developer/scrabble-game
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(vk): persist settings via VK Bridge storage; hide competing sign-in in Mini App hosts #278

Merged
developer merged 1 commits from feature/vk-moderation-fixes into development 2026-07-16 17:12:46 +00:00
Conversation 0 Commits 1 Files Changed 10
+376 -43
developer commented 2026-07-15 20:54:19 +00:00
Owner
Copy Link
Copy Source

VK moderation follow-ups (two independent client fixes, one PR — no schema/wire change).

1. Settings lost on reload in VK desktop iframe (Firefox)

Root cause: Firefox partitions/blocks IndexedDB + localStorage in a cross-origin iframe, so the browser-local store is empty on every reload inside VK desktop. A plain tab / PWA keeps them (first-party storage); Telegram has its own CloudStorage sync. The VK identity is stable (re-derived from the signed vk_* launch params, not from storage), so only the client prefs are lost — and the locale was additionally read back as a browser default.

Fix: mirror the display prefs + coachmark flags to VK Bridge storage (VKWebAppStorageSet/Get, lib/vkprefs.ts + lib/vk.ts), which travels over postMessage to vk.com and is immune to browser-storage partitioning; reconcile on the VK launch before first paint (reconcileVKPrefs). The locale rides this store on VK (it has no other durable client home there); it is restored via low-level setLocale, so it never re-pushes over the server value.

2. Profile must not advertise a competing sign-in inside a host (ToS)

Inside a proprietary Mini App host (VK or Telegram) the profile now shows only email linking — both the Telegram and VK link/unlink entries are hidden (profileValidation.signInProvidersVisible). Mirrors both ways (VK hides Telegram; Telegram hides VK). A provider linked earlier on the web stays attached, managed from the web; web/native builds are unchanged (show both).

Tests

  • vkprefs.test.ts — codec round-trip / validation / onboarding (the wire-ish layer).
  • profileValidation.test.ts — signInProvidersVisible (the ToS gate).
  • Full local gate green: svelte-check 0 errors, vitest 646 passed, vite build ok.
  • Item 2 host-gating needs on-contour visual verification (VK + TG Mini App): no VK-host e2e harness exists and a TG-host assertion would be vacuous without a vkLinked mock account — disproportionate to build for a pure conditional render on already-tested platform predicates.

Docs

ARCHITECTURE.md (VK Bridge storage sync + the profile ToS host-gate), FUNCTIONAL.md (+_ru).

VK moderation follow-ups (two independent client fixes, one PR — no schema/wire change). ## 1. Settings lost on reload in VK desktop iframe (Firefox) **Root cause:** Firefox partitions/blocks IndexedDB + localStorage in a cross-origin iframe, so the browser-local store is empty on every reload inside VK desktop. A plain tab / PWA keeps them (first-party storage); Telegram has its own CloudStorage sync. The VK identity is stable (re-derived from the signed `vk_*` launch params, not from storage), so only the client prefs are lost — and the locale was additionally read back as a browser default. **Fix:** mirror the display prefs + coachmark flags to **VK Bridge storage** (`VKWebAppStorageSet/Get`, `lib/vkprefs.ts` + `lib/vk.ts`), which travels over postMessage to vk.com and is immune to browser-storage partitioning; reconcile on the VK launch before first paint (`reconcileVKPrefs`). The **locale rides this store on VK** (it has no other durable client home there); it is restored via low-level `setLocale`, so it never re-pushes over the server value. ## 2. Profile must not advertise a competing sign-in inside a host (ToS) Inside a proprietary Mini App host (VK or Telegram) the profile now shows **only email linking** — both the Telegram and VK link/unlink entries are hidden (`profileValidation.signInProvidersVisible`). Mirrors both ways (VK hides Telegram; Telegram hides VK). A provider linked earlier on the web stays attached, managed from the web; web/native builds are unchanged (show both). ## Tests - `vkprefs.test.ts` — codec round-trip / validation / onboarding (the wire-ish layer). - `profileValidation.test.ts` — `signInProvidersVisible` (the ToS gate). - Full local gate green: `svelte-check` 0 errors, `vitest` 646 passed, `vite build` ok. - **Item 2 host-gating needs on-contour visual verification** (VK + TG Mini App): no VK-host e2e harness exists and a TG-host assertion would be vacuous without a `vkLinked` mock account — disproportionate to build for a pure conditional render on already-tested platform predicates. ## Docs `ARCHITECTURE.md` (VK Bridge storage sync + the profile ToS host-gate), `FUNCTIONAL.md` (+`_ru`).
developer added 1 commit 2026-07-15 20:54:19 +00:00
fix(vk): persist settings via VK Bridge storage; hide competing sign-in in Mini App hosts
CI / changes (pull_request) Successful in 3s
Details
CI / unit (pull_request) Has been skipped
Details
CI / integration (pull_request) Has been skipped
Details
CI / ui (pull_request) Successful in 1m28s
Details
CI / conformance (pull_request) Successful in 16s
Details
CI / gate (pull_request) Successful in 0s
Details
CI / deploy (pull_request) Successful in 2m6s
Details
6c0daeb177 
VK moderation follow-ups.

1. Settings (theme, language, board style, reduce-motion, zoom, first-run
   coachmark flags) were lost between reloads in VK's desktop iframe: Firefox
   partitions/blocks IndexedDB and localStorage in a cross-origin iframe, so the
   browser-local store is empty on every reload (a plain tab / PWA keeps them —
   first-party storage — and Telegram has its own CloudStorage sync). Mirror the
   prefs (plus the locale, which has no other durable client home on VK) and the
   coachmark flags to VK Bridge storage (VKWebAppStorageSet/Get), which travels
   over postMessage to vk.com and survives; reconcile them on the VK launch
   before the first paint. The VK identity re-derives from the signed launch
   params each load, so the values reload onto the same account.

2. Inside a proprietary Mini App host (VK or Telegram) the profile now surfaces
   only email linking — both the Telegram and VK link/unlink entries are hidden
   (signInProvidersVisible), so a competing sign-in is never advertised (a
   platform ToS requirement; VK forbids showing a Telegram login, mirrored in
   Telegram for VK). A provider linked earlier on the web stays attached and is
   managed from the web; web/native builds show both.

Tests: vkprefs codec + signInProvidersVisible unit tests. Docs: ARCHITECTURE,
FUNCTIONAL (+_ru). No schema/wire change.
owner approved these changes 2026-07-16 17:12:24 +00:00
developer merged commit 69246eb0c0 into development 2026-07-16 17:12:46 +00:00
developer deleted branch feature/vk-moderation-fixes 2026-07-16 17:12:46 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
owner
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
owner (Ilia) developer
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: developer/scrabble-game#278
Delete Branch "feature/vk-moderation-fixes"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?