdk-matching) so the CI android-build signed release and local builds work. Verified: a local assembleDebug now builds app-debug.apk. ci.yaml does not build Android (only the manual android-build workflow does), so this is verified locally.

fix(gateway): allow the native WebView origin via CORS ... f0b7ad47d4

The packaged native app (Capacitor) serves the bundled SPA from a localhost scheme, so its Connect calls to erudit-game.ru are cross-origin. The gateway had no CORS handling, so the preflight OPTIONS returned 405 with no Access-Control-Allow-Origin and the WebView blocked every RPC — a native build could never reach the gateway and stayed stuck offline (the native online path was never exercised on-device; on-device D was airplane-mode only). Add a CORS middleware that answers the preflight and sets the response headers for the native localhost origins (https/http/capacitor://localhost); web is same-origin and untouched. Fixes the native emulator 'starts offline, can't go online' report.

Merge pull request 'android: ANDROID_PLAN refresh + pin build-tools 36 (unblocks the release build)' (#269) from feature/android-plan-refresh into development 363f1632b1

Merge pull request 'fix(gateway): allow the native WebView origin via CORS (native stuck-offline)' (#270) from feature/native-cors into development d89438040b

fix(ui): default the profileless client to Erudit only, not every variant ... 54bc31c619

availableVariants fell back to all three variants when the player had no
stored preferences. A fresh offline native launch boots with no profile, so
New Game exposed the English game before the player opted in — contrary to the
backend's Erudit-only new-account default (docs/FUNCTIONAL.md). Fall back to
DEFAULT_VARIANTS (Erudit only) instead; all dictionaries stay bundled.

feat(icons): shrink the Android adaptive mark 25%, give old square launchers the full-bleed master ... 4a3e12c85a

The adaptive foreground's asterisk grazed the round mask's safe zone. Scale the
foreground mark 0.75 about the icon centre (25% smaller, the letter-to-star
arrangement unchanged) so it sits well inside the 61% safe zone. Independently,
the legacy square ic_launcher.png now renders the full-bleed master instead of
the safe-zone composite, so old Android (< API 26) shows a large mark rather
than a shrunk one; the legacy round icon keeps the safe-zone composite (a round
mask would clip the master's corner star). Regenerate the layer set, Android
res and the brandbook foreground previews; update ICON_BRANDBOOK.md / ICONS.md.

test(ui): update the native offline-first e2e for the Erudit-only guest default ... e07886ecb1

The offline native guest is now offered only Erudit (the profileless default
from the variants fix), so the specs that picked the English "Scrabble"
variant timed out. Play Erudit instead: the single `.variant` click both
selects it and asserts nothing else is offered; the vs_ai test plays НОЖ from
the pinned Erudit rack (ОЖЬЯНАО), and the bundled ru_erudit dawg drives the
robot reply.

Merge pull request 'android: shrink adaptive icon mark 25% + full-bleed legacy square + Erudit-only default for the profileless client' (#271) from feature/native-icons-variant-defaults into development b5fe61279b

owner approved these changes 2026-07-14 20:24:29 +00:00

developer merged commit e836dfefba into master 2026-07-14 20:29:05 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#272